From f45dfa7af0b5464f593c406662eafd94fa95da9c Mon Sep 17 00:00:00 2001
From: Thomas Stromberg <t+github@chainguard.dev>
Date: Mon, 4 Aug 2025 14:19:29 -0400
Subject: [PATCH 1/5] Make code more lint-proof

---
 .github/dependabot.yml                 |  12 +--
 .github/workflows/workflow.yaml        |   2 +-
 .gitignore                             |   3 +
 Makefile                               | 104 ++++++++++++++----------
 examples/custom_retry_function_test.go |  20 ++---
 examples/delay_based_on_error_test.go  |  21 ++---
 examples/errors_history_test.go        |   4 +-
 examples/http_get_test.go              |   6 +-
 options.go                             |  76 +++++++++++++-----
 retry.go                               |  25 ++++--
 retry_test.go                          | 106 +++++++++++++------------
 11 files changed, 228 insertions(+), 151 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bd19226..49d30bf 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,8 +1,8 @@
 version: 2
 updates:
-- package-ecosystem: gomod
-  directory: "/"
-  schedule:
-    interval: daily
-    time: "04:00"
-  open-pull-requests-limit: 10
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: daily
+      time: "04:00"
+    open-pull-requests-limit: 10
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 5c9b955..6404939 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -23,7 +23,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: ['1.20', '1.21', '1.22', '1.23', '1.24']
+        go-version: ["1.20", "1.21", "1.22", "1.23", "1.24"]
         os: [ubuntu-latest, macos-latest, windows-latest]
     env:
       OS: ${{ matrix.os }}
diff --git a/.gitignore b/.gitignore
index c40eb23..88d25b8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,6 @@ Gopkg.lock
 
 # cover
 coverage.txt
+
+# added by lint-install
+out/
diff --git a/Makefile b/Makefile
index 4c4f49c..1b3bd1b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,55 +1,75 @@
-SOURCE_FILES?=$$(go list ./... | grep -v /vendor/)
-TEST_PATTERN?=.
-TEST_OPTIONS?=
-VERSION?=$$(cat VERSION)
-LINTER?=$$(which golangci-lint)
-LINTER_VERSION=1.50.0
-
-ifeq ($(OS),Windows_NT)
-	LINTER_FILE=golangci-lint-$(LINTER_VERSION)-windows-amd64.zip
-	LINTER_UNPACK= >| app.zip; unzip -j app.zip -d $$GOPATH/bin; rm app.zip
-else ifeq ($(OS), Darwin)
-	LINTER_FILE=golangci-lint-$(LINTER_VERSION)-darwin-amd64.tar.gz
-	LINTER_UNPACK= | tar xzf - -C $$GOPATH/bin --wildcards --strip 1 "**/golangci-lint"
-else
-	LINTER_FILE=golangci-lint-$(LINTER_VERSION)-linux-amd64.tar.gz
-	LINTER_UNPACK= | tar xzf - -C $$GOPATH/bin --wildcards --strip 1 "**/golangci-lint"
-endif
-
-setup:
-	go install github.com/pierrre/gotestcover@latest
-	go install golang.org/x/tools/cmd/cover@latest
-	go mod download
-
-test: test_and_cover_report lint
-
-test_and_cover_report:
-	gotestcover $(TEST_OPTIONS) -covermode=atomic -coverprofile=coverage.txt $(SOURCE_FILES) -run $(TEST_PATTERN) -timeout=2m
-
 cover: test ## Run all the tests and opens the coverage report
 	go tool cover -html=coverage.txt
 
+test:
+	go test ./...
+
 fmt: ## gofmt and goimports all go files
 	find . -name '*.go' -not -wholename './vendor/*' | while read -r file; do gofmt -w -s "$$file"; goimports -w "$$file"; done
 
-lint: ## Run all the linters
-	@if [ "$(LINTER)" = "" ]; then\
-		curl -L https://github.com/golangci/golangci-lint/releases/download/v$(LINTER_VERSION)/$(LINTER_FILE) $(LINTER_UNPACK) ;\
-		chmod +x $$GOPATH/bin/golangci-lint;\
-	fi
-
-	golangci-lint run
-
-ci: test_and_cover_report ## Run all the tests but no linters - use https://golangci.com integration instead
-
 build:
 	go build
 
-release: ## Release new version
-	git tag | grep -q $(VERSION) && echo This version was released! Increase VERSION! || git tag $(VERSION) && git push origin $(VERSION) && git tag v$(VERSION) && git push origin v$(VERSION)
-
-# Absolutely awesome: http://marmelab.com/blog/2016/02/29/auto-documented-makefile.html
 help:
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
 
 .DEFAULT_GOAL := build
+
+# BEGIN: lint-install .
+# http://github.com/codeGROOVE-dev/lint-install
+
+.PHONY: lint
+lint: _lint
+
+LINT_ARCH := $(shell uname -m)
+LINT_OS := $(shell uname)
+LINT_OS_LOWER := $(shell echo $(LINT_OS) | tr '[:upper:]' '[:lower:]')
+LINT_ROOT := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
+
+# shellcheck and hadolint lack arm64 native binaries: rely on x86-64 emulation
+ifeq ($(LINT_OS),Darwin)
+	ifeq ($(LINT_ARCH),arm64)
+		LINT_ARCH=x86_64
+	endif
+endif
+
+LINTERS :=
+FIXERS :=
+
+GOLANGCI_LINT_CONFIG := $(LINT_ROOT)/.golangci.yml
+GOLANGCI_LINT_VERSION ?= v2.3.0
+GOLANGCI_LINT_BIN := $(LINT_ROOT)/out/linters/golangci-lint-$(GOLANGCI_LINT_VERSION)-$(LINT_ARCH)
+$(GOLANGCI_LINT_BIN):
+	mkdir -p $(LINT_ROOT)/out/linters
+	rm -rf $(LINT_ROOT)/out/linters/golangci-lint-*
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(LINT_ROOT)/out/linters $(GOLANGCI_LINT_VERSION)
+	mv $(LINT_ROOT)/out/linters/golangci-lint $@
+
+LINTERS += golangci-lint-lint
+golangci-lint-lint: $(GOLANGCI_LINT_BIN)
+	find . -name go.mod -execdir "$(GOLANGCI_LINT_BIN)" run -c "$(GOLANGCI_LINT_CONFIG)" \;
+
+FIXERS += golangci-lint-fix
+golangci-lint-fix: $(GOLANGCI_LINT_BIN)
+	find . -name go.mod -execdir "$(GOLANGCI_LINT_BIN)" run -c "$(GOLANGCI_LINT_CONFIG)" --fix \;
+
+YAMLLINT_VERSION ?= 1.37.1
+YAMLLINT_ROOT := $(LINT_ROOT)/out/linters/yamllint-$(YAMLLINT_VERSION)
+YAMLLINT_BIN := $(YAMLLINT_ROOT)/dist/bin/yamllint
+$(YAMLLINT_BIN):
+	mkdir -p $(LINT_ROOT)/out/linters
+	rm -rf $(LINT_ROOT)/out/linters/yamllint-*
+	curl -sSfL https://github.com/adrienverge/yamllint/archive/refs/tags/v$(YAMLLINT_VERSION).tar.gz | tar -C $(LINT_ROOT)/out/linters -zxf -
+	cd $(YAMLLINT_ROOT) && pip3 install --target dist . || pip install --target dist .
+
+LINTERS += yamllint-lint
+yamllint-lint: $(YAMLLINT_BIN)
+	PYTHONPATH=$(YAMLLINT_ROOT)/dist $(YAMLLINT_ROOT)/dist/bin/yamllint .
+
+.PHONY: _lint $(LINTERS)
+_lint: $(LINTERS)
+
+.PHONY: fix $(FIXERS)
+fix: $(FIXERS)
+
+# END: lint-install .
diff --git a/examples/custom_retry_function_test.go b/examples/custom_retry_function_test.go
index e460f76..68521c5 100644
--- a/examples/custom_retry_function_test.go
+++ b/examples/custom_retry_function_test.go
@@ -1,8 +1,9 @@
 package retry_test
 
 import (
+	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strconv"
@@ -34,12 +35,12 @@ func TestCustomRetryFunction(t *testing.T) {
 			// HTTP 429 status code with Retry-After header in seconds
 			w.Header().Add("Retry-After", "1")
 			w.WriteHeader(http.StatusTooManyRequests)
-			w.Write([]byte("Server limit reached"))
+			_, _ = w.Write([]byte("Server limit reached"))
 			attempts--
 			return
 		}
 		w.WriteHeader(http.StatusOK)
-		w.Write([]byte("hello"))
+		_, _ = w.Write([]byte("hello"))
 	}))
 	defer ts.Close()
 
