shankar0123 62513ad12f ci: fix Phase 3 post-push CI failures (contextcheck + ST1021) ...

CI on commit 9bc8453 (Phase 3 challenges) failed three lint checks under
golangci-lint. Two were contextcheck on internal/service/acme.go
RespondToChallenge, where the validator-pool dispatch deliberately
detached from the request ctx via 'context.Background()' so the async
WithinTx survives the HTTP handler returning. contextcheck rightly
flagged the non-inherited context — the canonical Go 1.21+ answer for
this exact pattern is context.WithoutCancel(ctx), which preserves
inherited values (logger, trace IDs, audit actor) but detaches
cancellation. Swapping that in clears both contextcheck hits.

The third was ST1021 on internal/api/acme/validators.go: a comment
intended for the (*Pool).Snapshot() method had landed above the
PoolSnapshot type by accident. Split the comment — one prose line
for the type, one for the method — so each exported symbol carries
its own properly-anchored doc.

Confirmed local 'go vet' clean and 'go test -short -count=1' green
across internal/service/ and internal/api/acme/ before commit.

2026-05-03 15:56:03 +00:00

..

acme_test.go

acme-server: HTTP-01 + DNS-01 + TLS-ALPN-01 challenge validation (Phase 3/7)

2026-05-03 14:09:00 +00:00

acme.go

ci: fix Phase 3 post-push CI failures (contextcheck + ST1021)

2026-05-03 15:56:03 +00:00

agent_group_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

agent_group.go

Bundle E: Mechanical sweeps & defensive polish — 6 findings closed; L-004 deferred

2026-04-27 01:17:15 +00:00

agent_retire_test.go

Close I-004 (agent hard-delete cascades targets) coverage-gap finding

2026-04-19 05:24:00 +00:00

agent_retire.go

Close I-004 (agent hard-delete cascades targets) coverage-gap finding

2026-04-19 05:24:00 +00:00

agent_round_out_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

agent_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

agent.go

feat(scep): plumb CertificateProfile.MustStaple end-to-end through service layer

2026-04-29 13:36:30 +00:00

atomic_audit_test.go

repo,service: introduce WithinTx and atomic audit rows for issue/renew/revoke

2026-05-02 00:29:09 +00:00

audit_redact_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

audit_redact.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

audit_test.go

Implement M4: comprehensive test coverage with 120 tests

2026-03-15 00:25:01 -04:00

audit.go

repo,service: introduce WithinTx and atomic audit rows for issue/renew/revoke

2026-05-02 00:29:09 +00:00

bulk_reassignment_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

bulk_reassignment.go

fix(api,web,mcp): add bulk-renew + bulk-reassign endpoints, drop client-side N×HTTP loops (L-1 master)

2026-04-25 14:33:02 +00:00

bulk_renewal_test.go

fix(api,web,mcp): add bulk-renew + bulk-reassign endpoints, drop client-side N×HTTP loops (L-1 master)

2026-04-25 14:33:02 +00:00

bulk_renewal.go

fix(api,web,mcp): add bulk-renew + bulk-reassign endpoints, drop client-side N×HTTP loops (L-1 master)

2026-04-25 14:33:02 +00:00

bulk_revocation_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

bulk_revocation.go

EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

2026-04-30 00:52:43 +00:00

ca_operations_test.go

F-001/F-002/F-003: CRL prefix-scan, digest error sanitization, ctx-aware sleeps

2026-04-20 16:51:52 +00:00

ca_operations.go

feat(ocsp): pre-signed response cache + invalidate-on-revoke (Phase 2)

2026-04-30 05:03:01 +00:00

certificate_nil_safety_test.go

fix(m-2): thread context through CertificateService cluster

2026-04-18 00:29:37 +00:00

certificate_round_out_test.go

Bundle N.C-extended (Coverage Audit Extension): service + handler round-out — M-002 + M-003 partial-closed

2026-04-27 21:40:09 +00:00

certificate_test.go

fix(m-2): thread context through CertificateService cluster

2026-04-18 00:29:37 +00:00

certificate.go

repo,service: introduce WithinTx and atomic audit rows for issue/renew/revoke

2026-05-02 00:29:09 +00:00

cloud_discovery_test.go

feat(M50): cloud secret manager discovery — AWS SM, Azure KV, GCP SM

2026-04-15 23:01:00 -04:00

cloud_discovery.go

feat(M50): cloud secret manager discovery — AWS SM, Azure KV, GCP SM

2026-04-15 23:01:00 -04:00

concurrent_test.go

fix(m2-pr-e): collapse AgentService.HeartbeatWithContext into Heartbeat

2026-04-18 01:25:20 +00:00

config_helpers_test.go

test: comprehensive test gap closure across 24 packages

2026-04-09 23:09:40 -04:00

config_helpers.go

feat(M35): dynamic target configuration with encrypted config, test connection, and GUI updates

2026-04-04 01:09:53 -04:00

context_test.go

fix(m2-pr-e): collapse AgentService.HeartbeatWithContext into Heartbeat

2026-04-18 01:25:20 +00:00

coverage_extras_test.go

test(service): coverage uplift for production hardening II + adjacent helpers (R-CI-extended floor)

