fix: resolve all 89 golangci-lint errors

cmd/devcloud/main.go

@@ -105,7 +105,7 @@ func main() {
 	// 404 handler so the dashboard routes don't leak service internals.
 	bus := eventbus.New()
 	logCollector := dashboard.NewLogCollector(1000)
-	var dashHandler http.Handler = http.NotFoundHandler()
+	dashHandler := http.NotFoundHandler()
 	webDir := ""
 	if cfg.Dashboard.Enabled {
 		dashAPI := dashboard.NewDashboardAPI(registry, logCollector)

internal/codegen/parser.go

@@ -105,7 +105,7 @@ func ParseSmithyJSON(data []byte) (*SmithyModel, error) {
 		}
 		if httpTrait, ok := opShape.Traits["smithy.api#http"]; ok {
 			var ht rawHTTPTrait
-			json.Unmarshal(httpTrait, &ht) //nolint:errcheck
+			_ = json.Unmarshal(httpTrait, &ht) //nolint:errcheck
 			op.HTTPMethod = ht.Method
 			op.HTTPUri = ht.URI
 		}
@@ -146,12 +146,12 @@ func ParseSmithyJSON(data []byte) (*SmithyModel, error) {
 					}
 					if hdr, ok := member.Traits["smithy.api#httpHeader"]; ok {
 						var headerName string
-						json.Unmarshal(hdr, &headerName) //nolint:errcheck
+						_ = json.Unmarshal(hdr, &headerName) //nolint:errcheck
 						m.HTTPHeader = headerName
 					}
 					if q, ok := member.Traits["smithy.api#httpQuery"]; ok {
 						var queryName string
-						json.Unmarshal(q, &queryName) //nolint:errcheck
+						_ = json.Unmarshal(q, &queryName) //nolint:errcheck
 						m.HTTPQuery = queryName
 					}
 				}
@@ -163,11 +163,11 @@ func ParseSmithyJSON(data []byte) (*SmithyModel, error) {
 
 			if errType, ok := rs.Traits["smithy.api#error"]; ok {
 				var et string
-				json.Unmarshal(errType, &et) //nolint:errcheck
+				_ = json.Unmarshal(errType, &et) //nolint:errcheck
 				shape.ErrorTrait = &ErrorTrait{Type: et}
 				if httpErr, ok := rs.Traits["smithy.api#httpError"]; ok {
 					var status int
-					json.Unmarshal(httpErr, &status) //nolint:errcheck
+					_ = json.Unmarshal(httpErr, &status) //nolint:errcheck
 					shape.ErrorTrait.HTTPStatus = status
 				}
 			}

internal/dashboard/api_test.go

@@ -48,7 +48,8 @@ func newTestRegistry(p *mockServicePlugin) *plugin.Registry {
 	reg.Register(p.id, func(cfg plugin.PluginConfig) plugin.ServicePlugin {
 		return captured
 	})
-	reg.Init(p.id, plugin.PluginConfig{}) //nolint:errcheck
+	_, err := reg.Init(p.id, plugin.PluginConfig{})
+	_ = err
 	return reg
 }
 

internal/dashboard/websocket.go

@@ -93,7 +93,7 @@ func (h *Hub) ServeWS(w http.ResponseWriter, r *http.Request) {
 			h.mu.Lock()
 			delete(h.clients, client)
 			h.mu.Unlock()
-			conn.Close()
+			_ = conn.Close()
 		})
 	}
 

internal/dashboard/websocket_test.go

@@ -42,7 +42,7 @@ func TestHub_ClientConnects(t *testing.T) {
 	defer server.Close()
 
 	conn := dialWS(t, wsURL(server.URL))
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	// Give the hub a moment to register the client.
 	time.Sleep(50 * time.Millisecond)
@@ -65,7 +65,7 @@ func TestHub_BroadcastEvent(t *testing.T) {
 	defer server.Close()
 
 	conn := dialWS(t, wsURL(server.URL))
-	defer conn.Close()
+	defer func() { _ = conn.Close() }()
 
 	// Allow the hub to register the client before publishing.
 	time.Sleep(50 * time.Millisecond)
@@ -81,7 +81,7 @@ func TestHub_BroadcastEvent(t *testing.T) {
 	require.NoError(t, err)
 
