chore: fix several checks issues from gocritic

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

.golangci.yml

@@ -94,32 +94,19 @@ linters:
         - emptyStringTest
         - exposedSyncMutex
         - filepathJoin
-        - httpNoBody
         - hugeParam
         - ifElseChain
         - importShadow
         - nestingReduce
         - nilValReturn
-        - octalLiteral
         - paramTypeCombine
-        - preferStringWriter
         - ptrToRefParam
         - rangeValCopy
-        - regexpSimplify
         - singleCaseSwitch
-        - sloppyReassign
-        - sloppyLen
-        - sprintfQuotedString
-        - stringConcatSimplify
-        - stringsCompare
-        - stringXbytes
         - todoCommentWithoutDetail
         - tooManyResultsChecker
-        - typeAssertChain
         - uncheckedInlineErr
         - unnamedResult
-        - unnecessaryDefer
-        - unslice
         - whyNoLint
       enable-all: true
 

internal/chart/v3/lint/rules/crds_test.go

@@ -45,11 +45,11 @@ func TestCrdWithEmptyDocument(t *testing.T) {
 		`apiVersion: v1
 name: test
 version: 0.1.0
-`), 0644)
+`), 0o644)
 
 	// CRD with comments before --- (creates empty document)
 	crdsDir := filepath.Join(chartDir, "crds")
-	os.Mkdir(crdsDir, 0755)
+	os.Mkdir(crdsDir, 0o755)
 	os.WriteFile(filepath.Join(crdsDir, "test.yaml"), []byte(
 		`# Comments create empty document
 ---
@@ -57,7 +57,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: test.example.io
-`), 0644)
+`), 0o644)
 
 	linter := support.Linter{ChartDir: chartDir}
 	Crds(&linter)

internal/chart/v3/lint/rules/values_test.go

@@ -176,7 +176,7 @@ func TestValidateValuesFile(t *testing.T) {
 func createTestingSchema(t *testing.T, dir string) string {
 	t.Helper()
 	schemafile := filepath.Join(dir, "values.schema.json")
-	if err := os.WriteFile(schemafile, []byte(testSchema), 0700); err != nil {
+	if err := os.WriteFile(schemafile, []byte(testSchema), 0o700); err != nil {
 		t.Fatalf("Failed to write schema to tmpdir: %s", err)
 	}
 	return schemafile

internal/chart/v3/loader/directory.go

@@ -114,7 +114,7 @@ func LoadDir(dir string) (*chart.Chart, error) {
 		files = append(files, &archive.BufferedFile{Name: n, ModTime: fi.ModTime(), Data: data})
 		return nil
 	}
-	if err = sympath.Walk(topdir, walk); err != nil {
+	if err := sympath.Walk(topdir, walk); err != nil {
 		return c, err
 	}
 

internal/chart/v3/loader/load_test.go

@@ -377,7 +377,7 @@ func TestLoadInvalidArchive(t *testing.T) {
 
 		h := &tar.Header{
 			Name:    internalPath,
-			Mode:    0755,
+			Mode:    0o755,
 			Size:    int64(len(body)),
 			ModTime: time.Now(),
 		}

internal/chart/v3/util/chartfile.go

@@ -58,7 +58,7 @@ func SaveChartfile(filename string, cf *chart.Metadata) error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(filename, out, 0644)
+	return os.WriteFile(filename, out, 0o644)
 }
 
 // IsChartDir validate a chart directory.

internal/chart/v3/util/create.go

@@ -803,7 +803,7 @@ func Create(name, dir string) (string, error) {
 		}
 	}
 	// Need to add the ChartsDir explicitly as it does not contain any file OOTB
-	if err := os.MkdirAll(filepath.Join(cdir, ChartsDir), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(cdir, ChartsDir), 0o755); err != nil {
 		return cdir, err
 	}
 	return cdir, nil
@@ -816,10 +816,10 @@ func transform(src, replacement string) []byte {
 }
 
 func writeFile(name string, content []byte) error {
-	if err := os.MkdirAll(filepath.Dir(name), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(name), 0o755); err != nil {
 		return err
 	}
-	return os.WriteFile(name, content, 0644)
+	return os.WriteFile(name, content, 0o644)
 }
 
 func validateChartName(name string) error {

internal/chart/v3/util/expand.go

@@ -88,11 +88,11 @@ func Expand(dir string, r io.Reader) error {
 
 		// Make sure the necessary subdirs get created.
 		basedir := filepath.Dir(outpath)
-		if err := os.MkdirAll(basedir, 0755); err != nil {
+		if err := os.MkdirAll(basedir, 0o755); err != nil {
 			return err
 		}
 
-		if err := os.WriteFile(outpath, file.Data, 0644); err != nil {
+		if err := os.WriteFile(outpath, file.Data, 0o644); err != nil {
 			return err
 		}
 	}

internal/chart/v3/util/save.go

@@ -49,7 +49,7 @@ func SaveDir(c *chart.Chart, dest string) error {
 	if fi, err := os.Stat(outdir); err == nil && !fi.IsDir() {
 		return fmt.Errorf("file %s already exists and is not a directory", outdir)
 	}
-	if err := os.MkdirAll(outdir, 0755); err != nil {
+	if err := os.MkdirAll(outdir, 0o755); err != nil {
 		return err
 	}
 
@@ -115,7 +115,7 @@ func Save(c *chart.Chart, outDir string) (string, error) {
 	dir := filepath.Dir(filename)
 	if stat, err := os.Stat(dir); err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
-			if err2 := os.MkdirAll(dir, 0755); err2 != nil {
+			if err2 := os.MkdirAll(dir, 0o755); err2 != nil {
 				return "", err2
 			}
 		} else {
@@ -230,7 +230,7 @@ func writeToTar(out *tar.Writer, name string, body []byte, modTime time.Time) er
 	// TODO: Do we need to create dummy parent directory names if none exist?
 	h := &tar.Header{
 		Name:    filepath.ToSlash(name),
-		Mode:    0644,
+		Mode:    0o644,
 		Size:    int64(len(body)),
 		ModTime: modTime,
 	}

internal/chart/v3/util/save_test.go

@@ -258,7 +258,7 @@ func TestSaveDir(t *testing.T) {
 	tmp2 := t.TempDir()
 	c.Metadata.Name = "../ahab"
 	pth := filepath.Join(tmp2, "tmpcharts")
-	if err := os.MkdirAll(filepath.Join(pth), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(pth), 0o755); err != nil {
 		t.Fatal(err)
 	}
 

internal/fileutil/fileutil_test.go

@@ -35,7 +35,7 @@ func TestAtomicWriteFile(t *testing.T) {
 	testpath := filepath.Join(dir, "test")
 	stringContent := "Test content"
 	reader := bytes.NewReader([]byte(stringContent))
-	mode := os.FileMode(0644)
+	mode := os.FileMode(0o644)
 
 	err := AtomicWriteFile(testpath, reader, mode)
 	assert.NoError(t, err)
@@ -56,7 +56,7 @@ func TestAtomicWriteFile_CreateTempError(t *testing.T) {
 	invalidPath := "/invalid/path/that/does/not/exist/testfile"
 
 	reader := bytes.NewReader([]byte("test content"))
-	mode := os.FileMode(0644)
+	mode := os.FileMode(0o644)
 
 	err := AtomicWriteFile(invalidPath, reader, mode)
 	assert.Error(t, err, "Expected error when CreateTemp fails")
@@ -68,7 +68,7 @@ func TestAtomicWriteFile_EmptyContent(t *testing.T) {
 	testpath := filepath.Join(dir, "empty_helm")
 
 	reader := bytes.NewReader([]byte(""))
-	mode := os.FileMode(0644)
+	mode := os.FileMode(0o644)
 
 	err := AtomicWriteFile(testpath, reader, mode)
 	assert.NoError(t, err, "AtomicWriteFile error with empty content")
@@ -87,7 +87,7 @@ func TestAtomicWriteFile_LargeContent(t *testing.T) {
 	// Create a large content string
 	largeContent := strings.Repeat("HELM", 1024*1024)
 	reader := bytes.NewReader([]byte(largeContent))
-	mode := os.FileMode(0644)
+	mode := os.FileMode(0o644)
 