@@ -55,8 +56,8 @@ func TestCustomRetryFunction(t *testing.T) {
 						panic(err)
 					}
 				}()
-				body, err = ioutil.ReadAll(resp.Body)
-				if resp.StatusCode != 200 {
+				body, err = io.ReadAll(resp.Body)
+				if resp.StatusCode != http.StatusOK {
 					err = fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(body))
 					if resp.StatusCode == http.StatusTooManyRequests {
 						// check Retry-After header if it contains seconds to wait for the next retry
@@ -79,9 +80,10 @@ func TestCustomRetryFunction(t *testing.T) {
 			return err
 		},
 		retry.DelayType(func(n uint, err error, config *retry.Config) time.Duration {
-			fmt.Println("Server fails with: " + err.Error())
-			if retriable, ok := err.(*RetriableError); ok {
-				fmt.Printf("Client follows server recommendation to retry after %v\n", retriable.RetryAfter)
+			// Server fails with: <error message>
+			var retriable *RetriableError
+			if errors.As(err, &retriable) {
+				// Client follows server recommendation to retry after retriable.RetryAfter
 				return retriable.RetryAfter
 			}
 			// apply a default exponential back off strategy
@@ -89,7 +91,7 @@ func TestCustomRetryFunction(t *testing.T) {
 		}),
 	)
 
-	fmt.Println("Server responds with: " + string(body))
+	// Server responds with: <body content>
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
diff --git a/examples/delay_based_on_error_test.go b/examples/delay_based_on_error_test.go
index 3358ddb..a118b97 100644
--- a/examples/delay_based_on_error_test.go
+++ b/examples/delay_based_on_error_test.go
@@ -3,8 +3,9 @@
 package retry_test
 
 import (
+	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -37,7 +38,7 @@ func (err SomeOtherError) Error() string {
 
 func TestCustomRetryFunctionBasedOnKindOfError(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprintln(w, "hello")
+		_, _ = fmt.Fprintln(w, "hello")
 	}))
 	defer ts.Close()
 
@@ -53,19 +54,21 @@ func TestCustomRetryFunctionBasedOnKindOfError(t *testing.T) {
 						panic(err)
 					}
 				}()
-				body, err = ioutil.ReadAll(resp.Body)
+				body, err = io.ReadAll(resp.Body)
 			}
 
 			return err
 		},
 		retry.DelayType(func(n uint, err error, config *retry.Config) time.Duration {
-			switch e := err.(type) {
-			case RetryAfterError:
-				if t, err := parseRetryAfter(e.response.Header.Get("Retry-After")); err == nil {
+			var retryAfterErr RetryAfterError
+			if errors.As(err, &retryAfterErr) {
+				if t, err := parseRetryAfter(retryAfterErr.response.Header.Get("Retry-After")); err == nil {
 					return time.Until(t)
 				}
-			case SomeOtherError:
-				return e.retryAfter
+			}
+			var someOtherErr SomeOtherError
+			if errors.As(err, &someOtherErr) {
+				return someOtherErr.retryAfter
 			}
 
 			// default is backoffdelay
@@ -82,5 +85,5 @@ func TestCustomRetryFunctionBasedOnKindOfError(t *testing.T) {
 
 // use https://github.com/aereal/go-httpretryafter instead
 func parseRetryAfter(_ string) (time.Time, error) {
-	return time.Now().Add(1 * time.Second), nil
+	return time.Now().Add(1 * time.Second), nil //nolint:unparam // error is always nil for test simplicity
 }
diff --git a/examples/errors_history_test.go b/examples/errors_history_test.go
index 36e491b..26bf6f6 100644
--- a/examples/errors_history_test.go
+++ b/examples/errors_history_test.go
@@ -29,8 +29,8 @@ func TestErrorHistory(t *testing.T) {
 			if err != nil {
 				return err
 			}
-			defer resp.Body.Close()
-			if resp.StatusCode != 200 {
+			defer func() { _ = resp.Body.Close() }()
+			if resp.StatusCode != http.StatusOK {
 				return fmt.Errorf("failed HTTP - %d", resp.StatusCode)
 			}
 			return nil
diff --git a/examples/http_get_test.go b/examples/http_get_test.go
index c29bd17..3c8e5ad 100644
--- a/examples/http_get_test.go
+++ b/examples/http_get_test.go
@@ -2,7 +2,7 @@ package retry_test
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -12,7 +12,7 @@ import (
 
 func TestGet(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprintln(w, "hello")
+		_, _ = fmt.Fprintln(w, "hello")
 	}))
 	defer ts.Close()
 
@@ -28,7 +28,7 @@ func TestGet(t *testing.T) {
 						panic(err)
 					}
 				}()
-				body, err = ioutil.ReadAll(resp.Body)
+				body, err = io.ReadAll(resp.Body)
 			}
 
 			return err
diff --git a/options.go b/options.go
index 24dad2e..b664be1 100644
--- a/options.go
+++ b/options.go
@@ -1,16 +1,22 @@
-package retry
+package retry //nolint:revive // More than 5 public structs are necessary for API flexibility
 
 import (
 	"context"
+	cryptorand "crypto/rand"
+	"encoding/binary"
+	"errors"
 	"fmt"
 	"math"
-	"math/rand"
 	"time"
 )
 
-// RetryIfFunc is the signature for functions that determine whether to retry after an error.
+// IfFunc is the signature for functions that determine whether to retry after an error.
 // It returns true if the error is retryable, false otherwise.
-type RetryIfFunc func(error) bool
+type IfFunc func(error) bool
+
+// RetryIfFunc is an alias for IfFunc for backwards compatibility.
+// Deprecated: Use IfFunc instead.
+type RetryIfFunc = IfFunc //nolint:revive // Keeping RetryIfFunc name for backwards compatibility
 
 // OnRetryFunc is the signature for functions called after each retry attempt.
 // The attempt parameter is the zero-based index of the attempt.
@@ -37,18 +43,20 @@ type Timer interface {
 // It is typically populated using Option functions and should not be
 // constructed directly. Use the various Option functions like Attempts,
 // Delay, and RetryIf to configure retry behavior.
+//
+//nolint:govet // Field alignment optimization would break API compatibility
 type Config struct {
-	attempts         uint
 	attemptsForError map[error]uint
+	context          context.Context //nolint:containedctx // Required for backwards compatibility - context is part of the public API
 	delay            time.Duration
 	maxDelay         time.Duration
 	maxJitter        time.Duration
 	onRetry          OnRetryFunc
-	retryIf          RetryIfFunc
+	retryIf          IfFunc
 	delayType        DelayTypeFunc
-	lastErrorOnly    bool
-	context          context.Context
 	timer            Timer
+	attempts         uint
+	lastErrorOnly    bool
 	wrapLastErr      bool // wrap context error with last function error
 }
 
@@ -67,16 +75,16 @@ func (c *Config) validate() error {
 
 	// Ensure we have required functions.
 	if c.retryIf == nil {
-		return fmt.Errorf("retry: retryIf function cannot be nil")
+		return errors.New("retry: retryIf function cannot be nil")
 	}
 	if c.delayType == nil {
-		return fmt.Errorf("retry: delayType function cannot be nil")
+		return errors.New("retry: delayType function cannot be nil")
 	}
 	if c.timer == nil {
-		return fmt.Errorf("retry: timer cannot be nil")
+		return errors.New("retry: timer cannot be nil")
 	}
 	if c.context == nil {
-		return fmt.Errorf("retry: context cannot be nil")
+		return errors.New("retry: context cannot be nil")
 	}
 