 	// Read message with a deadline to avoid hanging on failure.
-	conn.SetReadDeadline(time.Now().Add(2 * time.Second))
+	_ = conn.SetReadDeadline(time.Now().Add(2 * time.Second))
 	_, raw, err := conn.ReadMessage()
 	require.NoError(t, err)
 

internal/eventbus/eventbus_test.go

@@ -24,12 +24,11 @@ func TestPublishAndSubscribe(t *testing.T) {
 	})
 	defer unsub()
 
-	err := bus.Publish(context.Background(), Event{
+	require.NoError(t, bus.Publish(context.Background(), Event{
 		Source: "s3",
 		Type:   "s3:ObjectCreated",
 		Detail: map[string]any{"bucket": "test", "key": "hello.txt"},
-	})
-	require.NoError(t, err)
+	}))
 
 	time.Sleep(50 * time.Millisecond)
 	mu.Lock()
@@ -51,8 +50,8 @@ func TestSubscribeWildcard(t *testing.T) {
 	})
 	defer unsub()
 
-	bus.Publish(context.Background(), Event{Source: "s3", Type: "s3:ObjectCreated"})
-	bus.Publish(context.Background(), Event{Source: "sqs", Type: "sqs:MessageSent"})
+	require.NoError(t, bus.Publish(context.Background(), Event{Source: "s3", Type: "s3:ObjectCreated"}))
+	require.NoError(t, bus.Publish(context.Background(), Event{Source: "sqs", Type: "sqs:MessageSent"}))
 
 	time.Sleep(50 * time.Millisecond)
 	mu.Lock()
@@ -71,12 +70,12 @@ func TestUnsubscribe(t *testing.T) {
 		mu.Unlock()
 	})
 
-	bus.Publish(context.Background(), Event{Type: "test"})
+	require.NoError(t, bus.Publish(context.Background(), Event{Type: "test"}))
 	time.Sleep(50 * time.Millisecond)
 
 	unsub()
 
-	bus.Publish(context.Background(), Event{Type: "test"})
+	require.NoError(t, bus.Publish(context.Background(), Event{Type: "test"}))
 	time.Sleep(50 * time.Millisecond)
 
 	mu.Lock()

internal/gateway/gateway_test.go

@@ -38,7 +38,7 @@ func TestGateway_Integration(t *testing.T) {
 
 	res, err := http.Get(srv.URL + "/")
 	require.NoError(t, err)
-	defer res.Body.Close()
+	defer func() { _ = res.Body.Close() }()
 
 	assert.Equal(t, http.StatusOK, res.StatusCode)
 	// Middleware headers must be present.

internal/gateway/middleware.go

@@ -78,11 +78,11 @@ func ErrorRecoveryMiddleware(next http.Handler) http.Handler {
 					strings.HasPrefix(r.URL.Path, "/2015-03-31/") {
 					w.Header().Set("Content-Type", "application/json")
 					w.WriteHeader(http.StatusInternalServerError)
-					fmt.Fprintf(w, `{"__type":"InternalError","message":"%v"}`, rec)
+					_, _ = fmt.Fprintf(w, `{"__type":"InternalError","message":"%v"}`, rec)
 				} else {
 					w.Header().Set("Content-Type", "application/xml")
 					w.WriteHeader(http.StatusInternalServerError)
-					fmt.Fprintf(w, `<?xml version="1.0" encoding="UTF-8"?><Error><Code>InternalError</Code><Message>%v</Message></Error>`, rec)
+					_, _ = fmt.Fprintf(w, `<?xml version="1.0" encoding="UTF-8"?><Error><Code>InternalError</Code><Message>%v</Message></Error>`, rec)
 				}
 			}
 		}()

internal/plugin/registry_test.go

@@ -42,6 +42,7 @@ func TestRegistryGetUnknown(t *testing.T) {
 func TestRegistryList(t *testing.T) {
 	reg := NewRegistry()
 	reg.Register("s3", func(cfg PluginConfig) ServicePlugin { return &mockPlugin{} })
-	reg.Init("s3", PluginConfig{})
+	_, err := reg.Init("s3", PluginConfig{})
+	require.NoError(t, err)
 	assert.Equal(t, []string{"s3"}, reg.ActiveServices())
 }