 	err := AtomicWriteFile(testpath, reader, mode)
 	assert.NoError(t, err, "AtomicWriteFile error with large content")
@@ -105,10 +105,10 @@ func TestPlatformAtomicWriteFile_OverwritesExisting(t *testing.T) {
 	path := filepath.Join(dir, "overwrite_test")
 
 	first := bytes.NewReader([]byte("first"))
-	require.NoError(t, PlatformAtomicWriteFile(path, first, 0644), "first write failed")
+	require.NoError(t, PlatformAtomicWriteFile(path, first, 0o644), "first write failed")
 
 	second := bytes.NewReader([]byte("second"))
-	require.NoError(t, PlatformAtomicWriteFile(path, second, 0644), "second write failed")
+	require.NoError(t, PlatformAtomicWriteFile(path, second, 0o644), "second write failed")
 
 	contents, err := os.ReadFile(path)
 	require.NoError(t, err, "failed reading result")

internal/plugin/installer/extractor.go

@@ -132,7 +132,7 @@ func (g *TarGzExtractor) Extract(buffer *bytes.Buffer, targetDir string) error {
 		return err
 	}
 
-	if err := os.MkdirAll(targetDir, 0755); err != nil {
+	if err := os.MkdirAll(targetDir, 0o755); err != nil {
 		return err
 	}
 
@@ -153,12 +153,12 @@ func (g *TarGzExtractor) Extract(buffer *bytes.Buffer, targetDir string) error {
 
 		switch header.Typeflag {
 		case tar.TypeDir:
-			if err := os.MkdirAll(path, 0755); err != nil {
+			if err := os.MkdirAll(path, 0o755); err != nil {
 				return err
 			}
 		case tar.TypeReg:
 			// Ensure parent directory exists
-			if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+			if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 				return err
 			}
 			outFile, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, os.FileMode(header.Mode))
@@ -189,6 +189,6 @@ func stripPluginName(name string) string {
 			break
 		}
 	}
-	re := regexp.MustCompile(`(.*)-[0-9]+\..*`)
+	re := regexp.MustCompile(`(.*)-\d+\..*`)
 	return re.ReplaceAllString(strippedName, `$1`)
 }

internal/plugin/installer/http_installer.go

@@ -93,10 +93,10 @@ func (i *HTTPInstaller) Install() error {
 	}
 	filename := fmt.Sprintf("%s-%s.tgz", metadata.Name, metadata.Version)
 	tarballPath := helmpath.DataPath("plugins", filename)
-	if err := os.MkdirAll(filepath.Dir(tarballPath), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(tarballPath), 0o755); err != nil {
 		return fmt.Errorf("failed to create plugins directory: %w", err)
 	}
-	if err := os.WriteFile(tarballPath, i.pluginData, 0644); err != nil {
+	if err := os.WriteFile(tarballPath, i.pluginData, 0o644); err != nil {
 		return fmt.Errorf("failed to save tarball: %w", err)
 	}
 
@@ -112,7 +112,7 @@ func (i *HTTPInstaller) Install() error {
 	// Save prov file if we have the data
 	if i.provData != nil {
 		provPath := tarballPath + ".prov"
-		if err := os.WriteFile(provPath, i.provData, 0644); err != nil {
+		if err := os.WriteFile(provPath, i.provData, 0o644); err != nil {
 			slog.Debug("failed to save provenance file", "error", err)
 		}
 	}

internal/plugin/installer/http_installer_test.go

@@ -85,7 +85,7 @@ func TestHTTPInstaller(t *testing.T) {
 	defer srv.Close()
 	source := srv.URL + "/plugins/fake-plugin-0.0.1.tar.gz"
 
-	if err := os.MkdirAll(helmpath.DataPath("plugins"), 0755); err != nil {
+	if err := os.MkdirAll(helmpath.DataPath("plugins"), 0o755); err != nil {
 		t.Fatalf("Could not create %s: %s", helmpath.DataPath("plugins"), err)
 	}
 
@@ -132,7 +132,7 @@ func TestHTTPInstallerNonExistentVersion(t *testing.T) {
 	defer srv.Close()
 	source := srv.URL + "/plugins/fake-plugin-0.0.1.tar.gz"
 
-	if err := os.MkdirAll(helmpath.DataPath("plugins"), 0755); err != nil {
+	if err := os.MkdirAll(helmpath.DataPath("plugins"), 0o755); err != nil {
 		t.Fatalf("Could not create %s: %s", helmpath.DataPath("plugins"), err)
 	}
 
@@ -164,7 +164,7 @@ func TestHTTPInstallerUpdate(t *testing.T) {
 	source := srv.URL + "/plugins/fake-plugin-0.0.1.tar.gz"
 	ensure.HelmHome(t)
 
-	if err := os.MkdirAll(helmpath.DataPath("plugins"), 0755); err != nil {
+	if err := os.MkdirAll(helmpath.DataPath("plugins"), 0o755); err != nil {
 		t.Fatalf("Could not create %s: %s", helmpath.DataPath("plugins"), err)
 	}
 
@@ -219,8 +219,8 @@ func TestExtract(t *testing.T) {
 		Name, Body string
 		Mode       int64
 	}{
-		{"plugin.yaml", "plugin metadata", 0600},
+		{"plugin.yaml", "plugin metadata", 0o600},
-		{"README.md", "some text", 0777},
+		{"README.md", "some text", 0o777},
 	}
 	for _, file := range files {
 		hdr := &tar.Header{
@@ -271,8 +271,8 @@ func TestExtract(t *testing.T) {
 	}
 
 	// Calculate expected permissions after umask is applied
-	expectedPluginYAMLPerm := os.FileMode(0600 &^ currentUmask)
+	expectedPluginYAMLPerm := os.FileMode(0o600 &^ currentUmask)
-	expectedReadmePerm := os.FileMode(0777 &^ currentUmask)
+	expectedReadmePerm := os.FileMode(0o777 &^ currentUmask)
 
 	pluginYAMLFullPath := filepath.Join(tempDir, "plugin.yaml")
 	if info, err := os.Stat(pluginYAMLFullPath); err != nil {
@@ -361,13 +361,13 @@ func TestExtractWithNestedDirectories(t *testing.T) {
 		Mode     int64
 		TypeFlag byte
 	}{
-		{"plugin.yaml", "plugin metadata", 0600, tar.TypeReg},
+		{"plugin.yaml", "plugin metadata", 0o600, tar.TypeReg},
-		{"bin/", "", 0755, tar.TypeDir},
+		{"bin/", "", 0o755, tar.TypeDir},
-		{"bin/plugin", "#!/usr/bin/env sh\necho plugin", 0755, tar.TypeReg},
+		{"bin/plugin", "#!/usr/bin/env sh\necho plugin", 0o755, tar.TypeReg},
-		{"docs/", "", 0755, tar.TypeDir},
+		{"docs/", "", 0o755, tar.TypeDir},
-		{"docs/README.md", "readme content", 0644, tar.TypeReg},
+		{"docs/README.md", "readme content", 0o644, tar.TypeReg},
-		{"docs/examples/", "", 0755, tar.TypeDir},
+		{"docs/examples/", "", 0o755, tar.TypeDir},
-		{"docs/examples/example1.yaml", "example content", 0644, tar.TypeReg},
+		{"docs/examples/example1.yaml", "example content", 0o644, tar.TypeReg},
 	}
 
 	for _, file := range files {
@@ -434,13 +434,13 @@ func TestExtractWithExistingDirectory(t *testing.T) {
 