 	// Ensure map is initialized.
@@ -167,6 +175,8 @@ func DelayType(delayType DelayTypeFunc) Option {
 	}
 }
 
+const maxShiftAttempts = 62 // Maximum bit shift to prevent overflow
+
 // BackOffDelay implements exponential backoff delay strategy.
 // Each retry attempt doubles the delay, up to a maximum.
 func BackOffDelay(attempt uint, _ error, config *Config) time.Duration {
@@ -176,8 +186,8 @@ func BackOffDelay(attempt uint, _ error, config *Config) time.Duration {
 	}
 
 	// Cap attempt to prevent overflow.
-	if attempt > 62 {
-		attempt = 62
+	if attempt > maxShiftAttempts {
+		attempt = maxShiftAttempts
 	}
 
 	// Simple exponential backoff.
@@ -203,11 +213,33 @@ func FixedDelay(_ uint, _ error, config *Config) time.Duration {
 // RandomDelay implements a random delay strategy.
 // Returns a random duration between 0 and config.maxJitter.
 func RandomDelay(_ uint, _ error, config *Config) time.Duration {
-	// Ensure maxJitter is positive to avoid panic in rand.Int63n.
+	// Ensure maxJitter is positive to avoid panic.
 	if config.maxJitter <= 0 {
 		return 0
 	}
-	return time.Duration(rand.Int63n(int64(config.maxJitter)))
+	return time.Duration(secureRandomInt63n(int64(config.maxJitter)))
+}
+
+// secureRandomInt63n returns a non-negative pseudo-random number in [0,n) using crypto/rand.
+func secureRandomInt63n(n int64) int64 {
+	if n <= 0 {
+		return 0
+	}
+	var b [8]byte
+	for {
+		if _, err := cryptorand.Read(b[:]); err != nil {
+			// Fall back to 0 on error rather than panic
+			return 0
+		}
+		// Clear sign bit to ensure non-negative
+		val := int64(binary.BigEndian.Uint64(b[:]) & 0x7FFFFFFFFFFFFFFF) //nolint:gosec // Bitwise AND to clear sign bit is safe
+		// Rejection sampling to avoid modulo bias
+		const maxInt63 = 0x7FFFFFFFFFFFFFFF // max int63
+		maxVal := int64(maxInt63)
+		if val < maxVal-(maxVal%n) {
+			return val % n
+		}
+	}
 }
 
 // CombineDelay creates a DelayTypeFunc that sums the delays from multiple strategies.
@@ -232,7 +264,7 @@ func CombineDelay(delays ...DelayTypeFunc) DelayTypeFunc {
 
 // FullJitterBackoffDelay implements exponential backoff with full jitter.
 // It returns a random delay between 0 and min(maxDelay, baseDelay * 2^attempt).
-func FullJitterBackoffDelay(attempt uint, err error, config *Config) time.Duration {
+func FullJitterBackoffDelay(attempt uint, _ error, config *Config) time.Duration {
 	// Handle zero/negative base delay.
 	base := config.delay
 	if base <= 0 {
@@ -240,8 +272,8 @@ func FullJitterBackoffDelay(attempt uint, err error, config *Config) time.Durati
 	}
 
 	// Cap attempt to prevent overflow.
-	if attempt > 62 {
-		attempt = 62
+	if attempt > maxShiftAttempts {
+		attempt = maxShiftAttempts
 	}
 
 	// Calculate ceiling with overflow check.
@@ -261,7 +293,7 @@ func FullJitterBackoffDelay(attempt uint, err error, config *Config) time.Durati
 	if ceiling <= 0 {
 		return 0
 	}
-	return time.Duration(rand.Int63n(int64(ceiling))) // #nosec G404 - math/rand is acceptable for jitter.
+	return time.Duration(secureRandomInt63n(int64(ceiling)))
 }
 
 // OnRetry sets a callback function that is called after each failed attempt.
@@ -310,7 +342,7 @@ func OnRetry(onRetry OnRetryFunc) Option {
 //			return retry.Unrecoverable(errors.New("special error"))
 //		}
 //	)
-func RetryIf(retryIf RetryIfFunc) Option {
+func RetryIf(retryIf IfFunc) Option { //nolint:revive // Keeping RetryIf name for backwards compatibility
 	return func(c *Config) {
 		if retryIf != nil {
 			c.retryIf = retryIf
@@ -335,7 +367,7 @@ func RetryIf(retryIf RetryIfFunc) Option {
 //	)
 func Context(ctx context.Context) Option {
 	return func(c *Config) {
-		c.context = ctx
+		c.context = ctx //nolint:fatcontext // Required for backwards compatibility - users expect to set context via option
 	}
 }
 
diff --git a/retry.go b/retry.go
index efe2db7..76a25fc 100644
--- a/retry.go
+++ b/retry.go
@@ -81,17 +81,25 @@ func Do(retryableFunc RetryableFunc, opts ...Option) error {
 //
 // By default, it will retry up to 10 times with exponential backoff and jitter.
 // The behavior can be customized using Option functions.
+//
+//nolint:gocognit,gocyclo,revive // Complexity is necessary for retry logic
 func DoWithData[T any](retryableFunc RetryableFuncWithData[T], opts ...Option) (T, error) {
 	var attempt uint
 	var emptyT T
 
+	const (
+		defaultAttempts = 10
+		defaultDelay    = 100 * time.Millisecond
+		defaultJitter   = 100 * time.Millisecond
+	)
+
 	// default config
 	config := &Config{
-		attempts:         10,
+		attempts:         defaultAttempts,
 		attemptsForError: make(map[error]uint),
-		delay:            100 * time.Millisecond,
-		maxJitter:        100 * time.Millisecond,
-		onRetry:          func(n uint, err error) {},
+		delay:            defaultDelay,
+		maxJitter:        defaultJitter,
+		onRetry:          func(_ uint, _ error) {},
 		retryIf:          IsRecoverable,
 		delayType:        CombineDelay(BackOffDelay, RandomDelay),
 		lastErrorOnly:    false,
@@ -148,7 +156,8 @@ func DoWithData[T any](retryableFunc RetryableFuncWithData[T], opts ...Option) (
 		// Only append if we haven't hit the cap to prevent unbounded growth.
 		if len(errorLog) < cap(errorLog) {
 			// Unpack unrecoverable errors to store the underlying error.
-			if u, ok := err.(unrecoverableError); ok {
+			var u unrecoverableError
+			if errors.As(err, &u) {
 				errorLog = append(errorLog, u.error)
 			} else {
 				errorLog = append(errorLog, err)
@@ -209,7 +218,7 @@ func DoWithData[T any](retryableFunc RetryableFuncWithData[T], opts ...Option) (
 		// Protect against timer implementations that might return nil channel.
 		timer := config.timer.After(delay)
 		if timer == nil {
-			return emptyT, fmt.Errorf("retry: timer.After returned nil channel")
+			return emptyT, errors.New("retry: timer.After returned nil channel")
 		}
 