internal/services/account/provider.go

@@ -50,7 +50,7 @@ func (p *AccountProvider) HandleRequest(_ context.Context, op string, req *http.
 	body, _ := io.ReadAll(req.Body)
 	var bodyMap map[string]any
 	if len(body) > 0 {
-		json.Unmarshal(body, &bodyMap)
+		_ = json.Unmarshal(body, &bodyMap)
 	}
 	if bodyMap == nil {
 		bodyMap = map[string]any{}

internal/services/account/provider_test.go

@@ -19,7 +19,7 @@ func newTestProvider(t *testing.T) *AccountProvider {
 	p := &AccountProvider{}
 	err := p.Init(plugin.PluginConfig{DataDir: t.TempDir()})
 	require.NoError(t, err)
-	t.Cleanup(func() { p.Shutdown(context.Background()) })
+	t.Cleanup(func() { _ = p.Shutdown(context.Background()) })
 	return p
 }
 

internal/services/account/store.go

@@ -180,24 +180,30 @@ type Region struct {
 }
 
 func (s *Store) ListRegions(accountID string) ([]*Region, error) {
-	s.ensureRegions(accountID)
+	if err := s.ensureRegions(accountID); err != nil {
+		return nil, err
+	}
 	rows, err := s.db().Query(
 		`SELECT region_name, opt_status FROM account_regions WHERE account_id=? ORDER BY region_name`, accountID)
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var out []*Region
 	for rows.Next() {
 		r := &Region{}
-		rows.Scan(&r.RegionName, &r.OptStatus)
+		if err := rows.Scan(&r.RegionName, &r.OptStatus); err != nil {
+			return nil, err
+		}
 		out = append(out, r)
 	}
 	return out, rows.Err()
 }
 
 func (s *Store) GetRegionOptStatus(accountID, regionName string) (*Region, error) {
-	s.ensureRegions(accountID)
+	if err := s.ensureRegions(accountID); err != nil {
+		return nil, err
+	}
 	row := s.db().QueryRow(
 		`SELECT region_name, opt_status FROM account_regions WHERE account_id=? AND region_name=?`,
 		accountID, regionName)
@@ -213,7 +219,9 @@ func (s *Store) GetRegionOptStatus(accountID, regionName string) (*Region, error
 }
 
 func (s *Store) SetRegionOptStatus(accountID, regionName, status string) error {
-	s.ensureRegions(accountID)
+	if err := s.ensureRegions(accountID); err != nil {
+		return err
+	}
 	_, err := s.db().Exec(
 		`INSERT INTO account_regions (account_id, region_name, opt_status) VALUES (?,?,?)
 		 ON CONFLICT(account_id, region_name) DO UPDATE SET opt_status=excluded.opt_status`,
@@ -224,7 +232,7 @@ func (s *Store) SetRegionOptStatus(accountID, regionName, status string) error {
 // --- Primary Email ---
 
 func (s *Store) GetPrimaryEmail(accountID string) (email, pending string) {
-	s.db().QueryRow(`SELECT COALESCE(email,''), COALESCE(pending_email,'') FROM account_primary_email WHERE account_id=?`, accountID).
+	_ = s.db().QueryRow(`SELECT COALESCE(email,''), COALESCE(pending_email,'') FROM account_primary_email WHERE account_id=?`, accountID).
 		Scan(&email, &pending)
 	return
 }
@@ -248,7 +256,7 @@ func (s *Store) StartPrimaryEmailUpdate(accountID, pendingEmail string) error {
 func (s *Store) AcceptPrimaryEmailUpdate(accountID string) error {
 	row := s.db().QueryRow(`SELECT COALESCE(pending_email,'') FROM account_primary_email WHERE account_id=?`, accountID)
 	var pending string
-	row.Scan(&pending)
+	_ = row.Scan(&pending)
 	if pending == "" {
 		return ErrNotFound
 	}

internal/services/acm/store.go

@@ -115,7 +115,7 @@ func (s *ACMStore) ListCertificates(accountID string) ([]Certificate, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var certs []Certificate
 	for rows.Next() {
 		c, err := scanCert(rows)
@@ -160,7 +160,7 @@ func (s *ACMStore) ListTags(arn string) ([]CertTag, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var tags []CertTag
 	for rows.Next() {
 		var t CertTag