 	// Pre-create the cache directory structure
 	cacheDir := filepath.Join(tempDir, "cache")
-	if err := os.MkdirAll(filepath.Join(cacheDir, "existing", "dir"), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(cacheDir, "existing", "dir"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 
 	// Create a file in the existing directory
 	existingFile := filepath.Join(cacheDir, "existing", "file.txt")
-	if err := os.WriteFile(existingFile, []byte("existing content"), 0644); err != nil {
+	if err := os.WriteFile(existingFile, []byte("existing content"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -453,10 +453,10 @@ func TestExtractWithExistingDirectory(t *testing.T) {
 		Mode     int64
 		TypeFlag byte
 	}{
-		{"plugin.yaml", "plugin metadata", 0600, tar.TypeReg},
+		{"plugin.yaml", "plugin metadata", 0o600, tar.TypeReg},
-		{"existing/", "", 0755, tar.TypeDir},
+		{"existing/", "", 0o755, tar.TypeDir},
-		{"existing/dir/", "", 0755, tar.TypeDir},
+		{"existing/dir/", "", 0o755, tar.TypeDir},
-		{"existing/dir/newfile.txt", "new content", 0644, tar.TypeReg},
+		{"existing/dir/newfile.txt", "new content", 0o644, tar.TypeReg},
 	}
 
 	for _, file := range files {
@@ -523,10 +523,10 @@ func TestExtractPluginInSubdirectory(t *testing.T) {
 		Mode     int64
 		TypeFlag byte
 	}{
-		{"my-plugin/", "", 0755, tar.TypeDir},
+		{"my-plugin/", "", 0o755, tar.TypeDir},
-		{"my-plugin/plugin.yaml", "name: my-plugin\nversion: 1.0.0\nusage: test\ndescription: test plugin\ncommand: $HELM_PLUGIN_DIR/bin/my-plugin", 0644, tar.TypeReg},
+		{"my-plugin/plugin.yaml", "name: my-plugin\nversion: 1.0.0\nusage: test\ndescription: test plugin\ncommand: $HELM_PLUGIN_DIR/bin/my-plugin", 0o644, tar.TypeReg},
-		{"my-plugin/bin/", "", 0755, tar.TypeDir},
+		{"my-plugin/bin/", "", 0o755, tar.TypeDir},
-		{"my-plugin/bin/my-plugin", "#!/usr/bin/env sh\necho test", 0755, tar.TypeReg},
+		{"my-plugin/bin/my-plugin", "#!/usr/bin/env sh\necho test", 0o755, tar.TypeReg},
 	}
 
 	for _, file := range files {

internal/plugin/installer/installer.go

@@ -73,7 +73,7 @@ type VerificationResult struct {
 
 // InstallWithOptions installs a plugin with options.
 func InstallWithOptions(i Installer, opts Options) (*VerificationResult, error) {
-	if err := os.MkdirAll(filepath.Dir(i.Path()), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(i.Path()), 0o755); err != nil {
 		return nil, err
 	}
 	if _, pathErr := os.Stat(i.Path()); !os.IsNotExist(pathErr) {

internal/plugin/installer/local_installer.go

@@ -117,10 +117,10 @@ func (i *LocalInstaller) installFromArchive() error {
 	}
 	filename := fmt.Sprintf("%s-%s.tgz", metadata.Name, metadata.Version)
 	tarballPath := helmpath.DataPath("plugins", filename)
-	if err := os.MkdirAll(filepath.Dir(tarballPath), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(tarballPath), 0o755); err != nil {
 		return fmt.Errorf("failed to create plugins directory: %w", err)
 	}
-	if err := os.WriteFile(tarballPath, data, 0644); err != nil {
+	if err := os.WriteFile(tarballPath, data, 0o644); err != nil {
 		return fmt.Errorf("failed to save tarball: %w", err)
 	}
 
@@ -128,7 +128,7 @@ func (i *LocalInstaller) installFromArchive() error {
 	provSource := i.Source + ".prov"
 	if provData, err := os.ReadFile(provSource); err == nil {
 		provPath := tarballPath + ".prov"
-		if err := os.WriteFile(provPath, provData, 0644); err != nil {
+		if err := os.WriteFile(provPath, provData, 0o644); err != nil {
 			slog.Debug("failed to save provenance file", "error", err)
 		}
 	}

internal/plugin/installer/local_installer_test.go

@@ -34,7 +34,7 @@ func TestLocalInstaller(t *testing.T) {
 	ensure.HelmHome(t)
 	// Make a temp dir
 	tdir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(tdir, "plugin.yaml"), []byte{}, 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(tdir, "plugin.yaml"), []byte{}, 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -51,7 +51,7 @@ func TestLocalInstaller(t *testing.T) {
 	if i.Path() != helmpath.DataPath("plugins", "echo-v1") {
 		t.Fatalf("expected path '$XDG_CONFIG_HOME/helm/plugins/helm-env', got %q", i.Path())
 	}
-	defer os.RemoveAll(filepath.Dir(helmpath.DataPath())) // helmpath.DataPath is like /tmp/helm013130971/helm
+	os.RemoveAll(filepath.Dir(helmpath.DataPath())) // helmpath.DataPath is like /tmp/helm013130971/helm
 }
 
 func TestLocalInstallerNotAFolder(t *testing.T) {
@@ -87,8 +87,8 @@ func TestLocalInstallerTarball(t *testing.T) {
 		Body string
 		Mode int64
 	}{
-		{"test-plugin/plugin.yaml", "name: test-plugin\napiVersion: v1\ntype: cli/v1\nruntime: subprocess\nversion: 1.0.0\nconfig:\n  shortHelp: test\n  longHelp: test\nruntimeConfig:\n  platformCommand:\n  - command: echo", 0644},
+		{"test-plugin/plugin.yaml", "name: test-plugin\napiVersion: v1\ntype: cli/v1\nruntime: subprocess\nversion: 1.0.0\nconfig:\n  shortHelp: test\n  longHelp: test\nruntimeConfig:\n  platformCommand:\n  - command: echo", 0o644},
-		{"test-plugin/bin/test-plugin", "#!/usr/bin/env sh\necho test", 0755},
+		{"test-plugin/bin/test-plugin", "#!/usr/bin/env sh\necho test", 0o755},
 	}
 
 	for _, file := range files {
@@ -113,7 +113,7 @@ func TestLocalInstallerTarball(t *testing.T) {
 	}
 
 	// Write tarball to file
-	if err := os.WriteFile(tarballPath, buf.Bytes(), 0644); err != nil {
+	if err := os.WriteFile(tarballPath, buf.Bytes(), 0o644); err != nil {
 		t.Fatal(err)
 	}
 

internal/plugin/installer/oci_installer.go

@@ -104,10 +104,10 @@ func (i *OCIInstaller) Install() error {
 	filename := fmt.Sprintf("%s-%s.tgz", metadata.Name, metadata.Version)
 
 	tarballPath := helmpath.DataPath("plugins", filename)
-	if err := os.MkdirAll(filepath.Dir(tarballPath), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(tarballPath), 0o755); err != nil {
 		return fmt.Errorf("failed to create plugins directory: %w", err)
 	}
-	if err := os.WriteFile(tarballPath, i.pluginData, 0644); err != nil {
+	if err := os.WriteFile(tarballPath, i.pluginData, 0o644); err != nil {
 		return fmt.Errorf("failed to save tarball: %w", err)
 	}
 
@@ -123,7 +123,7 @@ func (i *OCIInstaller) Install() error {
 	// Save prov file if we have the data
 	if i.provData != nil {
 		provPath := tarballPath + ".prov"
-		if err := os.WriteFile(provPath, i.provData, 0644); err != nil {
+		if err := os.WriteFile(provPath, i.provData, 0o644); err != nil {
 			slog.Debug("failed to save provenance file", "error", err)
 		}
 	}
@@ -134,7 +134,7 @@ func (i *OCIInstaller) Install() error {
 	}
 
 	// Create cache directory
-	if err := os.MkdirAll(i.CacheDir, 0755); err != nil {
+	if err := os.MkdirAll(i.CacheDir, 0o755); err != nil {
 		return fmt.Errorf("failed to create cache directory: %w", err)
 	}
 
