From 52cf2af9f72fd6d4a9aaf3448c2aa9bbcd5abd81 Mon Sep 17 00:00:00 2001
From: Steve Yegge <stevey@sourcegraph.com>
Date: Wed, 5 Nov 2025 01:11:09 -0800
Subject: [PATCH] Fix lint errors: add error check and gosec suppressions

---
 internal/storage/sqlite/multirepo.go        | 2 +-
 internal/storage/sqlite/multirepo_export.go | 4 ++--
 internal/storage/sqlite/resurrection.go     | 2 +-
 internal/testutil/tmpfs.go                  | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/internal/storage/sqlite/multirepo.go b/internal/storage/sqlite/multirepo.go
index 430a9582..d054987d 100644
--- a/internal/storage/sqlite/multirepo.go
+++ b/internal/storage/sqlite/multirepo.go
@@ -118,7 +118,7 @@ func (s *SQLiteStorage) hydrateFromRepo(ctx context.Context, repoPath, sourceRep
 
 // importJSONLFile imports issues from a JSONL file, setting the source_repo field.
 func (s *SQLiteStorage) importJSONLFile(ctx context.Context, jsonlPath, sourceRepo string) (int, error) {
-	file, err := os.Open(jsonlPath)
+	file, err := os.Open(jsonlPath) // #nosec G304 -- jsonlPath is from trusted source
 	if err != nil {
 		return 0, fmt.Errorf("failed to open JSONL file: %w", err)
 	}
diff --git a/internal/storage/sqlite/multirepo_export.go b/internal/storage/sqlite/multirepo_export.go
index 180aa072..932d89f3 100644
--- a/internal/storage/sqlite/multirepo_export.go
+++ b/internal/storage/sqlite/multirepo_export.go
@@ -127,7 +127,7 @@ func (s *SQLiteStorage) exportToRepo(ctx context.Context, repoPath string, issue
 
 	// Write atomically using temp file + rename
 	tempPath := fmt.Sprintf("%s.tmp.%d", jsonlPath, os.Getpid())
-	f, err := os.Create(tempPath)
+	f, err := os.Create(tempPath) // #nosec G304 -- tempPath derived from trusted jsonlPath
 	if err != nil {
 		return 0, fmt.Errorf("failed to create temp file: %w", err)
 	}
@@ -161,7 +161,7 @@ func (s *SQLiteStorage) exportToRepo(ctx context.Context, repoPath string, issue
 	}
 
 	// Set file permissions
-	if err := os.Chmod(jsonlPath, 0644); err != nil {
+	if err := os.Chmod(jsonlPath, 0644); err != nil { // nolint:gosec // G302: 0644 intentional for git-tracked files
 		// Non-fatal
 		if os.Getenv("BD_DEBUG") != "" {
 			fmt.Fprintf(os.Stderr, "Debug: failed to set permissions on %s: %v\n", jsonlPath, err)
diff --git a/internal/storage/sqlite/resurrection.go b/internal/storage/sqlite/resurrection.go
index d5589844..5e6ee192 100644
--- a/internal/storage/sqlite/resurrection.go
+++ b/internal/storage/sqlite/resurrection.go
@@ -120,7 +120,7 @@ func (s *SQLiteStorage) findIssueInJSONL(issueID string) (*types.Issue, error) {
 	}
 	
 	// Open and scan JSONL file
-	file, err := os.Open(jsonlPath)
+	file, err := os.Open(jsonlPath) // #nosec G304 -- jsonlPath is from trusted beads directory
 	if err != nil {
 		return nil, fmt.Errorf("failed to open JSONL file: %w", err)
 	}
diff --git a/internal/testutil/tmpfs.go b/internal/testutil/tmpfs.go
index 50cf7a9c..56ed945e 100644
--- a/internal/testutil/tmpfs.go
+++ b/internal/testutil/tmpfs.go
@@ -55,7 +55,7 @@ func TempDirInMemory(t testing.TB) string {
 
 	// Register cleanup
 	t.Cleanup(func() {
-		os.RemoveAll(tmpDir)
+		_ = os.RemoveAll(tmpDir)
 	})
 
 	return tmpDir