Add make targets for go workspaces, gosec targets use go run instead of container, run make fix-all

.dockerignore

@@ -9,3 +9,5 @@ __debug_bin*
 docs/
 examples/
 deployments/
+go.work
+go.work.sum

.gitignore

@@ -5,6 +5,8 @@ apiserver.local.config/
 *.csv
 load_test_results.txt
 .env
+go.work
+go.work.sum
 
 # Development artifact path
 .build/

Makefile

@@ -71,6 +71,7 @@ include make/go.mk           # fmt, vet, lint, fix-headers, fix-all
 include make/testing.mk      # test, unit, unit-clean, vulncheck, test-e2e*
 include make/security.mk     # gosec, gosec-sarif
 include make/mocks.mk        # generate-mocks, clean-mocks
+include make/work.mk         # go.work, clean-work
 
 .DEFAULT_GOAL := help
 

api/Makefile

@@ -27,7 +27,7 @@ vet: ## Run go vet against the module
 
 .PHONY: fix
 fix: ## Run go fix against the module
-	go fix ./...
+	go fix -omitzero=false ./...
 
 .PHONY: tidy
 tidy: ## Run go tidy against the module

controllers/functionconfigs/functionconfigreconciler_test.go

@@ -192,7 +192,6 @@ func TestFunctionConfigReconciler(t *testing.T) {
 		t.Fatalf("unable to add configapi to scheme: %v", err)
 	}
 	for _, tt := range tests {
-		tt := tt // pin for closure
 		t.Run(tt.name, func(t *testing.T) {
 			c := fake.NewClientBuilder().WithObjects(tt.objs...).WithScheme(scheme).WithStatusSubresource(&configapi.FunctionConfig{}).Build()
 
@@ -468,13 +467,13 @@ func TestConcurrentAccessSafety(t *testing.T) {
 	// Writer goroutine
 	go func() {
 		defer close(done)
-		for i := 0; i < 100; i++ {
+		for range 100 {
 			store.UpdateExecCache(obj.Name, obj)
 		}
 	}()
 
 	// Reader goroutine (concurrent with writer)
-	for i := 0; i < 100; i++ {
+	for range 100 {
 		store.GetProcessorFromCache("ghcr.io/kptdev/krm-functions-catalog/set-namespace:v0.4.1")
 	}
 

controllers/packagerevisions/integration/packagerevision_integration_test.go

@@ -126,7 +126,6 @@ var _ = Describe("PackageRevision Controller Integration", func() {
 		}
 
 		for _, tc := range transitions {
-			tc := tc
 			It(fmt.Sprintf("Should transition %s -> %s and set Ready=True", tc.current, tc.desired), func() {
 				var fetched porchv1alpha2.PackageRevision
 				Expect(k8sClient.Get(ctx, nn, &fetched)).To(Succeed())

controllers/packagerevisions/pkg/controllers/packagerevision/mergekey.go

@@ -21,6 +21,7 @@ package packagerevision
 import (
 	"bytes"
 	"fmt"
+	"maps"
 	"path"
 	"strings"
 
@@ -50,9 +51,7 @@ func ensureMergeKey(resources map[string]string) (map[string]string, error) {
 		return nil, fmt.Errorf("failed to add merge-key directive: %w", err)
 	}
 
-	for k, v := range pr.extra {
-		result[k] = v
-	}
+	maps.Copy(result, pr.extra)
 
 	return result, nil
 }

controllers/packagerevisions/pkg/webhooks/packagerevision_webhook.go

@@ -503,7 +503,7 @@ func (v *PackageRevisionValidator) unmarshalPackageRevision(raw []byte, fieldNam
 }
 
 // unmarshalInto unmarshals raw bytes into a target object, handling empty and malformed data.
-func (v *PackageRevisionValidator) unmarshalInto(raw []byte, target interface{}, fieldName string) *admission.Response {
+func (v *PackageRevisionValidator) unmarshalInto(raw []byte, target any, fieldName string) *admission.Response {
 	if len(raw) == 0 {
 		resp := admission.Errored(http.StatusBadRequest, fmt.Errorf("%s is empty", fieldName))
 		return &resp

controllers/packagerevisions/pkg/webhooks/packagerevision_webhook_test.go

@@ -1174,7 +1174,7 @@ func TestUnmarshalInto(t *testing.T) {
 	tests := []struct {
 		name      string
 		raw       []byte
-		target    interface{}
+		target    any
 		fieldName string
 		wantErr   bool
 		errMsg    string

controllers/packagevariants/pkg/controllers/packagevariant/packagevariant_controller-with-workspacename_test.go