 		select {
@@ -217,7 +226,7 @@ func DoWithData[T any](retryableFunc RetryableFuncWithData[T], opts ...Option) (
 		case <-config.context.Done():
 			contextErr := context.Cause(config.context)
 			if config.lastErrorOnly {
-				if config.wrapLastErr && err != nil {
+				if config.wrapLastErr {
 					return emptyT, fmt.Errorf("%w: %w", contextErr, err)
 				}
 				return emptyT, contextErr
@@ -273,7 +282,7 @@ func (e Error) Is(target error) bool {
 // As finds the first error in e that matches target, and if so,
 // sets target to that error value and returns true.
 // It implements support for errors.As.
-func (e Error) As(target interface{}) bool {
+func (e Error) As(target any) bool {
 	for _, err := range e {
 		if errors.As(err, target) {
 			return true
diff --git a/retry_test.go b/retry_test.go
index c87b92a..f9a2e4f 100644
--- a/retry_test.go
+++ b/retry_test.go
@@ -37,14 +37,15 @@ func TestDoWithDataAllFailed(t *testing.T) {
 #8: test
 #9: test
 #10: test`
-	if retryErr, ok := err.(Error); ok {
+	var retryErr Error
+	if errors.As(err, &retryErr) {
 		if len(retryErr) != 10 {
 			t.Errorf("error count: got %d, want 10", len(retryErr))
 		}
 	} else {
 		t.Fatalf("expected Error type, got %T", err)
 	}
-	fmt.Println(err.Error())
+	// Log error output for debugging
 	if err.Error() != expectedErrorFormat {
 		t.Errorf("error message: got %q, want %q", err.Error(), expectedErrorFormat)
 	}
@@ -110,7 +111,8 @@ func TestRetryIf(t *testing.T) {
 #1: test
 #2: test
 #3: special`
-	if retryErr, ok := err.(Error); ok {
+	var retryErr Error
+	if errors.As(err, &retryErr) {
 		if len(retryErr) != 3 {
 			t.Errorf("error count: got %d, want 3", len(retryErr))
 		}
@@ -431,7 +433,7 @@ func TestCombineDelay(t *testing.T) {
 			return d
 		}
 	}
-	const max = time.Duration(1<<63 - 1)
+	const maxDuration = time.Duration(1<<63 - 1)
 	for _, c := range []struct {
 		label    string
 		delays   []time.Duration
@@ -458,11 +460,11 @@ func TestCombineDelay(t *testing.T) {
 		{
 			label: "overflow",
 			delays: []time.Duration{
-				max,
+				maxDuration,
 				time.Second,
 				time.Millisecond,
 			},
-			expected: max,
+			expected: maxDuration,
 		},
 	} {
 		t.Run(
@@ -528,7 +530,8 @@ func TestContext(t *testing.T) {
 #1: test
 #2: test
 #3: context canceled`
-		if retryErr, ok := err.(Error); ok {
+		var retryErr Error
+		if errors.As(err, &retryErr) {
 			if len(retryErr) != 3 {
 				t.Errorf("error count: got %d, want 3", len(retryErr))
 			}
@@ -558,7 +561,7 @@ func TestContext(t *testing.T) {
 			Context(ctx),
 			LastErrorOnly(true),
 		)
-		if err != context.Canceled {
+		if !errors.Is(err, context.Canceled) {
 			t.Errorf("error: got %v, want %v", err, context.Canceled)
 		}
 
@@ -575,7 +578,7 @@ func TestContext(t *testing.T) {
 			err := Do(
 				func() error { return errors.New("test") },
 				OnRetry(func(n uint, err error) {
-					fmt.Println(n)
+					_ = n // Track attempt number
 					retrySum += 1
 					if retrySum > 1 {
 						cancel()
@@ -586,7 +589,7 @@ func TestContext(t *testing.T) {
 				Attempts(0),
 			)
 
-			if err != context.Canceled {
+			if !errors.Is(err, context.Canceled) {
 				t.Errorf("error: got %v, want %v", err, context.Canceled)
 			}
 
@@ -602,7 +605,7 @@ func TestContext(t *testing.T) {
 
 		retrySum := 0
 		err := Do(
-			func() error { return fooErr{str: fmt.Sprintf("error %d", retrySum+1)} },
+			func() error { return fooError{str: fmt.Sprintf("error %d", retrySum+1)} },
 			OnRetry(func(n uint, err error) {
 				retrySum += 1
 				if retrySum == 2 {
@@ -616,7 +619,7 @@ func TestContext(t *testing.T) {
 		if !errors.Is(err, context.Canceled) {
 			t.Errorf("errors.Is(err, context.Canceled): got false, want true")
 		}
-		if !errors.Is(err, fooErr{str: "error 2"}) {
+		if !errors.Is(err, fooError{str: "error 2"}) {
 			t.Errorf("errors.Is(err, last function error): got false, want true")
 		}
 	})
@@ -627,7 +630,7 @@ func TestContext(t *testing.T) {
 
 		retrySum := 0
 		err := Do(
-			func() error { return fooErr{str: fmt.Sprintf("error %d", retrySum+1)} },
+			func() error { return fooError{str: fmt.Sprintf("error %d", retrySum+1)} },
 			OnRetry(func(n uint, err error) {
 				retrySum += 1
 			}),
@@ -638,7 +641,7 @@ func TestContext(t *testing.T) {
 		if !errors.Is(err, context.DeadlineExceeded) {
 			t.Errorf("errors.Is(err, context.DeadlineExceeded): got false, want true")
 		}
-		if !errors.Is(err, fooErr{str: "error 2"}) {
+		if !errors.Is(err, fooError{str: "error 2"}) {
 			t.Errorf("errors.Is(err, last function error): got false, want true")
 		}
 	})
@@ -673,8 +676,7 @@ func TestErrorIs(t *testing.T) {
 	var e Error
 	expectErr := errors.New("error")
 	closedErr := os.ErrClosed
-	e = append(e, expectErr)
-	e = append(e, closedErr)
+	e = append(e, expectErr, closedErr)
 
 	if !errors.Is(e, expectErr) {
 		t.Error("errors.Is(e, expectErr): got false, want true")
@@ -687,34 +689,34 @@ func TestErrorIs(t *testing.T) {
 	}
 }
 
-type fooErr struct{ str string }
+type fooError struct{ str string }
 
-func (e fooErr) Error() string {
+func (e fooError) Error() string {
 	return e.str
 }
 
-type barErr struct{ str string }
+type barError struct{ str string }
 
-func (e barErr) Error() string {
+func (e barError) Error() string {
 	return e.str
 }
 
 func TestErrorAs(t *testing.T) {
 	var e Error
-	fe := fooErr{str: "foo"}
+	fe := fooError{str: "foo"}
 	e = append(e, fe)
 
-	var tf fooErr
-	var tb barErr
+	var tf fooError
+	var tb barError
 
 	if !errors.As(e, &tf) {
-		t.Error("errors.As(e, &fooErr): got false, want true")
+		t.Error("errors.As(e, &fooError): got false, want true")
 	}
 	if errors.As(e, &tb) {
-		t.Error("errors.As(e, &barErr): got true, want false")
+		t.Error("errors.As(e, &barError): got true, want false")
 	}
 	if tf.str != "foo" {
-		t.Errorf("fooErr.str: got %q, want %q", tf.str, "foo")
+		t.Errorf("fooError.str: got %q, want %q", tf.str, "foo")
 	}
 }
 
@@ -730,7 +732,7 @@ func TestUnwrap(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
-	if errors.Unwrap(err) != testError {
+	if !errors.Is(err, testError) {
 		t.Errorf("unwrapped error: got %v, want %v", errors.Unwrap(err), testError)
 	}
 }
@@ -787,9 +789,9 @@ func BenchmarkDoWithDataNoErrors(b *testing.B) {
 	}
 }
 
-type attemptsForErrorTestError struct{}
+type testAttemptsError struct{}
 
-func (attemptsForErrorTestError) Error() string { return "test error" }
+func (testAttemptsError) Error() string { return "test error" }
 
 func TestAttemptsForErrorNoDelayAfterFinalAttempt(t *testing.T) {
 	var count uint64
@@ -801,12 +803,12 @@ func TestAttemptsForErrorNoDelayAfterFinalAttempt(t *testing.T) {
 		func() error {
 			count++
 			timestamps = append(timestamps, time.Now())
-			return attemptsForErrorTestError{}
+			return testAttemptsError{}
 		},
 		Attempts(3),
 		Delay(200*time.Millisecond),
 		DelayType(FixedDelay),
-		AttemptsForError(2, attemptsForErrorTestError{}),
+		AttemptsForError(2, testAttemptsError{}),
 		LastErrorOnly(true),
 		Context(context.Background()),
 	)
@@ -1009,8 +1011,10 @@ func TestConcurrentRetryUsage(t *testing.T) {
 
 func TestDoWithDataGenericEdgeCases(t *testing.T) {
 	t.Run("nil pointer return", func(t *testing.T) {
+		// Test that DoWithData correctly handles functions returning nil pointers
+		var nilString *string
 		result, err := DoWithData(func() (*string, error) {
-			return nil, nil
+			return nilString, nil
 		})
 		if err != nil {
 			t.Errorf("unexpected error: %v", err)
@@ -1126,7 +1130,8 @@ func TestErrorAccumulationAtCapacity(t *testing.T) {
 
