From a896d5f991ab67ecee4f883a05124bc570dbaedb Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sat, 2 May 2026 18:14:04 +0200
Subject: [PATCH] chore(lint): add revive config and fix exhaustive switch
 defaults

Add revive var-naming rule with skipPackageNameChecks to suppress
package-name lint violations. Add explicit default cases to switch
statements in wireguard/intent.go for exhaustiveness. Upgrade
assert.NoError to require.NoError in firewall tests to halt on error.
---
 .golangci.yml                | 8 ++++++++
 cmd/firewall/allow_test.go   | 2 +-
 cmd/firewall/resolve_test.go | 4 ++--
 internal/wireguard/intent.go | 5 ++++-
 4 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/.golangci.yml b/.golangci.yml
index 93bb9c3..7df00e4 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -42,6 +42,14 @@ linters:
     exhaustive:
       default-signifies-exhaustive: true
 
+    revive:
+      rules:
+        - name: var-naming
+          arguments:
+            - []
+            - []
+            - - skipPackageNameChecks: true
+
     staticcheck:
       checks: ["all", "-ST1005", "-S1016"]
 
diff --git a/cmd/firewall/allow_test.go b/cmd/firewall/allow_test.go
index e1b697f..53051dd 100644
--- a/cmd/firewall/allow_test.go
+++ b/cmd/firewall/allow_test.go
@@ -162,7 +162,7 @@ func TestEmitAllowRevoke_Bidirectional(t *testing.T) {
 	rootCmdFor(inner)
 
 	err := emitAllowRevoke(context.Background(), inner, parent, local, fr, false)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 
 	var posts int
 	for _, c := range fr.calls {
diff --git a/cmd/firewall/resolve_test.go b/cmd/firewall/resolve_test.go
index a42b8db..a7465ac 100644
--- a/cmd/firewall/resolve_test.go
+++ b/cmd/firewall/resolve_test.go
@@ -39,14 +39,14 @@ func TestResolveEndpoint_ByShortID(t *testing.T) {
 
 func TestResolveEndpoint_ByHostName(t *testing.T) {
 	c, err := resolveEndpoint("h3:web", cs())
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, "h3", c.Host)
 	assert.Equal(t, "10.210.2.10", c.IP.String())
 }
 
 func TestResolveEndpoint_ByRawIP(t *testing.T) {
 	c, err := resolveEndpoint("10.210.1.10", cs())
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, "h2", c.Host)
 }
 
diff --git a/internal/wireguard/intent.go b/internal/wireguard/intent.go
index eca9f94..542f7ad 100644
--- a/internal/wireguard/intent.go
+++ b/internal/wireguard/intent.go
@@ -193,6 +193,8 @@ func decide(a PlannedAction, d *DesiredMesh, newHostSet map[string]struct{}) str
 		case catSafeAlways, catDestructiveReplace, catWipeDB, catCorrosionSchemaFirstWrite:
 			return "upgrade: non-version-bump action skipped"
 		}
+	default:
+		// IntentBootstrap (and unknown intents) keep every action.
 	}
 	return ""
 }
@@ -206,6 +208,7 @@ func isUpgradeServiceRestart(t ActionType) bool {
 		ActionInstallCooldService,
 		ActionInstallSchedulerService:
 		return true
+	default:
+		return false
 	}
-	return false
 }