@@ -784,11 +784,11 @@ status:
 		t.Run(tn, func(t *testing.T) {
 			var pv api.PackageVariant
 			require.NoError(t, yaml.Unmarshal(
-				[]byte(fmt.Sprintf(pvStr, tc.deletionPolicy)), &pv))
+				fmt.Appendf(nil, pvStr, tc.deletionPolicy), &pv))
 
 			var pr porchapi.PackageRevision
 			require.NoError(t, yaml.Unmarshal(
-				[]byte(fmt.Sprintf(prStr, tc.prLifecycle)), &pr))
+				fmt.Appendf(nil, prStr, tc.prLifecycle), &pr))
 
 			fc := &fakeClient{}
 			reconciler := &PackageVariantReconciler{Client: fc}
@@ -963,7 +963,7 @@ items:
 
 			var pv api.PackageVariant
 			require.NoError(t, yaml.Unmarshal(
-				[]byte(fmt.Sprintf(pvStr, tc.adoptionPolicy)), &pv))
+				fmt.Appendf(nil, pvStr, tc.adoptionPolicy), &pv))
 
 			actualStr := reconciler.getDownstreamPRs(context.TODO(), &pv, &prList)
 			var actual []string

controllers/packagevariants/pkg/controllers/packagevariant/packagevariant_controller.go

@@ -18,6 +18,7 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"maps"
 	"strconv"
 	"strings"
 
@@ -601,15 +602,11 @@ func (r *PackageVariantReconciler) adoptPackageRevision(ctx context.Context,
 	if len(pv.Spec.Labels) > 0 && pr.Labels == nil {
 		pr.Labels = make(map[string]string)
 	}
-	for k, v := range pv.Spec.Labels {
-		pr.Labels[k] = v
-	}
+	maps.Copy(pr.Labels, pv.Spec.Labels)
 	if len(pv.Spec.Annotations) > 0 && pr.Annotations == nil {
 		pr.Annotations = make(map[string]string)
 	}
-	for k, v := range pv.Spec.Annotations {
-		pr.Annotations[k] = v
-	}
+	maps.Copy(pr.Annotations, pv.Spec.Annotations)
 	return r.Update(ctx, pr)
 }
 
@@ -872,9 +869,7 @@ func (r *PackageVariantReconciler) calculateDraftResources(ctx context.Context,
 	}
 
 	origResources := make(map[string]string, len(prr.Spec.Resources))
-	for k, v := range prr.Spec.Resources {
-		origResources[k] = v
-	}
+	maps.Copy(origResources, prr.Spec.Resources)
 
 	// Apply our mutations
 	if err := ensurePackageContext(pv, &prr); err != nil {
@@ -985,9 +980,7 @@ func ensurePackageContext(pv *configapi.PackageVariant,
 	}
 
 	// set or add keys that should be there
-	for k, v := range pv.Spec.PackageContext.Data {
-		data[k] = v
-	}
+	maps.Copy(data, pv.Spec.PackageContext.Data)
 
 	// remove any keys that should go
 	for _, k := range pv.Spec.PackageContext.RemoveKeys {

controllers/packagevariants/pkg/controllers/packagevariant/packagevariant_controller_test.go

@@ -787,11 +787,11 @@ status:
 		t.Run(tn, func(t *testing.T) {
 			var pv api.PackageVariant
 			require.NoError(t, yaml.Unmarshal(
-				[]byte(fmt.Sprintf(pvStr, tc.deletionPolicy)), &pv))
+				fmt.Appendf(nil, pvStr, tc.deletionPolicy), &pv))
 
 			var pr porchapi.PackageRevision
 			require.NoError(t, yaml.Unmarshal(
-				[]byte(fmt.Sprintf(prStr, tc.prLifecycle)), &pr))
+				fmt.Appendf(nil, prStr, tc.prLifecycle), &pr))
 
 			fc := &fakeClient{}
 			reconciler := &PackageVariantReconciler{Client: fc}
@@ -966,7 +966,7 @@ items:
 
 			var pv api.PackageVariant
 			require.NoError(t, yaml.Unmarshal(
-				[]byte(fmt.Sprintf(pvStr, tc.adoptionPolicy)), &pv))
+				fmt.Appendf(nil, pvStr, tc.adoptionPolicy), &pv))
 
 			actualStr := reconciler.getDownstreamPRs(context.TODO(), &pv, &prList)
 			var actual []string

controllers/packagevariantsets/pkg/controllers/packagevariantset/render.go

@@ -17,6 +17,7 @@ package packagevariantset
 import (
 	"context"
 	"fmt"
+	"maps"
 	"reflect"
 	"slices"
 
@@ -245,9 +246,7 @@ func objectToInput(obj any) (map[string]any, error) {
 
 func copyAndOverlayMapExpr(fieldName string, inMap map[string]string, mapExprs []api.MapExpr, inputs map[string]any) (map[string]string, error) {
 	outMap := make(map[string]string, len(inMap))
-	for k, v := range inMap {
-		outMap[k] = v
-	}
+	maps.Copy(outMap, inMap)
 
 	var err error
 	for i, me := range mapExprs {