From f21db2681619bfc51a50fde699dc4e2ec6dfd077 Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Wed, 19 Aug 2026 15:03:47 +1000
Subject: [PATCH] chore: block panic

---
 .golangci.yml                 | 5 ++++-
 internal/fipsboot/fipsboot.go | 1 +
 spinifex/utils/utils.go       | 1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.golangci.yml b/.golangci.yml
index 68623143d..ad42438fe 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -26,7 +26,7 @@ linters:
     - errorlint # catches ==/!= on errors, type assertions on errors, and %v instead of %w — all break on wrapped errors
     - exptostd # detects golang.org/x/exp/ functions replaceable by stdlib
     - fatcontext # detects nested contexts in loops
-    - forbidigo # blocks the legacy JetStream/KV symbols
+    - forbidigo # blocks forbidden identifiers
     - gocheckcompilerdirectives # validates go compiler directive comments (//go:)
     - godot # checks that declaration comments end in a period
     - goprintffuncname # checks that printf-like functions are named with f at the end
@@ -92,6 +92,8 @@ linters:
     forbidigo:
       analyze-types: true
       forbid:
+        - pattern: '^panic$'
+          msg: panic terminates the process; return an error or explicitly justify the panic.
         - pattern: '\.JetStream$'
           pkg: '^github\.com/nats-io/nats\.go$'
           msg: legacy nc.JetStream() is superseded; construct with jetstream.New(nc).
@@ -166,6 +168,7 @@ linters:
           - bodyclose
           - errcheck
           - errchkjson
+          - forbidigo
           - gosec
 
       # spinifex-specific: gosec exclusions
diff --git a/internal/fipsboot/fipsboot.go b/internal/fipsboot/fipsboot.go
index c3d711909..b659abf08 100644
--- a/internal/fipsboot/fipsboot.go
+++ b/internal/fipsboot/fipsboot.go
@@ -9,6 +9,7 @@ import (
 
 func init() {
 	if !fips140.Enabled() {
+		//nolint:forbidigo // Refuse to start when the required FIPS mode is disabled.
 		panic("fipsboot: FIPS 140-3 mode is not enabled at runtime — refusing to start. " +
 			"Build with GOFIPS140=v1.0.0 and do not set GODEBUG=fips140=off.")
 	}
diff --git a/spinifex/utils/utils.go b/spinifex/utils/utils.go
index 640530917..e6388e850 100644
--- a/spinifex/utils/utils.go
+++ b/spinifex/utils/utils.go
@@ -31,6 +31,7 @@ import (
 func GenerateResourceID(prefix string) string {
 	b := make([]byte, 9)
 	if _, err := rand.Read(b); err != nil {
+		//nolint:forbidigo // Continuing after the CSPRNG fails could create predictable resource IDs.
 		panic("crypto/rand failed: " + err.Error())
 	}
 	return prefix + "-" + hex.EncodeToString(b)[:17]