Release v1.17.1

aws-source/adapters/adapterhelpers_always_get_source.go

@@ -172,7 +172,7 @@ func (s *AlwaysGetAdapter[ListInput, ListOutput, GetInput, GetOutput, ClientStru
 	if err != nil {
 		err := WrapAWSError(err)
 		if !CanRetry(err) {
-			s.cache.StoreError(ctx, err, s.cacheDuration(), ck)
+			s.cache.StoreUnavailableItem(ctx, err, s.cacheDuration(), ck)
 		}
 		return nil, err
 	}
@@ -252,7 +252,7 @@ func (s *AlwaysGetAdapter[ListInput, ListOutput, GetInput, GetOutput, ClientStru
 				ItemType:      s.ItemType,
 				ResponderName: s.Name(),
 			}
-			s.cache.StoreError(ctx, notFoundErr, s.cacheDuration(), ck)
+			s.cache.StoreUnavailableItem(ctx, notFoundErr, s.cacheDuration(), ck)
 		}
 	}()
 
@@ -262,7 +262,7 @@ func (s *AlwaysGetAdapter[ListInput, ListOutput, GetInput, GetOutput, ClientStru
 			hadError.Store(true)
 			err := WrapAWSError(err)
 			if !CanRetry(err) {
-				s.cache.StoreError(ctx, err, s.cacheDuration(), ck)
+				s.cache.StoreUnavailableItem(ctx, err, s.cacheDuration(), ck)
 			}
 			stream.SendError(err)
 			return
@@ -273,7 +273,7 @@ func (s *AlwaysGetAdapter[ListInput, ListOutput, GetInput, GetOutput, ClientStru
 			hadError.Store(true)
 			err := WrapAWSError(err)
 			if !CanRetry(err) {
-				s.cache.StoreError(ctx, err, s.cacheDuration(), ck)
+				s.cache.StoreUnavailableItem(ctx, err, s.cacheDuration(), ck)
 			}
 			stream.SendError(err)
 			return
@@ -375,7 +375,7 @@ func (s *AlwaysGetAdapter[ListInput, ListOutput, GetInput, GetOutput, ClientStru
 		if err != nil {
 			err := WrapAWSError(err)
 			if !CanRetry(err) {
-				s.cache.StoreError(ctx, err, s.cacheDuration(), ck)
+				s.cache.StoreUnavailableItem(ctx, err, s.cacheDuration(), ck)
 			}
 			stream.SendError(err)
 			return
@@ -394,7 +394,7 @@ func (s *AlwaysGetAdapter[ListInput, ListOutput, GetInput, GetOutput, ClientStru
 				ItemType:      s.ItemType,
 				ResponderName: s.Name(),
 			}
-			s.cache.StoreError(ctx, notFoundErr, s.cacheDuration(), ck)
+			s.cache.StoreUnavailableItem(ctx, notFoundErr, s.cacheDuration(), ck)
 		}
 	} else {
 		stream.SendError(errors.New("SearchCustom called without SearchInputMapper or SearchGetInputMapper"))

aws-source/adapters/adapterhelpers_describe_source.go

@@ -241,7 +241,7 @@ func (s *DescribeOnlyAdapter[Input, Output, ClientStruct, Options]) Get(ctx cont
 			ItemType:      s.ItemType,
 			ResponderName: s.Name(),
 		}
-		s.cache.StoreError(ctx, qErr, s.cacheDuration(), ck)
+		s.cache.StoreUnavailableItem(ctx, qErr, s.cacheDuration(), ck)
 
 		return nil, qErr
 	case numItems == 0:
@@ -253,7 +253,7 @@ func (s *DescribeOnlyAdapter[Input, Output, ClientStruct, Options]) Get(ctx cont
 			ItemType:      s.ItemType,
 			ResponderName: s.Name(),
 		}
-		s.cache.StoreError(ctx, qErr, s.cacheDuration(), ck)
+		s.cache.StoreUnavailableItem(ctx, qErr, s.cacheDuration(), ck)
 		return nil, qErr
 	}
 
@@ -418,7 +418,7 @@ func (s *DescribeOnlyAdapter[Input, Output, ClientStruct, Options]) processError
 