@@ -229,12 +229,12 @@ func extractTar(r io.Reader, targetDir string) error {
 
 		switch header.Typeflag {
 		case tar.TypeDir:
-			if err := os.MkdirAll(path, 0755); err != nil {
+			if err := os.MkdirAll(path, 0o755); err != nil {
 				return err
 			}
 		case tar.TypeReg:
 			dir := filepath.Dir(path)
-			if err := os.MkdirAll(dir, 0755); err != nil {
+			if err := os.MkdirAll(dir, 0o755); err != nil {
 				return err
 			}
 

internal/plugin/installer/oci_installer_test.go

@@ -58,7 +58,7 @@ command: "$HELM_PLUGIN_DIR/bin/%s"
 `, pluginName, pluginName)
 	header := &tar.Header{
 		Name:     "plugin.yaml",
-		Mode:     0644,
+		Mode:     0o644,
 		Size:     int64(len(pluginYAML)),
 		Typeflag: tar.TypeReg,
 	}
@@ -72,7 +72,7 @@ command: "$HELM_PLUGIN_DIR/bin/%s"
 	// Add bin directory
 	dirHeader := &tar.Header{
 		Name:     "bin/",
-		Mode:     0755,
+		Mode:     0o755,
 		Typeflag: tar.TypeDir,
 	}
 	if err := tarWriter.WriteHeader(dirHeader); err != nil {
@@ -83,7 +83,7 @@ command: "$HELM_PLUGIN_DIR/bin/%s"
 	execContent := fmt.Sprintf("#!/bin/sh\necho '%s test plugin'", pluginName)
 	execHeader := &tar.Header{
 		Name:     "bin/" + pluginName,
-		Mode:     0755,
+		Mode:     0o755,
 		Size:     int64(len(execContent)),
 		Typeflag: tar.TypeReg,
 	}
@@ -539,7 +539,7 @@ func TestOCIInstaller_Install_ComponentExtraction(t *testing.T) {
 	execPath := filepath.Join(tempDir, "bin", pluginName)
 	if info, err := os.Stat(execPath); err != nil {
 		t.Errorf("executable not found: %v", err)
-	} else if info.Mode()&0111 == 0 {
+	} else if info.Mode()&0o111 == 0 {
 		t.Error("file is not executable")
 	}
 
@@ -561,7 +561,7 @@ func TestExtractTarGz(t *testing.T) {
 	testContent := "test content"
 	header := &tar.Header{
 		Name:     "test-file.txt",
-		Mode:     0644,
+		Mode:     0o644,
 		Size:     int64(len(testContent)),
 		Typeflag: tar.TypeReg,
 	}
@@ -577,7 +577,7 @@ func TestExtractTarGz(t *testing.T) {
 	// Add a test directory
 	dirHeader := &tar.Header{
 		Name:     "test-dir/",
-		Mode:     0755,
+		Mode:     0o755,
 		Typeflag: tar.TypeDir,
 	}
 
@@ -634,7 +634,7 @@ func TestExtractTar_UnknownFileType(t *testing.T) {
 	testContent := "test content"
 	header := &tar.Header{
 		Name:     "test-file.txt",
-		Mode:     0644,
+		Mode:     0o644,
 		Size:     int64(len(testContent)),
 		Typeflag: tar.TypeReg,
 	}
@@ -650,7 +650,7 @@ func TestExtractTar_UnknownFileType(t *testing.T) {
 	// Test unknown file type
 	unknownHeader := &tar.Header{
 		Name:     "unknown-type",
-		Mode:     0644,
+		Mode:     0o644,
 		Typeflag: tar.TypeSymlink, // Use a type that's not handled
 	}
 
@@ -686,7 +686,7 @@ func TestExtractTar_SuccessfulExtraction(t *testing.T) {
 	testContent := "test content"
 	header := &tar.Header{
 		Name:     "test-file.txt",
-		Mode:     0644,
+		Mode:     0o644,
 		Size:     int64(len(testContent)),
 		Typeflag: tar.TypeReg,
 	}

internal/plugin/installer/plugin_structure_test.go

@@ -31,7 +31,7 @@ func TestDetectPluginRoot(t *testing.T) {
 		{
 			name: "plugin.yaml at root",
 			setup: func(dir string) error {
-				return os.WriteFile(filepath.Join(dir, "plugin.yaml"), []byte("name: test"), 0644)
+				return os.WriteFile(filepath.Join(dir, "plugin.yaml"), []byte("name: test"), 0o644)
 			},
 			expectRoot:  ".",
 			expectError: false,
@@ -40,10 +40,10 @@ func TestDetectPluginRoot(t *testing.T) {
 			name: "plugin.yaml in subdirectory",
 			setup: func(dir string) error {
 				subdir := filepath.Join(dir, "my-plugin")
-				if err := os.MkdirAll(subdir, 0755); err != nil {
+				if err := os.MkdirAll(subdir, 0o755); err != nil {
 					return err
 				}
-				return os.WriteFile(filepath.Join(subdir, "plugin.yaml"), []byte("name: test"), 0644)
+				return os.WriteFile(filepath.Join(subdir, "plugin.yaml"), []byte("name: test"), 0o644)
 			},
 			expectRoot:  "my-plugin",
 			expectError: false,
@@ -51,7 +51,7 @@ func TestDetectPluginRoot(t *testing.T) {
 		{
 			name: "no plugin.yaml",
 			setup: func(dir string) error {
-				return os.WriteFile(filepath.Join(dir, "README.md"), []byte("test"), 0644)
+				return os.WriteFile(filepath.Join(dir, "README.md"), []byte("test"), 0o644)
 			},
 			expectRoot:  "",
 			expectError: true,
@@ -60,10 +60,10 @@ func TestDetectPluginRoot(t *testing.T) {
 			name: "plugin.yaml in nested subdirectory (should not find)",
 			setup: func(dir string) error {
 				subdir := filepath.Join(dir, "outer", "inner")
-				if err := os.MkdirAll(subdir, 0755); err != nil {
+				if err := os.MkdirAll(subdir, 0o755); err != nil {
 					return err
 				}
-				return os.WriteFile(filepath.Join(subdir, "plugin.yaml"), []byte("name: test"), 0644)
+				return os.WriteFile(filepath.Join(subdir, "plugin.yaml"), []byte("name: test"), 0o644)
 			},
 			expectRoot:  "",
 			expectError: true,
@@ -110,14 +110,14 @@ func TestValidatePluginName(t *testing.T) {
 			name: "matching directory and plugin name",
 			setup: func(dir string) error {
 				subdir := filepath.Join(dir, "my-plugin")
-				if err := os.MkdirAll(subdir, 0755); err != nil {
+				if err := os.MkdirAll(subdir, 0o755); err != nil {
 					return err
 				}
 				yaml := `name: my-plugin
 version: 1.0.0
 usage: test
 description: test`
-				return os.WriteFile(filepath.Join(subdir, "plugin.yaml"), []byte(yaml), 0644)
+				return os.WriteFile(filepath.Join(subdir, "plugin.yaml"), []byte(yaml), 0o644)
 			},
 			pluginRoot:   "my-plugin",
 			expectedName: "my-plugin",
@@ -127,14 +127,14 @@ description: test`
 			name: "different directory and plugin name",
 			setup: func(dir string) error {
 				subdir := filepath.Join(dir, "wrong-name")
-				if err := os.MkdirAll(subdir, 0755); err != nil {
+				if err := os.MkdirAll(subdir, 0o755); err != nil {
 					return err
 				}
 				yaml := `name: my-plugin
 version: 1.0.0
 usage: test
 description: test`
-				return os.WriteFile(filepath.Join(subdir, "plugin.yaml"), []byte(yaml), 0644)
+				return os.WriteFile(filepath.Join(subdir, "plugin.yaml"), []byte(yaml), 0o644)
 			},
 			pluginRoot:   "wrong-name",
 			expectedName: "wrong-name",

internal/plugin/installer/vcs_installer_test.go

@@ -52,7 +52,7 @@ func (r *testRepo) UpdateVersion(version string) error {
 func TestVCSInstaller(t *testing.T) {
 	ensure.HelmHome(t)
 
