Follow-up to 590f654 (awsacmpca: replace stub client with AWS SDK v2
implementation). CI's golangci-lint contextcheck rule flagged six
violations in awsacmpca_test.go where mustNew/awsacmpca.New were
called from test functions that had ctx in scope but didn't thread it
through New(). The previous commit used context.Background() inside
New() with the rationale that "the audit allows either threading or
documenting the limitation"; CI made that choice for us.
Threading ctx is the right shape per the audit's stated preference.
The fix cascades from awsacmpca.New through issuerfactory.NewFromConfig
and IssuerRegistry.Rebuild because the contextcheck rule propagates
upward through every caller that has ctx in scope.
This commit:
- Changes awsacmpca.New(config, logger) to
awsacmpca.New(ctx, config, logger). The ctx is passed to
buildSDKClient → awsconfig.LoadDefaultConfig so SDK credential chain
resolution honors caller deadlines (LoadDefaultConfig may probe IMDS
or remote credential sources). The doc-comment on New explains that
callers without a useful deadline should pass context.Background()
and that the SDK has internal credential-resolution timeouts.
- Adds ctx as the first parameter of issuerfactory.NewFromConfig.
Currently only the AWSACMPCA branch uses ctx (it's threaded into
awsacmpca.New); the other 11 branches accept ctx without using it.
This is a contractual change that lets callers thread ctx through
without contextcheck warnings, even though most issuer constructors
do no ctx-aware work today.
- Adds ctx as the first parameter of IssuerRegistry.Rebuild. Rebuild
iterates over configs and calls NewFromConfig per issuer; the same
ctx flows through every connector instantiation.
- Updates the two production call sites in internal/service:
- issuer.go:279 (TestIssuer connection test) now passes its
method-scoped ctx
- issuer.go:303 (BuildRegistry) now passes its method-scoped ctx
to Rebuild
- Updates 13 test sites in internal/connector/issuerfactory/factory_test.go
via a new testCtx() helper that returns context.Background(). Helper
is dedicated to this file so contextcheck's "you have a ctx in scope,
pass it" rule doesn't fire on test functions that don't otherwise
need ctx.
- Updates 6 test sites in internal/service/issuer_registry_test.go
to pass context.Background() to Rebuild.
- Removes the now-stale "// NewFromConfig has no ctx parameter
(preserved across all 12 connectors); pass context.Background() ..."
comment from the awsacmpca branch in factory.go — that workaround
is no longer the design.
Verified locally:
- gofmt -l . clean
- go vet ./... clean
- staticcheck ./... clean
- golangci-lint run --timeout 5m ./... clean (was failing with 6
contextcheck issues before the cascade; now 0 issues)
- go test -short -count=1 across all changed packages green
Sandbox couldn't run the existing CI's full make verify due to
disk pressure on /sessions and a virtiofs concurrent-open-file
ceiling on go mod tidy; operator should run `make verify` on
the workstation to confirm.
Audit reference: cowork/issuer-coverage-audit-2026-05-01/RESULTS.md
Top-10 fix#1 (CI follow-up; behavior unchanged from 590f654).
Close coverage gaps identified by dual-audit (qualitative + quantitative).
New test files for config (0%→98%), router (0%→100%), handler validation,
health, audit, response helpers, webhook notifier (0%→88%), email notifier,
middleware (recovery, rate limiter), domain profile, service nil-safety,
config helpers, issuer bootstrap, and server bootstrap wiring. Expanded
existing tests for ACME (34%→42%), step-ca (42%→52%), F5, SSH, agent
(43%→63%), scheduler (88%→99%), renewal service, and issuerfactory.
All tests pass: go test -short, go vet, go test -race clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace static env-var-based issuer wiring with GUI-driven dynamic
configuration stored encrypted in PostgreSQL. Operators can now
configure, test, enable/disable, and manage issuers from the dashboard
without restarting the server.
Key changes:
- AES-256-GCM encryption for sensitive issuer config at rest (PBKDF2
key derivation with 100k iterations)
- Dynamic IssuerRegistry with sync.RWMutex replacing static map
- Connector factory pattern (issuerfactory.NewFromConfig) replacing
140 lines of static wiring in main.go
- Migration 000009: encrypted_config, last_tested_at, test_status,
source columns on issuers table
- Env var seeding on first boot with ON CONFLICT DO NOTHING
- Registry Rebuild() for atomic map swap after CRUD operations
- Issuer type validation against domain constants on Create
- Audit trail for test connection results
- Conditional seeding for step-ca/OpenSSL (only when env vars set)
- GUI: source badge, connection test status on issuer detail page
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
shankar0123