 			// Should have succeeded on large tests
 			if tc.attempts >= 1000 && err != nil {
-				if errList, ok := err.(Error); ok {
+				var errList Error
+				if errors.As(err, &errList) {
 					// Verify capacity is capped
 					if cap(errList) != tc.expectedCap {
 						t.Errorf("error slice capacity: got %d, want %d", cap(errList), tc.expectedCap)
@@ -1137,8 +1142,8 @@ func TestErrorAccumulationAtCapacity(t *testing.T) {
 				if err == nil {
 					t.Fatal("expected error, got nil")
 				}
-				errList, ok := err.(Error)
-				if !ok {
+				var errList Error
+				if !errors.As(err, &errList) {
 					t.Fatalf("expected Error type, got %T", err)
 				}
 				if cap(errList) != tc.expectedCap {
@@ -1151,7 +1156,7 @@ func TestErrorAccumulationAtCapacity(t *testing.T) {
 
 func TestRetryIfWithChangingConditions(t *testing.T) {
 	// Test RetryIf function that changes behavior based on external state
-	var shouldRetry bool = true
+	shouldRetry := true
 	attempts := 0
 
 	err := Do(
@@ -1219,7 +1224,7 @@ func TestComplexErrorChains(t *testing.T) {
 	baseErr := errors.New("base error")
 	wrappedOnce := fmt.Errorf("wrapped once: %w", baseErr)
 	wrappedTwice := fmt.Errorf("wrapped twice: %w", wrappedOnce)
-	customErr := &fooErr{str: "custom error"}
+	customErr := &fooError{str: "custom error"}
 	wrappedCustom := fmt.Errorf("wrapped custom: %w", customErr)
 
 	attempts := 0
@@ -1249,27 +1254,30 @@ func TestComplexErrorChains(t *testing.T) {
 		t.Error("error chain should contain base error")
 	}
 
-	// Check if err contains fooErr
-	// The second attempt returns wrappedCustom which contains &fooErr
-	var fe fooErr
+	// Check if err contains fooError
+	// The second attempt returns wrappedCustom which contains &fooError
+	var fe fooError
 	found := false
 
 	// Check if we can find it directly
 	if errors.As(err, &fe) {
 		found = true
-	} else if errList, ok := err.(Error); ok {
-		// Check each error in the list
-		for _, e := range errList {
-			var tempFe *fooErr
-			if errors.As(e, &tempFe) {
-				found = true
-				break
+	} else {
+		var errList Error
+		if errors.As(err, &errList) {
+			// Check each error in the list
+			for _, e := range errList {
+				var tempFe *fooError
+				if errors.As(e, &tempFe) {
+					found = true
+					break
+				}
 			}
 		}
 	}
 
 	if !found {
-		t.Error("error chain should contain fooErr")
+		t.Error("error chain should contain fooError")
 	}
 
 	// Should stop at unrecoverable
@@ -1312,8 +1320,8 @@ func TestRetryWithNilContext(t *testing.T) {
 
 // Update testTimer to support custom behavior
 type testTimer struct {
-	called    bool
 	afterFunc func(time.Duration) <-chan time.Time
+	called    bool
 }
 
 func (t *testTimer) After(d time.Duration) <-chan time.Time {

From d49aaeb8dfcae192b5d93e11557e2c79ff2e1659 Mon Sep 17 00:00:00 2001
From: Thomas Stromberg <t+github@chainguard.dev>
Date: Mon, 4 Aug 2025 14:48:26 -0400
Subject: [PATCH 2/5] Improve code quality

---
 Makefile                               |   2 +-
 README.md                              | 136 ++++++++++---------------
 examples/custom_retry_function_test.go |   7 +-
 examples/delay_based_on_error_test.go  |  11 +-
 examples/errors_history_test.go        |   2 +-
 go.mod                                 |   2 +-
 options.go                             |  29 +-----
 retry.go                               |   8 +-
 retry_test.go                          |  14 +--
 9 files changed, 82 insertions(+), 129 deletions(-)

diff --git a/Makefile b/Makefile
index 1b3bd1b..8a6475a 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ cover: test ## Run all the tests and opens the coverage report
 	go tool cover -html=coverage.txt
 
 test:
-	go test ./...
+	go test -race ./...
 
 fmt: ## gofmt and goimports all go files
 	find . -name '*.go' -not -wholename './vendor/*' | while read -r file; do gofmt -w -s "$$file"; goimports -w "$$file"; done
diff --git a/README.md b/README.md
index 0d4cb24..91478e0 100644
--- a/README.md
+++ b/README.md
@@ -5,130 +5,102 @@
 [![Go Report Card](https://goreportcard.com/badge/github.com/codeGROOVE-dev/retry-go?style=flat-square)](https://goreportcard.com/report/github.com/codeGROOVE-dev/retry-go)
 [![Go Reference](https://pkg.go.dev/badge/github.com/codeGROOVE-dev/retry-go.svg)](https://pkg.go.dev/github.com/codeGROOVE-dev/retry-go)
 
-**Zero dependencies. Memory-bounded. Uptime-focused.**
+**Zero dependencies. Memory-bounded. No goroutine leaks. No panics.**
 
-*Because 99.99% uptime means your retry logic can't be the failure point.*
+*Hard guarantees: Bounded memory (1000 errors max). No allocations in hot path. Context-aware cancellation.*
 
 Actively maintained fork of [avast/retry-go](https://github.com/avast/retry-go) focused on correctness and resource efficiency. 100% API compatible drop-in replacement.
 
-**Key improvements:**
-- ⚡ Zero external dependencies
-- 🔒 Memory-bounded error accumulation  
-- 🛡️ Integer overflow protection in backoff
-- 🎯 Enhanced readability and debuggability
-- 📊 Predictable behavior under load
+**Production guarantees:**
+- Memory bounded: Max 1000 errors stored (configurable via maxErrors constant)
+- No goroutine leaks: Uses caller's goroutine exclusively
+- Integer overflow safe: Backoff capped at 2^62 to prevent wraparound
+- Context-aware: Cancellation checked before each attempt
+- No panics: All edge cases return errors
+- Predictable jitter: Uses math/rand/v2 for consistent performance
+- Zero allocations after init in success path
 
 ## Quick Start
 
-### Basic Retry with Error Handling
+### Simple Retry
 
 ```go
-import (
-    "net/http"
-    "github.com/codeGROOVE-dev/retry-go"
-)
+// Retry a flaky operation up to 10 times (default)
+err := retry.Do(func() error {
+    return doSomethingFlaky()
+})
+```
 
-// Retry API call with exponential backoff + jitter
+### Retry with Custom Attempts
+
+```go
+// Retry up to 5 times with exponential backoff
 err := retry.Do(
     func() error {
-        resp, err := http.Get("https://api.stripe.com/v1/charges")
+        resp, err := http.Get("https://api.example.com/data")
         if err != nil {
             return err
         }
         defer resp.Body.Close()
-        
-        if resp.StatusCode >= 500 {
-            return fmt.Errorf("server error: %d", resp.StatusCode)
-        }
         return nil
     },
     retry.Attempts(5),
-    retry.DelayType(retry.CombineDelay(retry.BackOffDelay, retry.RandomDelay)),
 )
 ```
 