-	if err := os.MkdirAll(helmpath.DataPath("plugins"), 0755); err != nil {
+	if err := os.MkdirAll(helmpath.DataPath("plugins"), 0o755); err != nil {
 		t.Fatalf("Could not create %s: %s", helmpath.DataPath("plugins"), err)
 	}
 

internal/plugin/installer/verification_test.go

@@ -291,7 +291,7 @@ func TestInstallWithOptions_VerifyProvenanceAccessError(t *testing.T) {
 
 	// Create a .prov file but make it inaccessible (simulate permission error)
 	provFile := pluginTgz + ".prov"
-	if err := os.WriteFile(provFile, []byte("test"), 0000); err != nil {
+	if err := os.WriteFile(provFile, []byte("test"), 0o000); err != nil {
 		t.Fatalf("Failed to create inaccessible provenance file: %v", err)
 	}
 	defer os.Remove(provFile)
@@ -333,7 +333,7 @@ func createTestPluginDir(t *testing.T) string {
 	// Create temporary directory with plugin structure
 	tmpDir := t.TempDir()
 	pluginDir := filepath.Join(tmpDir, "test-plugin")
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatalf("Failed to create plugin directory: %v", err)
 	}
 
@@ -346,7 +346,7 @@ version: 1.0.0
 runtimeConfig:
   platformCommand:
     - command: echo`
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(pluginYaml), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(pluginYaml), 0o644); err != nil {
 		t.Fatalf("Failed to create plugin.yaml: %v", err)
 	}
 
@@ -404,7 +404,7 @@ Version: GnuPG v1
 iQEcBAEBCAAGBQJktest...
 -----END PGP SIGNATURE-----
 `, hashStr)
-	if err := os.WriteFile(provFile, []byte(provContent), 0644); err != nil {
+	if err := os.WriteFile(provFile, []byte(provContent), 0o644); err != nil {
 		t.Fatalf("Failed to create provenance file: %v", err)
 	}
 }
@@ -414,7 +414,7 @@ func createProvFileInvalidFormat(t *testing.T, provFile string) {
 
 	// Create an invalid provenance file (not PGP signed format)
 	invalidProv := "This is not a valid PGP signed message"
-	if err := os.WriteFile(provFile, []byte(invalidProv), 0644); err != nil {
+	if err := os.WriteFile(provFile, []byte(invalidProv), 0o644); err != nil {
 		t.Fatalf("Failed to create invalid provenance file: %v", err)
 	}
 }
@@ -427,7 +427,7 @@ func createTestKeyring(t *testing.T) string {
 	keyringPath := filepath.Join(tmpDir, "pubring.gpg")
 
 	// Create empty keyring for testing
-	if err := os.WriteFile(keyringPath, []byte{}, 0644); err != nil {
+	if err := os.WriteFile(keyringPath, []byte{}, 0o644); err != nil {
 		t.Fatalf("Failed to create test keyring: %v", err)
 	}
 

internal/plugin/sign_test.go

@@ -28,7 +28,7 @@ func TestSignPlugin(t *testing.T) {
 	// Create a test plugin directory
 	tempDir := t.TempDir()
 	pluginDir := filepath.Join(tempDir, "test-plugin")
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -41,7 +41,7 @@ version: 1.0.0
 runtimeConfig:
   platformCommand:
     - command: echo`
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(pluginYAML), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(pluginYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
 

internal/plugin/verify_test.go

@@ -41,11 +41,11 @@ func TestVerifyPlugin(t *testing.T) {
 
 	// Create plugin directory
 	pluginDir := filepath.Join(tempDir, "verify-test-plugin")
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -86,7 +86,7 @@ func TestVerifyPlugin(t *testing.T) {
 
 	// Write the signature to .prov file
 	provFile := tarballPath + ".prov"
-	if err := os.WriteFile(provFile, []byte(sig), 0644); err != nil {
+	if err := os.WriteFile(provFile, []byte(sig), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -126,11 +126,11 @@ func TestVerifyPluginBadSignature(t *testing.T) {
 
 	// Create a plugin tarball
 	pluginDir := filepath.Join(tempDir, "bad-plugin")
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -158,7 +158,7 @@ InvalidSignatureData
 -----END PGP SIGNATURE-----`
 
 	provFile := tarballPath + ".prov"
-	if err := os.WriteFile(provFile, []byte(badSig), 0644); err != nil {
+	if err := os.WriteFile(provFile, []byte(badSig), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -185,7 +185,7 @@ func TestVerifyPluginMissingProvenance(t *testing.T) {
 	tarballPath := filepath.Join(tempDir, "no-prov.tar.gz")
 
 	// Create a minimal tarball
-	if err := os.WriteFile(tarballPath, []byte("dummy"), 0644); err != nil {
+	if err := os.WriteFile(tarballPath, []byte("dummy"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 

internal/sympath/walk_test.go

@@ -90,7 +90,7 @@ func makeTree(t *testing.T) {
 				fd.Close()
 			}
 		} else {
-			require.NoError(t, os.Mkdir(path, 0770), "makeTree")
+			require.NoError(t, os.Mkdir(path, 0o770), "makeTree")
 		}
 	})
 }

internal/test/test.go

@@ -87,7 +87,7 @@ func update(filename string, in []byte) error {
 	if !*updateGolden {
 		return nil
 	}
-	return os.WriteFile(filename, normalize(in), 0666)
+	return os.WriteFile(filename, normalize(in), 0o666)
 }
 
 func normalize(in []byte) []byte {

internal/third_party/dep/fs/fs.go

@@ -193,7 +193,7 @@ func CopyFile(src, dst string) (err error) {
 	}
 
 	// Check for write errors on Close
-	if err = out.Close(); err != nil {
+	if err := out.Close(); err != nil {
 		return err
 	}
 

internal/third_party/dep/fs/fs_test.go

@@ -59,12 +59,12 @@ func TestRenameWithFallback(t *testing.T) {
 	}
 
 	srcpath = filepath.Join(dir, "a")
-	if err := os.MkdirAll(srcpath, 0777); err != nil {
+	if err := os.MkdirAll(srcpath, 0o777); err != nil {
 		t.Fatal(err)
 	}
 
 	dstpath := filepath.Join(dir, "b")
-	if err := os.MkdirAll(dstpath, 0777); err != nil {
+	if err := os.MkdirAll(dstpath, 0o777); err != nil {
 		t.Fatal(err)
 	}
 
@@ -77,7 +77,7 @@ func TestCopyDir(t *testing.T) {
 	dir := t.TempDir()
 
 	srcdir := filepath.Join(dir, "src")
-	if err := os.MkdirAll(srcdir, 0755); err != nil {
+	if err := os.MkdirAll(srcdir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -94,7 +94,7 @@ func TestCopyDir(t *testing.T) {
 	for i, file := range files {
 		fn := filepath.Join(srcdir, file.path)
 		dn := filepath.Dir(fn)
-		if err := os.MkdirAll(dn, 0755); err != nil {
+		if err := os.MkdirAll(dn, 0o755); err != nil {
 			t.Fatal(err)
 		}
 
@@ -103,7 +103,7 @@ func TestCopyDir(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		if _, err = fh.Write([]byte(file.contents)); err != nil {
+		if _, err = fh.WriteString(file.contents); err != nil {
 			t.Fatal(err)
 		}
 		fh.Close()
@@ -171,7 +171,7 @@ func TestCopyDirFail_SrcInaccessible(t *testing.T) {
 
 	cleanup := setupInaccessibleDir(t, func(dir string) error {
 		srcdir = filepath.Join(dir, "src")
-		return os.MkdirAll(srcdir, 0755)
+		return os.MkdirAll(srcdir, 0o755)
 	})
 	defer cleanup()
 
