Main CI red post-#1220: golangci-lint flood, npm audit, internal/config integration failures

[cristim]

Main's CI - Build & Test workflow still fails on the current HEAD (4108e51, post #1220 "fix/main-ci-failing-jobs"), run 27325319311. Every open PR inherits these failures, so CI is red regardless of the PR's content. Three independent breakages:

1. Lint Code ("Run golangci-lint" step): a flood of findings across long-unchanged files, e.g. errcheck on cmd/cleanup-lambda/main.go:78 and cmd/configure_azure.go, errorlint on internal/config/store_postgres.go (many lines) and internal/api/handler_purchases.go:1383, godot on internal/testutil/testutil.go. The breadth suggests linter version or config drift (new linters becoming active) rather than new code. Note the repo rule to pin CI tool versions.

2. Security Scanning ("Run npm audit (frontend)" step): the job now fails at the frontend npm audit step (the Go scanners pass).

3. Integration Tests ("Run integration tests" step): real failures in internal/config:

   • TestPostgresStore_UpsertRecommendations_AccountScopedEviction
   • TestPostgresStore_UpsertRecommendations_AmbientAndRegisteredCoexist
   • TestPostgresStore_PurchaseExecutions/Get_execution_by_ID_-_not_found followed by panic: runtime error: invalid memory address or nil pointer dereference, failing the whole package.

The pre-commit workflow on main is also red; that one is the gocyclo breakage tracked separately in #1222.

Suggested split: pin/align golangci-lint and reconcile its config; triage the npm audit advisory (upgrade or documented exemption, no blanket --audit-level loosening without justification); fix the internal/config integration tests (the nil-pointer panic looks related to the recent (nil, nil) not-found contract change in 1017f66).

[cristim]

Verification sweep against main (101f099fb) on 2026-07-27 finds this already resolved.
Main CI is green: Lint Code, Security Scanning and Integration Tests all report success on the latest run.
Evidence: run 30296156256 on 101f099.
Recommending close. Reopen if CI regresses.

[cristim]

Closing as resolved. Verified rather than assumed.

CI - Build & Test is green on main across the last three merges:

08-09T02:44  a37e14790: success
08-08T20:22  d6e60f637: success
08-08T14:40  726389b48: success

All three named breakages are addressed:

1. golangci-lint flood — the linter is now pinned to v2.10.1 in CI and passes at the repo root with a genuine 0 issues. line. (Version drift was the suspected cause in this issue, and pinning is what fixed it.)
2. npm audit — fixed in fix(ci): npm audit advisories and scanner decoupling in Security Scanning #1716.
3. internal/config integration failures — not reproducing; integration tests pass in the current runs.

Two things found while checking, both filed separately rather than folded in here:

• ci(azure): Deploy to Azure Container Apps has failed on every main run for 3 weeks — no Azure change since 2026-07-19 is deployed #1794 (p0) — Deploy to Azure Container Apps has failed on every main run since 2026-07-19: 0 successes in the last 100 runs. It fails at Terraform Apply on a missing custom role definition. This issues premise, "CI is red", turned out to be false for build and test and true for deploy — a distinction nothing surfaces, since the deploy is a separate workflow.
• The repos CI has also changed materially since this was filed: ci: run unit and integration tests in every workspace module #1755 rewrote the test jobs to loop over all six workspace modules, because ./... from the root covered only one of them (ci: unit and integration test jobs only run the root module — providers/*, pkg and tests/e2e are never tested #1751). Five modules had tests that had never gated a merge.

Reopen if the lint flood recurs; the pinned version is the thing keeping it closed.