internal/services/acmpca/store.go

@@ -137,7 +137,7 @@ func (s *ACMPCAStore) ListCAs() ([]CertificateAuthority, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var cas []CertificateAuthority
 	for rows.Next() {
 		ca, err := scanCA(rows)
@@ -194,7 +194,7 @@ func (s *ACMPCAStore) ListPermissions(caARN string) ([]Permission, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var perms []Permission
 	for rows.Next() {
 		var p Permission
@@ -243,7 +243,7 @@ func (s *ACMPCAStore) ListTags(caARN string) ([]Tag, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var tags []Tag
 	for rows.Next() {
 		var t Tag

internal/services/amplify/provider.go

@@ -437,7 +437,7 @@ func (p *Provider) createApp(params map[string]any) (*plugin.Response, error) {
 	}
 
 	if rawTags, ok := params["tags"].(map[string]any); ok {
-		p.store.tags.AddTags(arn, toStringMap(rawTags))
+		_ = p.store.tags.AddTags(arn, toStringMap(rawTags))
 	}
 
 	tags, _ := p.store.tags.ListTags(arn)
@@ -489,7 +489,7 @@ func (p *Provider) deleteApp(appID string) (*plugin.Response, error) {
 	if err != nil {
 		return shared.JSONError("NotFoundException", "app not found", http.StatusNotFound), nil
 	}
-	p.store.tags.DeleteAllTags(a.ARN)
+	_ = p.store.tags.DeleteAllTags(a.ARN)
 	tags := map[string]string{}
 	return shared.JSONResponse(http.StatusOK, map[string]any{"app": appToMap(a, tags)})
 }
@@ -832,7 +832,7 @@ func (p *Provider) stopJob(appID, branchName, jobID string) (*plugin.Response, e
 	if err != nil {
 		return shared.JSONError("NotFoundException", "job not found", http.StatusNotFound), nil
 	}
-	p.store.UpdateJobStatus(appID, branchName, jobID, "CANCELLED")
+	p.store.UpdateJobStatus(appID, branchName, jobID, "CANCELLED") //nolint:errcheck
 	j.Status = "CANCELLED"
 	return shared.JSONResponse(http.StatusOK, map[string]any{"jobSummary": buildJobSummaryMap(j)})
 }
@@ -928,7 +928,7 @@ func branchToMap(b *Branch) map[string]any {
 
 func domainAssociationToMap(d *DomainAssociation) map[string]any {
 	var subDomains any
-	json.Unmarshal([]byte(d.SubDomains), &subDomains)
+	_ = json.Unmarshal([]byte(d.SubDomains), &subDomains)
 	if subDomains == nil {
 		subDomains = []any{}
 	}

internal/services/amplify/provider_test.go

@@ -20,7 +20,7 @@ func newTestProvider(t *testing.T) *Provider {
 	p := &Provider{}
 	err := p.Init(plugin.PluginConfig{DataDir: t.TempDir()})
 	require.NoError(t, err)
-	t.Cleanup(func() { p.Shutdown(context.Background()) })
+	t.Cleanup(func() { _ = p.Shutdown(context.Background()) })
 	return p
 }
 

internal/services/amplify/store.go

@@ -205,7 +205,7 @@ func (s *Store) ListApps() ([]App, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var apps []App
 	for rows.Next() {
 		a, err := scanApp(rows)
@@ -289,7 +289,7 @@ func (s *Store) ListBranches(appID string) ([]Branch, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var branches []Branch
 	for rows.Next() {
 		b, err := scanBranch(rows)
@@ -374,7 +374,7 @@ func (s *Store) ListDomainAssociations(appID string) ([]DomainAssociation, error
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var domains []DomainAssociation
 	for rows.Next() {
 		d, err := scanDomainAssociation(rows)
@@ -445,7 +445,7 @@ func (s *Store) ListWebhooks(appID string) ([]Webhook, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var webhooks []Webhook
 	for rows.Next() {
 		w, err := scanWebhook(rows)
@@ -513,7 +513,7 @@ func (s *Store) ListBackendEnvironments(appID string) ([]BackendEnvironment, err
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var envs []BackendEnvironment
 	for rows.Next() {
 		be, err := scanBackendEnvironment(rows)
@@ -562,7 +562,7 @@ func (s *Store) ListJobs(appID, branchName string) ([]Job, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 	var jobs []Job
 	for rows.Next() {
 		j, err := scanJob(rows)