@@ -203,7 +203,7 @@ func TestCopyDirFail_DstInaccessible(t *testing.T) {
 	dir := t.TempDir()
 
 	srcdir = filepath.Join(dir, "src")
-	if err := os.MkdirAll(srcdir, 0755); err != nil {
+	if err := os.MkdirAll(srcdir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -247,12 +247,12 @@ func TestCopyDirFail_DstExists(t *testing.T) {
 	dir := t.TempDir()
 
 	srcdir = filepath.Join(dir, "src")
-	if err = os.MkdirAll(srcdir, 0755); err != nil {
+	if err = os.MkdirAll(srcdir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
 	dstdir = filepath.Join(dir, "dst")
-	if err = os.MkdirAll(dstdir, 0755); err != nil {
+	if err = os.MkdirAll(dstdir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -288,7 +288,7 @@ func TestCopyDirFailOpen(t *testing.T) {
 	dir := t.TempDir()
 
 	srcdir = filepath.Join(dir, "src")
-	if err := os.MkdirAll(srcdir, 0755); err != nil {
+	if err := os.MkdirAll(srcdir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -300,7 +300,7 @@ func TestCopyDirFailOpen(t *testing.T) {
 	srcf.Close()
 
 	// setup source file so that it cannot be read
-	if err = os.Chmod(srcfn, 0222); err != nil {
+	if err = os.Chmod(srcfn, 0o222); err != nil {
 		t.Fatal(err)
 	}
 
@@ -320,7 +320,7 @@ func TestCopyFile(t *testing.T) {
 	}
 
 	want := "hello world"
-	if _, err := srcf.Write([]byte(want)); err != nil {
+	if _, err := srcf.WriteString(want); err != nil {
 		t.Fatal(err)
 	}
 	srcf.Close()
@@ -433,7 +433,7 @@ func TestCopyFileFail(t *testing.T) {
 
 	cleanup := setupInaccessibleDir(t, func(dir string) error {
 		dstdir = filepath.Join(dir, "dir")
-		return os.Mkdir(dstdir, 0777)
+		return os.Mkdir(dstdir, 0o777)
 	})
 	defer cleanup()
 
@@ -463,12 +463,12 @@ func setupInaccessibleDir(t *testing.T, op func(dir string) error) func() {
 	subdir := filepath.Join(dir, "dir")
 
 	cleanup := func() {
-		if err := os.Chmod(subdir, 0777); err != nil {
+		if err := os.Chmod(subdir, 0o777); err != nil {
 			t.Error(err)
 		}
 	}
 
-	if err := os.Mkdir(subdir, 0777); err != nil {
+	if err := os.Mkdir(subdir, 0o777); err != nil {
 		cleanup()
 		t.Fatal(err)
 		return nil
@@ -480,7 +480,7 @@ func setupInaccessibleDir(t *testing.T, op func(dir string) error) func() {
 		return nil
 	}
 
-	if err := os.Chmod(subdir, 0666); err != nil {
+	if err := os.Chmod(subdir, 0o666); err != nil {
 		cleanup()
 		t.Fatal(err)
 		return nil
@@ -506,7 +506,7 @@ func TestIsDir(t *testing.T) {
 
 	cleanup := setupInaccessibleDir(t, func(dir string) error {
 		dn = filepath.Join(dir, "dir")
-		return os.Mkdir(dn, 0777)
+		return os.Mkdir(dn, 0o777)
 	})
 	defer cleanup()
 
@@ -552,7 +552,7 @@ func TestIsSymlink(t *testing.T) {
 	dir := t.TempDir()
 
 	dirPath := filepath.Join(dir, "directory")
-	if err := os.MkdirAll(dirPath, 0777); err != nil {
+	if err := os.MkdirAll(dirPath, 0o777); err != nil {
 		t.Fatal(err)
 	}
 
@@ -582,7 +582,7 @@ func TestIsSymlink(t *testing.T) {
 		inaccessibleFile = filepath.Join(dir, "file")
 		if fh, err := os.Create(inaccessibleFile); err != nil {
 			return err
-		} else if err = fh.Close(); err != nil {
+		} else if err := fh.Close(); err != nil {
 			return err
 		}
 

pkg/action/action.go

@@ -484,9 +484,9 @@ func (cfg *Configuration) renderResources(ctx context.Context, ch *chart.Chart,
 	if includeCrds {
 		for _, crd := range ch.CRDObjects() {
 			if outputDir == "" {
-				fmt.Fprintf(b, "---\n# Source: %s\n%s\n", crd.Filename, string(crd.File.Data[:]))
+				fmt.Fprintf(b, "---\n# Source: %s\n%s\n", crd.Filename, string(crd.File.Data))
 			} else {
-				err = writeToFile(outputDir, crd.Filename, string(crd.File.Data[:]), fileWritten[crd.Filename])
+				err = writeToFile(outputDir, crd.Filename, string(crd.File.Data), fileWritten[crd.Filename])
 				if err != nil {
 					return hs, b, "", err
 				}

pkg/action/dependency_test.go

@@ -70,7 +70,7 @@ func TestDependencyStatus_Dashes(t *testing.T) {
 	dir := t.TempDir()
 
 	chartpath := filepath.Join(dir, "charts")
-	if err := os.MkdirAll(chartpath, 0700); err != nil {
+	if err := os.MkdirAll(chartpath, 0o700); err != nil {
 		t.Fatal(err)
 	}
 
@@ -104,7 +104,7 @@ func TestStatArchiveForStatus(t *testing.T) {
 	dir := t.TempDir()
 
 	chartpath := filepath.Join(dir, "charts")
-	if err := os.MkdirAll(chartpath, 0700); err != nil {
+	if err := os.MkdirAll(chartpath, 0o700); err != nil {
 		t.Fatal(err)
 	}
 

pkg/action/install.go

@@ -68,7 +68,7 @@ import (
 // since there can be filepath in front of it.
 const notesFileSuffix = "NOTES.txt"
 
-const defaultDirectoryPermission = 0755
+const defaultDirectoryPermission = 0o755
 
 // Install performs an installation operation.
 type Install struct {
@@ -718,7 +718,7 @@ func (i *Install) replaceRelease(rel *release.Release) error {
 
 // write the <data> to <output-dir>/<name>. <appendData> controls if the file is created or content will be appended
 func writeToFile(outputDir string, name string, data string, appendData bool) error {
-	outfileName := strings.Join([]string{outputDir, name}, string(filepath.Separator))
+	outfileName := outputDir + string(filepath.Separator) + name
 
 	err := ensureDirectoryForFile(outfileName)
 	if err != nil {
@@ -744,7 +744,7 @@ func writeToFile(outputDir string, name string, data string, appendData bool) er
 
 func createOrOpenFile(filename string, appendData bool) (*os.File, error) {
 	if appendData {
-		return os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0600)
+		return os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0o600)
 	}
 	return os.Create(filename)
 }
@@ -976,7 +976,7 @@ func (c *ChartPathOptions) LocateChart(name string, settings *cli.EnvSettings) (
 		dl.Options = append(dl.Options, getter.WithBasicAuth(c.Username, c.Password))
 	}
 
-	if err := os.MkdirAll(settings.RepositoryCache, 0755); err != nil {
+	if err := os.MkdirAll(settings.RepositoryCache, 0o755); err != nil {
 		return "", err
 	}
 

pkg/action/package.go

@@ -194,7 +194,7 @@ func (p *Package) Clearsign(filename string) error {
 		return err
 	}
 
-	return os.WriteFile(filename+".prov", []byte(sig), 0644)
+	return os.WriteFile(filename+".prov", []byte(sig), 0o644)
 }
 