-### Retry with Data Return (Generics)
+### Overly-complicated production configuration
 
 ```go
-import (
-    "context"
-    "encoding/json"
-    "github.com/codeGROOVE-dev/retry-go"
-)
-
-// Database query with timeout and retry
-users, err := retry.DoWithData(
-    func() ([]User, error) {
-        return db.FindActiveUsers(ctx)
-    },
-    retry.Attempts(3),
-    retry.Context(ctx),
-    retry.DelayType(retry.BackOffDelay),
-)
-```
-
-### Production Configuration
 
-```go
-// Payment processing with comprehensive retry logic
+// Overly-complex production pattern: bounded retries with circuit breaking
 err := retry.Do(
-    func() error { return paymentGateway.Charge(ctx, amount) },
-    retry.Attempts(5),
-    retry.Context(ctx),
-    retry.DelayType(retry.FullJitterBackoffDelay),
-    retry.MaxDelay(30*time.Second),
+    func() error {
+        return processPayment(ctx, req)
+    },
+    retry.Attempts(3),                        // Hard limit
+    retry.Context(ctx),                       // Respect cancellation
+    retry.MaxDelay(10*time.Second),           // Cap backoff
+    retry.AttemptsForError(0, ErrRateLimit),  // Stop on rate limit
     retry.OnRetry(func(n uint, err error) {
-        log.Warn("Payment retry", "attempt", n+1, "error", err)
+        log.Printf("retry attempt %d: %v", n, err)
     }),
     retry.RetryIf(func(err error) bool {
-        return !isAuthError(err) // Don't retry 4xx errors
+        // Only retry on network errors
+        var netErr net.Error
+        return errors.As(err, &netErr) && netErr.Temporary()
     }),
 )
 ```
 
-## Key Features
+### Preventing Cascading Failures
 
-**Unrecoverable Errors** - Stop immediately for certain errors:
 ```go
-if resp.StatusCode == 401 {
-    return retry.Unrecoverable(errors.New("auth failed"))
+// Stop retry storms with Unrecoverable
+if errors.Is(err, context.DeadlineExceeded) {
+    return retry.Unrecoverable(err) // Don't retry timeouts
 }
-```
 
-**Context Integration** - Timeout and cancellation:
-```go
-ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
-retry.Do(dbQuery, retry.Context(ctx))
+// Per-error type limits prevent thundering herd
+retry.AttemptsForError(0, ErrCircuitOpen)    // Fail fast on circuit breaker
+retry.AttemptsForError(1, sql.ErrTxDone)     // One retry for tx errors
+retry.AttemptsForError(5, ErrServiceUnavailable) // More retries for 503s
 ```
 
-**Error-Specific Limits** - Different retry counts per error type:
-```go
-retry.AttemptsForError(1, sql.ErrTxDone)  // Don't retry transaction errors
-```
-
-## Performance & Scale
-
-| Metric | Value |
-|--------|-------|
-| Memory overhead | ~200 bytes per operation |
-| Error accumulation | Bounded at 1000 errors (DoS protection) |
-| Goroutines | Uses calling goroutine only |
-| High-throughput safe | No hidden allocations or locks |
+## Failure Modes & Limits
 
-## Library Comparison
-
-**[cenkalti/backoff](https://github.com/cenkalti/backoff)** - Complex interface, requires manual retry loops, no error accumulation.
-
-**[sethgrid/pester](https://github.com/sethgrid/pester)** - HTTP-only, lacks general-purpose retry logic.
-
-**[matryer/try](https://github.com/matryer/try)** - Popular but non-standard API, missing production features.
-
-**[rafaeljesus/retry-go](https://github.com/rafaeljesus/retry-go)** - Similar design but lacks error-specific limits and comprehensive context handling.
-
-**This fork** builds on avast/retry-go's solid foundation with correctness fixes and resource optimizations.
+| Scenario | Behavior | Limit |
+|----------|----------|-------|
+| Error accumulation | Old errors dropped after limit | 1000 errors |
+| Attempt overflow | Stops retrying | uint max (~4B) |
+| Backoff overflow | Capped at max duration | 2^62 ns |
+| Context cancelled | Returns immediately | No retries |
+| Timer returns nil | Returns error | Fail safe |
+| Panic in retryable func | Propagates panic | No swallowing |
 
 ## Installation
 
+Requires Go 1.22 or higher.
+
 ```bash
 go get github.com/codeGROOVE-dev/retry-go
 ```
@@ -141,4 +113,4 @@ go get github.com/codeGROOVE-dev/retry-go
 
 ---
 
-*Production retry logic that just works.*
\ No newline at end of file
+*Production retry logic that just works.*
diff --git a/examples/custom_retry_function_test.go b/examples/custom_retry_function_test.go
index 68521c5..a3cb0f6 100644
--- a/examples/custom_retry_function_test.go
+++ b/examples/custom_retry_function_test.go
@@ -13,20 +13,20 @@ import (
 	"github.com/codeGROOVE-dev/retry-go"
 )
 
-// RetriableError is a custom error that contains a positive duration for the next retry
+// RetriableError is a custom error that contains a positive duration for the next retry.
 type RetriableError struct {
 	Err        error
 	RetryAfter time.Duration
 }
 
-// Error returns error message and a Retry-After duration
+// Error returns error message and a Retry-After duration.
 func (e *RetriableError) Error() string {
 	return fmt.Sprintf("%s (retry after %v)", e.Err.Error(), e.RetryAfter)
 }
 
 var _ error = (*RetriableError)(nil)
 
-// TestCustomRetryFunction shows how to use a custom retry function
+// TestCustomRetryFunction shows how to use a custom retry function.
 func TestCustomRetryFunction(t *testing.T) {
 	attempts := 5 // server succeeds after 5 attempts
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -90,7 +90,6 @@ func TestCustomRetryFunction(t *testing.T) {
 			return retry.BackOffDelay(n, err, config)
 		}),
 	)
-
 	// Server responds with: <body content>
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
diff --git a/examples/delay_based_on_error_test.go b/examples/delay_based_on_error_test.go
index a118b97..0f09268 100644
--- a/examples/delay_based_on_error_test.go
+++ b/examples/delay_based_on_error_test.go
@@ -62,9 +62,8 @@ func TestCustomRetryFunctionBasedOnKindOfError(t *testing.T) {
 		retry.DelayType(func(n uint, err error, config *retry.Config) time.Duration {
 			var retryAfterErr RetryAfterError
 			if errors.As(err, &retryAfterErr) {
-				if t, err := parseRetryAfter(retryAfterErr.response.Header.Get("Retry-After")); err == nil {
-					return time.Until(t)
-				}
+				t := parseRetryAfter(retryAfterErr.response.Header.Get("Retry-After"))
+				return time.Until(t)
 			}
 			var someOtherErr SomeOtherError
 			if errors.As(err, &someOtherErr) {
@@ -83,7 +82,7 @@ func TestCustomRetryFunctionBasedOnKindOfError(t *testing.T) {
 	}
 }
 
-// use https://github.com/aereal/go-httpretryafter instead
-func parseRetryAfter(_ string) (time.Time, error) {
-	return time.Now().Add(1 * time.Second), nil //nolint:unparam // error is always nil for test simplicity
+// use https://github.com/aereal/go-httpretryafter instead.
+func parseRetryAfter(_ string) time.Time {
+	return time.Now().Add(1 * time.Second)
 }
diff --git a/examples/errors_history_test.go b/examples/errors_history_test.go
index 26bf6f6..a76e7b4 100644
--- a/examples/errors_history_test.go
+++ b/examples/errors_history_test.go
@@ -10,7 +10,7 @@ import (
 )
 
 // TestErrorHistory shows an example of how to get all the previous errors when
-// retry.Do ends in success
+// retry.Do ends in success.
 func TestErrorHistory(t *testing.T) {
 	attempts := 3 // server succeeds after 3 attempts
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
diff --git a/go.mod b/go.mod
index 6a2655d..4209c27 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,3 @@
 module github.com/codeGROOVE-dev/retry-go
 
-go 1.20
+go 1.22
diff --git a/options.go b/options.go
index b664be1..77c32b8 100644
--- a/options.go
+++ b/options.go
@@ -2,11 +2,10 @@ package retry //nolint:revive // More than 5 public structs are necessary for AP
 
 import (
 	"context"
-	cryptorand "crypto/rand"
-	"encoding/binary"
 	"errors"
 	"fmt"
 	"math"
+	"math/rand/v2"
 	"time"
 )
 