2026-04-30 06:22:06 +00:00

crl_cache_test.go

repo,service: introduce WithinTx and atomic audit rows for issue/renew/revoke

2026-05-02 00:29:09 +00:00

crl_cache.go

scheduler/service: crlGenerationLoop + CRLCacheService with singleflight

2026-04-29 00:02:01 +00:00

crypto_validation_test.go

feat: M11a — certificate profiles, crypto policy enforcement, short-lived cert expiry

2026-03-20 20:39:49 -04:00

crypto_validation.go

feat: M11a — certificate profiles, crypto policy enforcement, short-lived cert expiry

2026-03-20 20:39:49 -04:00

csr_renewal_test.go

feat(M34): dynamic issuer configuration with encrypted config storage

2026-04-04 00:20:13 -04:00

deploy_counters_test.go

feat(metrics): per-target-type deploy counters wired into /metrics/prometheus

2026-04-30 15:25:38 +00:00

deploy_counters.go

chore: gofmt fixes across deploy-hardening I new files

2026-04-30 15:33:33 +00:00

deployment_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

deployment.go

Close I-004 (agent hard-delete cascades targets) coverage-gap finding

2026-04-19 05:24:00 +00:00

digest_test.go

feat(m28+m29+m30): ACME ARI, email digest, and Helm chart

2026-03-28 21:18:35 -04:00

digest.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

discovery_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

discovery.go

Close M-004 (OCSP issuer binding) and M-005 (discovery actor propagation) coverage-gap findings

2026-04-18 22:20:25 +00:00

est_audit_actions_test.go

EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

2026-04-30 00:52:43 +00:00

est_audit_actions.go

EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

2026-04-30 00:52:43 +00:00

est_counters.go

fix(est): plumb context through ESTService.ReloadTrust to satisfy contextcheck

2026-04-30 01:59:04 +00:00

est_profile_counter_isolation_test.go

EST RFC 7030 hardening master bundle Phases 5-7: end-to-end serverkeygen

2026-04-29 23:57:45 +00:00

est_test.go

EST RFC 7030 hardening master bundle Phases 5-7: end-to-end serverkeygen

2026-04-29 23:57:45 +00:00

est.go

EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

2026-04-30 00:52:43 +00:00

export_audit_actions.go

fix(cert-export): satisfy staticcheck ST1022 on PKCS12CipherModernAES256

2026-04-30 05:22:10 +00:00

export_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

export.go

feat(cert-export): typed audit-action constants + has_private_key + cipher detail (Phase 7)

2026-04-30 05:13:15 +00:00

health_check_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

health_check.go

feat(M48): continuous TLS health monitoring — endpoint state machine, shared tlsprobe, 8 API endpoints, GUI

2026-04-15 21:45:45 -04:00

issuance_metrics_test.go

metrics: gofmt issuance_metrics_test.go — fix CI

2026-05-02 01:27:33 +00:00

issuance_metrics.go

metrics: add per-issuer-type issuance counters, histogram, and failure classifier

2026-05-02 00:39:25 +00:00

issuer_adapter_test.go

feat(scep): plumb CertificateProfile.MustStaple end-to-end through service layer

2026-04-29 13:36:30 +00:00

issuer_adapter.go

metrics: add per-issuer-type issuance counters, histogram, and failure classifier

2026-05-02 00:39:25 +00:00

issuer_bootstrap_test.go

fix(crypto): per-ciphertext PBKDF2 salt + v2 versioned format with v1 fallback (M-8)

2026-04-17 05:36:29 +00:00

issuer_registry_test.go

awsacmpca: thread ctx through factory + registry — fix CI contextcheck

2026-05-01 23:27:25 +00:00

issuer_registry.go

acme: support serial-only revocation via local cert-version lookup

2026-05-02 13:09:30 +00:00

issuer_test.go

M-2 PR-B: Collapse IssuerService + TargetService to ctx-first signatures

2026-04-18 00:46:58 +00:00

issuer.go

awsacmpca: thread ctx through factory + registry — fix CI contextcheck

2026-05-01 23:27:25 +00:00

job_concurrency_test.go

fix(test): TestBoundedFanOut_SkipsAgentRoutedDeployments race on seenIDs slice

2026-05-02 14:34:48 +00:00

job_offline_agent_reaper_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

job_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

job.go

scheduler: bound renewal concurrency via CERTCTL_RENEWAL_CONCURRENCY

2026-05-02 14:12:30 +00:00

m11c_crypto_enforcement_test.go

feat(scep): plumb CertificateProfile.MustStaple end-to-end through service layer

2026-04-29 13:36:30 +00:00

network_scan_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

network_scan.go

feat(scep): SCEP probe in network scanner for fleet-readiness assessment

2026-04-29 18:51:57 +00:00

notification_test.go

I-005: notification retry loop + dead-letter queue

2026-04-19 15:17:27 +00:00

notification.go

I-005: notification retry loop + dead-letter queue

2026-04-19 15:17:27 +00:00

ocsp_counters_test.go

test(service): coverage uplift for production hardening II + adjacent helpers (R-CI-extended floor)