 		// Only cache the error if is something that won't be fixed by retrying
 		if sdpErr.GetErrorType() == sdp.QueryError_NOTFOUND || sdpErr.GetErrorType() == sdp.QueryError_NOSCOPE {
-			s.cache.StoreError(ctx, sdpErr, s.cacheDuration(), cacheKey)
+			s.cache.StoreUnavailableItem(ctx, sdpErr, s.cacheDuration(), cacheKey)
 		}
 	}
 
@@ -507,7 +507,7 @@ func (s *DescribeOnlyAdapter[Input, Output, ClientStruct, Options]) describe(ctx
 			ItemType:      s.ItemType,
 			ResponderName: s.Name(),
 		}
-		s.cache.StoreError(ctx, notFoundErr, s.cacheDuration(), ck)
+		s.cache.StoreUnavailableItem(ctx, notFoundErr, s.cacheDuration(), ck)
 	}
 }
 

aws-source/adapters/adapterhelpers_get_list_adapter_v2.go

@@ -167,7 +167,7 @@ func (s *GetListAdapterV2[ListInput, ListOutput, AWSItem, ClientStruct, Options]
 	if err != nil {
 		err := WrapAWSError(err)
 		if !CanRetry(err) {
-			s.cache.StoreError(ctx, err, s.cacheDuration(), ck)
+			s.cache.StoreUnavailableItem(ctx, err, s.cacheDuration(), ck)
 		}
 		return nil, err
 	}
@@ -310,7 +310,7 @@ func (s *GetListAdapterV2[ListInput, ListOutput, AWSItem, ClientStruct, Options]
 			ItemType:      s.ItemType,
 			ResponderName: s.Name(),
 		}
-		s.cache.StoreError(ctx, notFoundErr, s.cacheDuration(), ck)
+		s.cache.StoreUnavailableItem(ctx, notFoundErr, s.cacheDuration(), ck)
 	}
 }
 

aws-source/adapters/adapterhelpers_get_list_source.go

@@ -140,7 +140,7 @@ func (s *GetListAdapter[AWSItem, ClientStruct, Options]) Get(ctx context.Context
 	if err != nil {
 		err := WrapAWSError(err)
 		if !CanRetry(err) {
-			s.cache.StoreError(ctx, err, s.cacheDuration(), ck)
+			s.cache.StoreUnavailableItem(ctx, err, s.cacheDuration(), ck)
 		}
 		return nil, err
 	}
@@ -195,7 +195,7 @@ func (s *GetListAdapter[AWSItem, ClientStruct, Options]) List(ctx context.Contex
 	if err != nil {
 		err := WrapAWSError(err)
 		if !CanRetry(err) {
-			s.cache.StoreError(ctx, err, s.cacheDuration(), ck)
+			s.cache.StoreUnavailableItem(ctx, err, s.cacheDuration(), ck)
 		}
 		return nil, err
 	}
@@ -230,7 +230,7 @@ func (s *GetListAdapter[AWSItem, ClientStruct, Options]) List(ctx context.Contex
 			ItemType:      s.ItemType,
 			ResponderName: s.Name(),
 		}
-		s.cache.StoreError(ctx, notFoundErr, s.cacheDuration(), ck)
+		s.cache.StoreUnavailableItem(ctx, notFoundErr, s.cacheDuration(), ck)
 	}
 
 	return items, nil
@@ -319,7 +319,7 @@ func (s *GetListAdapter[AWSItem, ClientStruct, Options]) SearchCustom(ctx contex
 	awsItems, err := s.SearchFunc(ctx, s.Client, scope, query)
 	if err != nil {
 		err = WrapAWSError(err)
-		s.cache.StoreError(ctx, err, s.cacheDuration(), ck)
+		s.cache.StoreUnavailableItem(ctx, err, s.cacheDuration(), ck)
 		return nil, err
 	}
 