 // promptUser implements provenance.PassphraseFetcher

pkg/action/package_test.go

@@ -92,7 +92,7 @@ func TestPassphraseFileFetcher_WithStdinAndMultipleFetches(t *testing.T) {
 	passphrase := "secret-from-stdin"
 
 	go func() {
-		_, err = w.Write([]byte(passphrase + "\n"))
+		_, err = w.WriteString(passphrase + "\n")
 		require.NoError(t, err)
 	}()
 

pkg/action/pull.go

@@ -162,7 +162,7 @@ func (p *Pull) Run(chartRef string) (string, error) {
 		}
 
 		if _, err := os.Stat(udCheck); err != nil {
-			if err := os.MkdirAll(udCheck, 0755); err != nil {
+			if err := os.MkdirAll(udCheck, 0o755); err != nil {
 				return out.String(), fmt.Errorf("failed to untar (mkdir): %w", err)
 			}
 		} else {

pkg/chart/loader/load_test.go

@@ -55,7 +55,7 @@ description: A test chart
 	for name, data := range files {
 		header := &tar.Header{
 			Name:    filepath.Join(chartName, name),
-			Mode:    0644,
+			Mode:    0o644,
 			Size:    int64(len(data)),
 			ModTime: time.Now(),
 		}

pkg/chart/v2/lint/rules/crds_test.go

@@ -45,11 +45,11 @@ func TestCrdWithEmptyDocument(t *testing.T) {
 		`apiVersion: v1
 name: test
 version: 0.1.0
-`), 0644)
+`), 0o644)
 
 	// CRD with comments before --- (creates empty document)
 	crdsDir := filepath.Join(chartDir, "crds")
-	os.Mkdir(crdsDir, 0755)
+	os.Mkdir(crdsDir, 0o755)
 	os.WriteFile(filepath.Join(crdsDir, "test.yaml"), []byte(
 		`# Comments create empty document
 ---
@@ -57,7 +57,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: test.example.io
-`), 0644)
+`), 0o644)
 
 	linter := support.Linter{ChartDir: chartDir}
 	Crds(&linter)

pkg/chart/v2/lint/rules/values_test.go

@@ -176,7 +176,7 @@ func TestValidateValuesFile(t *testing.T) {
 func createTestingSchema(t *testing.T, dir string) string {
 	t.Helper()
 	schemafile := filepath.Join(dir, "values.schema.json")
-	if err := os.WriteFile(schemafile, []byte(testSchema), 0700); err != nil {
+	if err := os.WriteFile(schemafile, []byte(testSchema), 0o700); err != nil {
 		t.Fatalf("Failed to write schema to tmpdir: %s", err)
 	}
 	return schemafile

pkg/chart/v2/loader/directory.go

@@ -114,7 +114,7 @@ func LoadDir(dir string) (*chart.Chart, error) {
 		files = append(files, &archive.BufferedFile{Name: n, ModTime: fi.ModTime(), Data: data})
 		return nil
 	}
-	if err = sympath.Walk(topdir, walk); err != nil {
+	if err := sympath.Walk(topdir, walk); err != nil {
 		return c, err
 	}
 

pkg/chart/v2/loader/load_test.go

@@ -430,7 +430,7 @@ func TestLoadInvalidArchive(t *testing.T) {
 
 		h := &tar.Header{
 			Name:    internalPath,
-			Mode:    0755,
+			Mode:    0o755,
 			Size:    int64(len(body)),
 			ModTime: time.Now(),
 		}

pkg/chart/v2/util/chartfile.go

@@ -67,7 +67,7 @@ func SaveChartfile(filename string, cf *chart.Metadata) error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(filename, out, 0644)
+	return os.WriteFile(filename, out, 0o644)
 }
 
 // IsChartDir validate a chart directory.

pkg/chart/v2/util/create.go

@@ -802,7 +802,7 @@ func Create(name, dir string) (string, error) {
 		}
 	}
 	// Need to add the ChartsDir explicitly as it does not contain any file OOTB
-	if err := os.MkdirAll(filepath.Join(cdir, ChartsDir), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(cdir, ChartsDir), 0o755); err != nil {
 		return cdir, err
 	}
 	return cdir, nil
@@ -815,10 +815,10 @@ func transform(src, replacement string) []byte {
 }
 
 func writeFile(name string, content []byte) error {
-	if err := os.MkdirAll(filepath.Dir(name), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(name), 0o755); err != nil {
 		return err
 	}
-	return os.WriteFile(name, content, 0644)
+	return os.WriteFile(name, content, 0o644)
 }
 
 func validateChartName(name string) error {

pkg/chart/v2/util/expand.go

@@ -88,11 +88,11 @@ func Expand(dir string, r io.Reader) error {
 
 		// Make sure the necessary subdirs get created.
 		basedir := filepath.Dir(outpath)
-		if err := os.MkdirAll(basedir, 0755); err != nil {
+		if err := os.MkdirAll(basedir, 0o755); err != nil {
 			return err
 		}
 
-		if err := os.WriteFile(outpath, file.Data, 0644); err != nil {
+		if err := os.WriteFile(outpath, file.Data, 0o644); err != nil {
 			return err
 		}
 	}

pkg/chart/v2/util/save.go

@@ -49,7 +49,7 @@ func SaveDir(c *chart.Chart, dest string) error {
 	if fi, err := os.Stat(outdir); err == nil && !fi.IsDir() {
 		return fmt.Errorf("file %s already exists and is not a directory", outdir)
 	}
-	if err := os.MkdirAll(outdir, 0755); err != nil {
+	if err := os.MkdirAll(outdir, 0o755); err != nil {
 		return err
 	}
 
@@ -115,7 +115,7 @@ func Save(c *chart.Chart, outDir string) (string, error) {
 	dir := filepath.Dir(filename)
 	if stat, err := os.Stat(dir); err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
-			if err2 := os.MkdirAll(dir, 0755); err2 != nil {
+			if err2 := os.MkdirAll(dir, 0o755); err2 != nil {
 				return "", err2
 			}
 		} else {
@@ -242,7 +242,7 @@ func writeToTar(out *tar.Writer, name string, body []byte, modTime time.Time) er
 	// TODO: Do we need to create dummy parent directory names if none exist?
 	h := &tar.Header{
 		Name:    filepath.ToSlash(name),
-		Mode:    0644,
+		Mode:    0o644,
 		Size:    int64(len(body)),
 		ModTime: modTime,
 	}

pkg/chart/v2/util/save_test.go

@@ -262,7 +262,7 @@ func TestSaveDir(t *testing.T) {
 	tmp2 := t.TempDir()
 	c.Metadata.Name = "../ahab"
 	pth := filepath.Join(tmp2, "tmpcharts")
-	if err := os.MkdirAll(filepath.Join(pth), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(pth), 0o755); err != nil {
 		t.Fatal(err)
 	}
 

pkg/cli/values/options_test.go

@@ -91,7 +91,7 @@ func TestReadFile(t *testing.T) {
 				tmpDir := t.TempDir()
 				filePath := filepath.Join(tmpDir, "test.txt")
 				content := []byte("local file content")
-				require.NoError(t, os.WriteFile(filePath, content, 0644))
+				require.NoError(t, os.WriteFile(filePath, content, 0o644))
 				return filePath, func() {} // cleanup handled by t.TempDir()
 			},
 			expectError:  false,
@@ -152,7 +152,7 @@ func TestReadFile(t *testing.T) {
 				fileName := "ftp_file.txt" // Valid filename for filesystem
 				filePath := filepath.Join(tmpDir, fileName)
 				content := []byte("local fallback content")
-				require.NoError(t, os.WriteFile(filePath, content, 0644))
+				require.NoError(t, os.WriteFile(filePath, content, 0o644))
 				return filePath, func() {}
 			},
 			expectError:  false,

pkg/cmd/docs.go

@@ -86,7 +86,7 @@ func (o *docsOptions) run(_ io.Writer) error {
 				base := filepath.Base(filename)
 				name := strings.TrimSuffix(base, path.Ext(base))
 				title := cases.Title(language.Und, cases.NoLower).String(strings.ReplaceAll(name, "_", " "))
-				return fmt.Sprintf("---\ntitle: \"%s\"\n---\n\n", title)
+				return fmt.Sprintf("---\ntitle: %q\n---\n\n", title)
 			}
 
 			return doc.GenMarkdownTreeCustom(o.topCmd, o.dest, hdrFunc, standardLinks)

pkg/cmd/load_plugins.go

@@ -220,8 +220,7 @@ type pluginCommand struct {
 // and add the dynamic completion hook to call the optional plugin.complete
 func loadCompletionForPlugin(pluginCmd *cobra.Command, plug plugin.Plugin) {
 	// Parse the yaml file providing the plugin's sub-commands and flags
-	cmds, err := loadFile(strings.Join(
+	cmds, err := loadFile(plug.Dir() + string(filepath.Separator) + pluginStaticCompletionFile)
-		[]string{plug.Dir(), pluginStaticCompletionFile}, string(filepath.Separator)))
 
 	if err != nil {
 		// The file could be missing or invalid.  No static completion for this plugin.
@@ -351,7 +350,7 @@ func pluginDynamicComp(plug plugin.Plugin, cmd *cobra.Command, args []string, to
 	}
 