2026-04-30 06:22:06 +00:00

ocsp_counters.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

ocsp_nonce_test.go

feat(ocsp): RFC 6960 §4.4.1 nonce extension support — echo client nonce in response, reject malformed

2026-04-30 04:55:06 +00:00

ocsp_nonce.go

feat(ocsp): RFC 6960 §4.4.1 nonce extension support — echo client nonce in response, reject malformed

2026-04-30 04:55:06 +00:00

ocsp_response_cache_real_test.go

test(service): coverage uplift for production hardening II + adjacent helpers (R-CI-extended floor)

2026-04-30 06:22:06 +00:00

ocsp_response_cache_test.go

feat(ocsp): pre-signed response cache + invalidate-on-revoke (Phase 2)

2026-04-30 05:03:01 +00:00

ocsp_response_cache.go

feat(ocsp): pre-signed response cache + invalidate-on-revoke (Phase 2)

2026-04-30 05:03:01 +00:00

owner_test.go

M-2 PR-C: Collapse Policy/Profile/Owner/Team services to ctx-first signatures

2026-04-18 01:10:06 +00:00

owner.go

Bundle E: Mechanical sweeps & defensive polish — 6 findings closed; L-004 deferred

2026-04-27 01:17:15 +00:00

policy_test.go

fix(policies): close the D-006 loop — TitleCase seed canonicals + severity-aware, config-consuming rule engine (D-008)

2026-04-18 14:55:56 +00:00

policy.go

fix(policies): close the D-006 loop — TitleCase seed canonicals + severity-aware, config-consuming rule engine (D-008)

2026-04-18 14:55:56 +00:00

profile_test.go

M-2 PR-C: Collapse Policy/Profile/Owner/Team services to ctx-first signatures

2026-04-18 01:10:06 +00:00

profile.go

Bundle E: Mechanical sweeps & defensive polish — 6 findings closed; L-004 deferred

2026-04-27 01:17:15 +00:00

renewal_policy_test.go

G-1: renewal-policies API + frontend FK-drift fix

2026-04-20 18:53:01 +00:00

renewal_policy.go

G-1: renewal-policies API + frontend FK-drift fix

2026-04-20 18:53:01 +00:00

renewal_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

renewal.go

repo,service: introduce WithinTx and atomic audit rows for issue/renew/revoke

2026-05-02 00:29:09 +00:00

revocation_svc_test.go

fix(m-2): thread context through CertificateService cluster

2026-04-18 00:29:37 +00:00

revocation_svc.go

repo,service: introduce WithinTx and atomic audit rows for issue/renew/revoke

2026-05-02 00:29:09 +00:00

revocation_test.go

fix(m-2): thread context through CertificateService cluster

2026-04-18 00:29:37 +00:00

scep_intune_test.go

fix(scep-intune): close 11 audit gaps from 2026-04-29 pre-tag review

2026-04-29 20:28:53 +00:00

scep_must_staple_test.go

feat(scep): plumb CertificateProfile.MustStaple end-to-end through service layer

2026-04-29 13:36:30 +00:00

scep_probe_persist_test.go

fix(scep-intune): close 11 audit gaps from 2026-04-29 pre-tag review

2026-04-29 20:28:53 +00:00

scep_probe_test.go

feat(scep): SCEP probe in network scanner for fleet-readiness assessment

2026-04-29 18:51:57 +00:00

scep_probe.go

fix(scep-probe): satisfy staticcheck QF1008 in describeCertAlgorithm

2026-04-29 19:00:05 +00:00

scep_test.go

feat(scep): RenewalReq + GetCertInitial + ChromeOS E2E + caps + must-staple

2026-04-29 13:16:09 +00:00

scep.go

fix(scep-intune): close 11 audit gaps from 2026-04-29 pre-tag review

2026-04-29 20:28:53 +00:00

shortlived_test.go

acme: support serial-only revocation via local cert-version lookup

2026-05-02 13:09:30 +00:00

stats_test.go

fix: resolve flaky TestGetJobStats_WithData timezone issue

2026-03-25 20:55:48 -04:00

stats.go

I-005: notification retry loop + dead-letter queue

2026-04-19 15:17:27 +00:00

target_test.go

fix(gui,api): close C-001 + C-002 — ownership + agent FK contract

2026-04-18 16:01:40 +00:00

target.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

team_test.go

M-2 PR-C: Collapse Policy/Profile/Owner/Team services to ctx-first signatures

2026-04-18 01:10:06 +00:00

team.go

Bundle E: Mechanical sweeps & defensive polish — 6 findings closed; L-004 deferred

2026-04-27 01:17:15 +00:00

testutil_test.go

acme: support serial-only revocation via local cert-version lookup

2026-05-02 13:09:30 +00:00

verification_test.go

Bundle C: Renewal/reliability cluster — 7 findings closed

2026-04-27 00:08:25 +00:00

verification.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00