@@ -348,7 +348,7 @@ func (s *GetListAdapter[AWSItem, ClientStruct, Options]) SearchCustom(ctx contex
 			ItemType:      s.ItemType,
 			ResponderName: s.Name(),
 		}
-		s.cache.StoreError(ctx, notFoundErr, s.cacheDuration(), ck)
+		s.cache.StoreUnavailableItem(ctx, notFoundErr, s.cacheDuration(), ck)
 	}
 
 	return items, nil

aws-source/adapters/cloudwatch-instance-metric.go

@@ -293,7 +293,7 @@ func (a *CloudwatchInstanceMetricAdapter) Get(ctx context.Context, scope string,
 			Scope:       scope,
 		}
 		// Cache the error
-		a.cache.StoreError(ctx, qErr, a.cacheDuration(), ck)
+		a.cache.StoreUnavailableItem(ctx, qErr, a.cacheDuration(), ck)
 		return nil, qErr
 	}
 
@@ -305,7 +305,7 @@ func (a *CloudwatchInstanceMetricAdapter) Get(ctx context.Context, scope string,
 			Scope:       scope,
 		}
 		// Cache the error
-		a.cache.StoreError(ctx, qErr, a.cacheDuration(), ck)
+		a.cache.StoreUnavailableItem(ctx, qErr, a.cacheDuration(), ck)
 		return nil, qErr
 	}
 

aws-source/adapters/s3.go

@@ -226,7 +226,7 @@ func getImpl(ctx context.Context, cache sdpcache.Cache, client S3Client, scope s
 		if errors.As(err, &queryErr) {
 			// Cache not-found errors and other non-retryable errors
 			if queryErr.GetErrorType() == sdp.QueryError_NOTFOUND || !CanRetry(queryErr) {
-				cache.StoreError(ctx, err, CacheDuration, ck)
+				cache.StoreUnavailableItem(ctx, err, CacheDuration, ck)
 			}
 		}
 		return nil, err
@@ -400,7 +400,7 @@ func getImpl(ctx context.Context, cache sdpcache.Cache, client S3Client, scope s
 			ErrorString: err.Error(),
 			Scope:       scope,
 		}
-		cache.StoreError(ctx, err, CacheDuration, ck)
+		cache.StoreUnavailableItem(ctx, err, CacheDuration, ck)
 		return nil, err
 	}
 
@@ -596,7 +596,7 @@ func listImpl(ctx context.Context, cache sdpcache.Cache, client S3Client, scope
 
 	if err != nil {
 		err = sdp.NewQueryError(err)
-		cache.StoreError(ctx, err, CacheDuration, ck)
+		cache.StoreUnavailableItem(ctx, err, CacheDuration, ck)
 		return nil, err
 	}
 
@@ -625,7 +625,7 @@ func listImpl(ctx context.Context, cache sdpcache.Cache, client S3Client, scope
 			ItemType:      "s3-bucket",
 			ResponderName: "aws-s3-adapter",
 		}
-		cache.StoreError(ctx, notFoundErr, CacheDuration, ck)
+		cache.StoreUnavailableItem(ctx, notFoundErr, CacheDuration, ck)
 		return items, nil
 	}
 

cmd/changes_submit_plan.go

@@ -52,7 +52,7 @@ func changeTitle(ctx context.Context, arg string) string {
 		return arg
 	}
 
-	describeBytes, err := exec.CommandContext(ctx, "git", "describe", "--long").Output() //nolint:gosec // G702: all arguments are hardcoded string literals; no user input reaches this command
+	describeBytes, err := exec.CommandContext(ctx, "git", "describe", "--long").Output()
 	describe := strings.TrimSpace(string(describeBytes))
 	if err != nil {
 		log.WithError(err).Trace("failed to run 'git describe' for default title")

cmd/pterm.go

@@ -151,7 +151,7 @@ func RunRevlinkWarmup(ctx context.Context, oi sdp.OvermindInstance, postPlanPrin
 }
 
 func RunPlan(ctx context.Context, args []string) error {
-	c := exec.CommandContext(ctx, "terraform", args...) //nolint:gosec // G702: args are CLI arguments from the local user who invoked this command; this tool runs on the user's own machine
+	c := exec.CommandContext(ctx, "terraform", args...)
 
 	// remove go's default process cancel behaviour, so that terraform has a
 	// chance to gracefully shutdown when ^C is pressed. Otherwise the
@@ -180,7 +180,7 @@ func RunPlan(ctx context.Context, args []string) error {
 }
 
 func RunApply(ctx context.Context, args []string) error {
-	c := exec.CommandContext(ctx, "terraform", args...) //nolint:gosec // G702: args are CLI arguments from the local user who invoked this command; this tool runs on the user's own machine
+	c := exec.CommandContext(ctx, "terraform", args...)
 