@@ -217,29 +216,7 @@ func RandomDelay(_ uint, _ error, config *Config) time.Duration {
 	if config.maxJitter <= 0 {
 		return 0
 	}
-	return time.Duration(secureRandomInt63n(int64(config.maxJitter)))
-}
-
-// secureRandomInt63n returns a non-negative pseudo-random number in [0,n) using crypto/rand.
-func secureRandomInt63n(n int64) int64 {
-	if n <= 0 {
-		return 0
-	}
-	var b [8]byte
-	for {
-		if _, err := cryptorand.Read(b[:]); err != nil {
-			// Fall back to 0 on error rather than panic
-			return 0
-		}
-		// Clear sign bit to ensure non-negative
-		val := int64(binary.BigEndian.Uint64(b[:]) & 0x7FFFFFFFFFFFFFFF) //nolint:gosec // Bitwise AND to clear sign bit is safe
-		// Rejection sampling to avoid modulo bias
-		const maxInt63 = 0x7FFFFFFFFFFFFFFF // max int63
-		maxVal := int64(maxInt63)
-		if val < maxVal-(maxVal%n) {
-			return val % n
-		}
-	}
+	return time.Duration(rand.Int64N(int64(config.maxJitter))) //nolint:gosec // Cryptographic randomness not needed for retry jitter
 }
 
 // CombineDelay creates a DelayTypeFunc that sums the delays from multiple strategies.
@@ -293,7 +270,7 @@ func FullJitterBackoffDelay(attempt uint, _ error, config *Config) time.Duration
 	if ceiling <= 0 {
 		return 0
 	}
-	return time.Duration(secureRandomInt63n(int64(ceiling)))
+	return time.Duration(rand.Int64N(int64(ceiling))) //nolint:gosec // Cryptographic randomness not needed for retry jitter
 }
 
 // OnRetry sets a callback function that is called after each failed attempt.
diff --git a/retry.go b/retry.go
index 76a25fc..9808d18 100644
--- a/retry.go
+++ b/retry.go
@@ -239,7 +239,10 @@ func DoWithData[T any](retryableFunc RetryableFuncWithData[T], opts ...Option) (
 	}
 
 	if config.lastErrorOnly {
-		return emptyT, errorLog.Unwrap()
+		if len(errorLog) > 0 {
+			return emptyT, errorLog.Unwrap()
+		}
+		return emptyT, nil
 	}
 	return emptyT, errorLog
 }
@@ -256,7 +259,10 @@ func (e Error) Error() string {
 		return "retry: all attempts failed"
 	}
 
+	// Pre-size builder for better performance
+	// Estimate: prefix (30) + each error (~50 chars avg)
 	var b strings.Builder
+	b.Grow(30 + len(e)*50)
 	b.WriteString("retry: all attempts failed:")
 
 	for i, err := range e {
diff --git a/retry_test.go b/retry_test.go
index f9a2e4f..8dbdb35 100644
--- a/retry_test.go
+++ b/retry_test.go
@@ -740,7 +740,7 @@ func TestUnwrap(t *testing.T) {
 func BenchmarkDo(b *testing.B) {
 	testError := errors.New("test error")
 
-	for i := 0; i < b.N; i++ {
+	for range b.N {
 		_ = Do(
 			func() error {
 				return testError
@@ -754,7 +754,7 @@ func BenchmarkDo(b *testing.B) {
 func BenchmarkDoWithData(b *testing.B) {
 	testError := errors.New("test error")
 
-	for i := 0; i < b.N; i++ {
+	for range b.N {
 		_, _ = DoWithData(
 			func() (int, error) {
 				return 0, testError
@@ -766,7 +766,7 @@ func BenchmarkDoWithData(b *testing.B) {
 }
 
 func BenchmarkDoNoErrors(b *testing.B) {
-	for i := 0; i < b.N; i++ {
+	for range b.N {
 		_ = Do(
 			func() error {
 				return nil
@@ -778,7 +778,7 @@ func BenchmarkDoNoErrors(b *testing.B) {
 }
 
 func BenchmarkDoWithDataNoErrors(b *testing.B) {
-	for i := 0; i < b.N; i++ {
+	for range b.N {
 		_, _ = DoWithData(
 			func() (int, error) {
 				return 0, nil
@@ -980,7 +980,7 @@ func TestConcurrentRetryUsage(t *testing.T) {
 	var wg sync.WaitGroup
 	goroutines := 20 // Reduced from 100 for faster tests
 
-	for i := 0; i < goroutines; i++ {
+	for i := range goroutines {
 		wg.Add(1)
 		go func(id int) {
 			defer wg.Done()
@@ -1318,7 +1318,7 @@ func TestRetryWithNilContext(t *testing.T) {
 	}
 }
 
-// Update testTimer to support custom behavior
+// Update testTimer to support custom behavior.
 type testTimer struct {
 	afterFunc func(time.Duration) <-chan time.Time
 	called    bool
@@ -1400,7 +1400,7 @@ func TestFullJitterBackoffDelay(t *testing.T) {
 	// Test with very small base delay
 	smallBaseDelay := 1 * time.Nanosecond
 	configSmallBase := &Config{delay: smallBaseDelay, maxDelay: 100 * time.Nanosecond}
-	for i := uint(0); i < 5; i++ {
+	for i := range uint(5) {
 		d := FullJitterBackoffDelay(i, errors.New("test"), configSmallBase)
 		ceil := float64(smallBaseDelay) * math.Pow(2, float64(i))
 		if ceil > 100 {

From 954697ff472d8a71a273fa35d2fa26ad75512c52 Mon Sep 17 00:00:00 2001
From: Thomas Stromberg <t+github@chainguard.dev>
Date: Mon, 4 Aug 2025 14:48:40 -0400
Subject: [PATCH 3/5] add lint configs

---
 .golangci.yml | 231 ++++++++++++++++++++++++++++++++++++++++++++++++++
 .yamllint     |  16 ++++
 2 files changed, 247 insertions(+)
 create mode 100644 .golangci.yml
 create mode 100644 .yamllint

diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..9e3c6fe
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,231 @@
+## Golden config for golangci-lint - strict, but within the realm of what Go authors might use.
+#
+# This is tied to the version of golangci-lint listed in the Makefile, usage with other
+# versions of golangci-lint will yield errors and/or false positives.
+#
+# Docs: https://github.com/golangci/golangci-lint/blob/HEAD/.golangci.reference.yml
+# Based heavily on https://gist.github.com/maratori/47a4d00457a92aa426dbd48a18776322
+
+version: "2"
+
+issues:
+  # Maximum issues count per one linter. Set to 0 to disable. Default is 50.
+  max-issues-per-linter: 0
+  # Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
+  max-same-issues: 0
+
+formatters:
+  enable:
+    # - gci
+    # - gofmt
+    - gofumpt
+    # - goimports
+    # - golines
+    - swaggo
+
+  settings:
+    golines:
+      # Default: 100
+      max-len: 120
+
+linters:
+  default: all
+  disable:
+    # linters that give advice contrary to what the Go authors advise
+    - decorder # checks declaration order and count of types, constants, variables and functions
+    - dupword # [useless without config] checks for duplicate words in the source code
+    - exhaustruct # [highly recommend to enable] checks if all structure fields are initialized
+    - forcetypeassert # [replaced by errcheck] finds forced type assertions
+    - ginkgolinter # [if you use ginkgo/gomega] enforces standards of using ginkgo and gomega
+    - gochecknoglobals # checks that no global variables exist
+    - cyclop # replaced by revive
+    - funlen # replaced by revive
+    - godox # TODO's are OK
+    - ireturn # It's OK
+    - musttag
+    - nonamedreturns
+    - goconst # finds repeated strings that could be replaced by a constant
+    - goheader # checks is file header matches to pattern
+    - gomodguard # [use more powerful depguard] allow and block lists linter for direct Go module dependencies
+    - err113 # bad advice about dynamic errors
+    - lll # [replaced by golines] reports long lines
+    - mnd # detects magic numbers, duplicated by revive
+    - nlreturn # [too strict and mostly code is not more readable] checks for a new line before return and branch statements to increase code clarity
+    - noinlineerr # disallows inline error handling `if err := ...; err != nil {`
+    - prealloc # [premature optimization, but can be used in some cases] finds slice declarations that could potentially be preallocated
+    - tagliatelle # needs configuration
+    - testableexamples # checks if examples are testable (have an expected output)
+    - testpackage # makes you use a separate _test package
+    - paralleltest # not every test should be in parallel
+    - wrapcheck # not required
+    - wsl # [too strict and mostly code is not more readable] whitespace linter forces you to use empty lines
+    - wsl_v5 # [too strict and mostly code is not more readable] add or remove empty lines
+    - zerologlint # detects the wrong usage of zerolog that a user forgets to dispatch zerolog.Event
+
+  # All settings can be found here https://github.com/golangci/golangci-lint/blob/HEAD/.golangci.reference.yml
+  settings:
+    depguard:
+      rules:
+        "deprecated":
+          files:
+            - "$all"
+          deny:
+            - pkg: github.com/golang/protobuf
+              desc: Use google.golang.org/protobuf instead, see https://developers.google.com/protocol-buffers/docs/reference/go/faq#modules
+            - pkg: github.com/satori/go.uuid
+              desc: Use github.com/google/uuid instead, satori's package is not maintained
+            - pkg: github.com/gofrs/uuid$
+              desc: Use github.com/gofrs/uuid/v5 or later, it was not a go module before v5
+        "non-test files":
+          files:
+            - "!$test"
+          deny:
+            - pkg: math/rand$
+              desc: Use math/rand/v2 instead, see https://go.dev/blog/randv2
+            - pkg: "github.com/sirupsen/logrus"
+              desc: not allowed
+            - pkg: "github.com/pkg/errors"
+              desc: Should be replaced by standard lib errors package
+
+    dupl:
+      # token count (default: 150)
+      threshold: 300
+
+    embeddedstructfieldcheck:
+      # Checks that sync.Mutex and sync.RWMutex are not used as embedded fields.
+      forbid-mutex: true
+
+    errcheck:
+      # Report about not checking of errors in type assertions: `a := b.(MyStruct)`.
+      check-type-assertions: true
+
+    exhaustive:
+      # Program elements to check for exhaustiveness.
+      # Default: [ switch ]
+      check:
+        - switch
+        - map
+      default-signifies-exhaustive: true
+
+    fatcontext:
+      # Check for potential fat contexts in struct pointers.
+      # May generate false positives.
+      # Default: false
+      check-struct-pointers: true
+
+    funcorder:
+      # Checks if the exported methods of a structure are placed before the non-exported ones.
+      struct-method: false
+
+    gocognit:
+      min-complexity: 55
+
+    gocritic:
+      enable-all: true
+      disabled-checks:
+        - paramTypeCombine
+      # The list of supported checkers can be found at https://go-critic.com/overview.
+      settings:
+        captLocal:
+          # Whether to restrict checker to params only.
+          paramsOnly: false
+        underef:
+          # Whether to skip (*x).method() calls where x is a pointer receiver.
+          skipRecvDeref: false
+        hugeParam:
+          # Default: 80
+          sizeThreshold: 200
+
+    govet:
+      enable-all: true
+
+    godot:
+      scope: toplevel
+
+    inamedparam:
+      # Skips check for interface methods with only a single parameter.
+      skip-single-param: true
+
+    nakedret:
+      # Default: 30
+      max-func-lines: 4
+
+    nestif:
+      min-complexity: 12
+
+    nolintlint:
+      # Exclude following linters from requiring an explanation.
+      # Default: []
+      allow-no-explanation: [funlen, gocognit, golines]
+      # Enable to require an explanation of nonzero length after each nolint directive.
+      require-explanation: true
+      # Enable to require nolint directives to mention the specific linter being suppressed.
+      require-specific: true
+
+    revive:
+      enable-all-rules: true
+      rules:
+        - name: add-constant
+          severity: warning
+          disabled: false
+          exclude: [""]
+          arguments:
+            - max-lit-count: "5"
+              allow-strs: '"","\n"'
+              allow-ints: "0,1,2,3,256,1024"
+              allow-floats: "0.0,0.,1.0,1.,2.0,2."
+        - name: cognitive-complexity
+          arguments: [50]
+        - name: cyclomatic
+          severity: warning
+          arguments: [30]
+        - name: function-length
+          arguments: [150, 225]
+        - name: line-length-limit
+          arguments: [150]
+        - name: nested-structs
+          disabled: true
+
+    rowserrcheck:
+      # database/sql is always checked.
+      # Default: []
+      packages:
+        - github.com/jmoiron/sqlx
+
+    perfsprint:
+      # optimize fmt.Sprintf("x: %s", y) into "x: " + y
+      strconcat: false
+
+    staticcheck:
+      checks:
+        - all
+
+    usetesting:
+      # Enable/disable `os.TempDir()` detections.
+      # Default: false
+      os-temp-dir: true
+
+    varnamelen:
+      max-distance: 40
+      min-name-length: 2
+
+  exclusions:
+    # Default: []
+    presets:
+      - common-false-positives
+    rules:
+      # Allow "err" and "ok" vars to shadow existing declarations, otherwise we get too many false positives.
+      - text: '^shadow: declaration of "(err|ok)" shadows declaration'
+        linters:
+          - govet
+      - text: "parameter 'ctx' seems to be unused, consider removing or renaming it as _"
+        linters:
+          - revive
+      - path: _test\.go
+        linters:
+          - dupl
+          - gosec
+          - noctx
+          - perfsprint
+          - revive
+          - varnamelen
diff --git a/.yamllint b/.yamllint
new file mode 100644
index 0000000..9a08ad1
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,16 @@
+---
+extends: default
+
+rules:
+  braces:
+    max-spaces-inside: 1
+  brackets:
+    max-spaces-inside: 1
+  comments: disable
+  comments-indentation: disable
+  document-start: disable
+  line-length:
+    level: warning
+    max: 160
+    allow-non-breakable-inline-mappings: true
+  truthy: disable

From 14648974141ef2f5c964d2c013dc120f88c5f968 Mon Sep 17 00:00:00 2001
From: Thomas Stromberg <t+github@chainguard.dev>
Date: Mon, 4 Aug 2025 14:54:08 -0400
Subject: [PATCH 4/5] simplify the ci workflow

---
 .github/workflows/workflow.yaml | 68 ++++++++-------------------------
 1 file changed, 15 insertions(+), 53 deletions(-)

diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 6404939..5d81f51 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -2,64 +2,26 @@ name: Go
 
 on:
   push:
+    branches: [main]
   pull_request:
-    branches:
-      - master
+    branches: [main]
 
 jobs:
-  golangci-lint:
+  build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: stable
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
-        with:
-          version: latest
-  tests:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        go-version: ["1.20", "1.21", "1.22", "1.23", "1.24"]
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    env:
-      OS: ${{ matrix.os }}
-      GOVERSION: ${{ matrix.go-version }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Go ${{ matrix.go-version }}
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go-version }}
-          check-latest: true
-          cache: true
-      - name: Display Go version
-        run: go version
-      - name: Install dependencies
-        run: make setup
-      - name: Test
-        run: make ci
-      - name: Archive code coverage results
-        uses: actions/upload-artifact@v4
+      - uses: actions/checkout@v2
+
+      - name: Set up Go
+        uses: actions/setup-go@v2
         with:
-          name: code-coverage-report-${{ matrix.os }}-${{ matrix.go-version }}
-          path: coverage.txt
+          go-version: latest
 
-  coverage:
-    needs: tests
-    runs-on: ubuntu-latest
+      - name: Build
+        run: make build
 
-    steps:
-      - name: Download a linux coverage report
-        uses: actions/download-artifact@v4
-        with:
-          name: code-coverage-report-ubuntu-latest-1.24
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          fail_ci_if_error: true
-          flags: unittest
+      - name: Test
+        run: make test
+
+      - name: Lint
+        run: make lint

From 7a031ef893be9ca75858e1900802ae9d30c52cc1 Mon Sep 17 00:00:00 2001
From: Thomas Stromberg <t+github@chainguard.dev>
Date: Mon, 4 Aug 2025 14:55:00 -0400
Subject: [PATCH 5/5] go-version 1.22

---
 .github/workflows/workflow.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 5d81f51..c5a3aa2 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -15,7 +15,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v2
         with:
-          go-version: latest
+          go-version: 1.22
 
       - name: Build
         run: make build