 	// remove go's default process cancel behaviour, so that terraform has a
 	// chance to gracefully shutdown when ^C is pressed. Otherwise the

cmd/root.go

@@ -522,7 +522,7 @@ func login(ctx context.Context, cmd *cobra.Command, scopes []string, writer io.W
 	}
 
 	// apply a timeout to the main body of processing
-	ctx, _ = context.WithTimeout(ctx, timeout) //nolint:govet // the context will not leak as the command will exit when it is done
+	ctx, _ = context.WithTimeout(ctx, timeout) //nolint:govet,gosec // the context will not leak as the command will exit when it is done
 
 	return ctx, oi, token, nil
 }

cmd/terraform_plan.go

@@ -116,7 +116,7 @@ func TerraformPlanImpl(ctx context.Context, cmd *cobra.Command, oi sdp.OvermindI
 	// Convert provided plan into JSON for easier parsing
 	///////////////////////////////////////////////////////////////////
 
-	tfPlanJsonCmd := exec.CommandContext(ctx, "terraform", "show", "-json", planFile) //nolint:gosec // G702: "terraform", "show", "-json" are hardcoded; planFile is from the local user's CLI -out flag
+	tfPlanJsonCmd := exec.CommandContext(ctx, "terraform", "show", "-json", planFile)
 
 	tfPlanJsonCmd.Stderr = multi.NewWriter() // send output through PTerm; is usually empty
 
@@ -182,7 +182,7 @@ func TerraformPlanImpl(ctx context.Context, cmd *cobra.Command, oi sdp.OvermindI
 		}
 
 		line := printer.Sprintf("%v (%v)", mapping.TerraformName, mapping.Message)
-		_, err = fmt.Fprintf(resourceExtractionResults, "   %v\n", line) //nolint:gosec // G203: resourceExtractionResults is a pterm.MultiPrinter writer (terminal UI), not an http.ResponseWriter; no XSS vector
+		_, err = fmt.Fprintf(resourceExtractionResults, "   %v\n", line)
 		if err != nil {
 			return fmt.Errorf("error writing to resource extraction results: %w", err)
 		}
@@ -230,7 +230,7 @@ func TerraformPlanImpl(ctx context.Context, cmd *cobra.Command, oi sdp.OvermindI
 	}
 
 	title := changeTitle(ctx, viper.GetString("title"))
-	tfPlanTextCmd := exec.CommandContext(ctx, "terraform", "show", planFile) //nolint:gosec // G702: "terraform" and "show" are hardcoded; planFile is from the local user's CLI -out flag
+	tfPlanTextCmd := exec.CommandContext(ctx, "terraform", "show", planFile)
 
 	tfPlanTextCmd.Stderr = multi.NewWriter() // send output through PTerm; is usually empty
 
@@ -514,7 +514,7 @@ func osc8Hyperlink(url, text string) string {
 
 // getTicketLinkFromPlan reads the plan file to create a unique hash to identify this change
 func getTicketLinkFromPlan(planFile string) (string, error) {
-	plan, err := os.ReadFile(planFile) //nolint:gosec // G703: planFile is from the local user's CLI args; reading their chosen file is the intended behavior of this CLI tool
+	plan, err := os.ReadFile(planFile)
 	if err != nil {
 		return "", fmt.Errorf("failed to read plan file (%v): %w", planFile, err)
 	}

cmd/version_check.go

@@ -55,7 +55,7 @@ func checkVersion(ctx context.Context, currentVersion string) (latestVersion str
 	req.Header.Set("User-Agent", fmt.Sprintf("overmind-cli/%s", currentVersion))
 	req.Header.Set("Accept", "application/vnd.github.v3+json")
 
-	resp, err := client.Do(req) //nolint:gosec // G704: URL is the hardcoded constant githubReleasesURL; no user input reaches the request URL
+	resp, err := client.Do(req)
 	if err != nil {
 		log.WithError(err).Debug("Failed to check for CLI updates")
 		return "", false