 	// We will call the dynamic completion script of the plugin
-	main := strings.Join([]string{plug.Dir(), pluginDynamicCompletionExecutable}, string(filepath.Separator))
+	main := plug.Dir() + string(filepath.Separator) + pluginDynamicCompletionExecutable
 
 	// We must include all sub-commands passed on the command-line.
 	// To do that, we pass-in the entire CommandPath, except the first two elements

pkg/cmd/plugin_package.go

@@ -91,7 +91,7 @@ func (o *pluginPackageOptions) run(out io.Writer) error {
 	}
 
 	// Create destination directory if needed
-	if err := os.MkdirAll(o.destination, 0755); err != nil {
+	if err := os.MkdirAll(o.destination, 0o755); err != nil {
 		return err
 	}
 
@@ -158,7 +158,7 @@ func (o *pluginPackageOptions) run(out io.Writer) error {
 
 		// Write the signature
 		provFile := tarballPath + ".prov"
-		if err := os.WriteFile(provFile, []byte(sig), 0644); err != nil {
+		if err := os.WriteFile(provFile, []byte(sig), 0o644); err != nil {
 			os.Remove(tarballPath)
 			return err
 		}

pkg/cmd/plugin_package_test.go

@@ -43,12 +43,12 @@ func TestPluginPackageWithoutSigning(t *testing.T) {
 	// Create a test plugin directory
 	tempDir := t.TempDir()
 	pluginDir := filepath.Join(tempDir, "test-plugin")
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
 	// Create a plugin.yaml file
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -94,12 +94,12 @@ func TestPluginPackageDefaultRequiresSigning(t *testing.T) {
 	// Create a test plugin directory
 	tempDir := t.TempDir()
 	pluginDir := filepath.Join(tempDir, "test-plugin")
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
 	// Create a plugin.yaml file
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -131,12 +131,12 @@ func TestPluginPackageSigningFailure(t *testing.T) {
 	// Create a test plugin directory
 	tempDir := t.TempDir()
 	pluginDir := filepath.Join(tempDir, "test-plugin")
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
 	// Create a plugin.yaml file
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
 

pkg/cmd/plugin_uninstall_test.go

@@ -39,7 +39,7 @@ func TestPluginUninstallCleansUpVersionedFiles(t *testing.T) {
 
 	// Create plugin directory
 	pluginDir := filepath.Join(pluginsDir, pluginName)
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -49,7 +49,7 @@ version: 1.2.3
 description: Test plugin
 command: $HELM_PLUGIN_DIR/test-plugin
 `
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(pluginYAML), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(pluginYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -58,14 +58,14 @@ command: $HELM_PLUGIN_DIR/test-plugin
 	provFile := filepath.Join(pluginsDir, "test-plugin-1.2.3.tgz.prov")
 	otherVersionTarball := filepath.Join(pluginsDir, "test-plugin-2.0.0.tgz")
 
-	if err := os.WriteFile(tarballFile, []byte("fake tarball"), 0644); err != nil {
+	if err := os.WriteFile(tarballFile, []byte("fake tarball"), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(provFile, []byte("fake provenance"), 0644); err != nil {
+	if err := os.WriteFile(provFile, []byte("fake provenance"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	// Create another version that should NOT be removed
-	if err := os.WriteFile(otherVersionTarball, []byte("other version"), 0644); err != nil {
+	if err := os.WriteFile(otherVersionTarball, []byte("other version"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 

pkg/cmd/plugin_verify_test.go

@@ -102,7 +102,7 @@ func TestPluginVerifyCmd_InvalidProvenance(t *testing.T) {
 
 	// Create invalid .prov file
 	provFile := pluginTgz + ".prov"
-	if err := os.WriteFile(provFile, []byte("invalid provenance"), 0644); err != nil {
+	if err := os.WriteFile(provFile, []byte("invalid provenance"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	defer os.Remove(provFile)
@@ -178,12 +178,12 @@ func createTestPluginDir(t *testing.T) string {
 	// Create temporary directory with plugin structure
 	tmpDir := t.TempDir()
 	pluginDir := filepath.Join(tmpDir, "test-plugin")
-	if err := os.MkdirAll(pluginDir, 0755); err != nil {
+	if err := os.MkdirAll(pluginDir, 0o755); err != nil {
 		t.Fatalf("Failed to create plugin directory: %v", err)
 	}
 
 	// Use the same plugin YAML as other cmd tests
-	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(pluginDir, "plugin.yaml"), []byte(testPluginYAML), 0o644); err != nil {
 		t.Fatalf("Failed to create plugin.yaml: %v", err)
 	}
 
@@ -243,7 +243,7 @@ Version: GnuPG v1
 iQEcBAEBCAAGBQJktest...
 -----END PGP SIGNATURE-----
 `, hashStr)
-	if err := os.WriteFile(provFile, []byte(provContent), 0644); err != nil {
+	if err := os.WriteFile(provFile, []byte(provContent), 0o644); err != nil {
 		t.Fatalf("Failed to create provenance file: %v", err)
 	}
 }
@@ -256,7 +256,7 @@ func createTestKeyring(t *testing.T) string {
 	keyringPath := filepath.Join(tmpDir, "pubring.gpg")
 
 	// Create empty keyring for testing
-	if err := os.WriteFile(keyringPath, []byte{}, 0644); err != nil {
+	if err := os.WriteFile(keyringPath, []byte{}, 0o644); err != nil {
 		t.Fatalf("Failed to create test keyring: %v", err)
 	}
 

pkg/cmd/pull_test.go

@@ -229,7 +229,7 @@ func TestPullCmd(t *testing.T) {
 			// Create file or Dir before helm pull --untar, see: https://github.com/helm/helm/issues/7182
 			if tt.existFile != "" {
 				file := filepath.Join(outdir, tt.existFile)
-				if err := os.MkdirAll(filepath.Dir(file), 0755); err != nil {
+				if err := os.MkdirAll(filepath.Dir(file), 0o755); err != nil {
 					t.Fatal(err)
 				}
 				_, err := os.Create(file)
@@ -239,7 +239,7 @@ func TestPullCmd(t *testing.T) {
 			}
 			if tt.existDir != "" {
 				file := filepath.Join(outdir, tt.existDir)
-				err := os.MkdirAll(file, 0755)
+				err := os.MkdirAll(file, 0o755)
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -306,7 +306,7 @@ func runPullTests(t *testing.T, tests []struct {
 			}
 			if tt.existDir != "" {
 				file := filepath.Join(outdir, tt.existDir)
-				err := os.MkdirAll(file, 0755)
+				err := os.MkdirAll(file, 0o755)
 				if err != nil {
 					t.Fatal(err)
 				}

pkg/cmd/repo_add_test.go

@@ -270,7 +270,7 @@ func TestRepoAddWithPasswordFromStdin(t *testing.T) {
 		t.Errorf("unexpected error, got '%v'", err)
 	}
 
-	if !strings.Contains(result, fmt.Sprintf("\"%s\" has been added to your repositories", testName)) {
+	if !strings.Contains(result, fmt.Sprintf("%q has been added to your repositories", testName)) {
 		t.Errorf("Repo was not successfully added. Output: %s", result)
 	}
 }

pkg/cmd/repo_remove.go

@@ -68,7 +68,7 @@ func (o *repoRemoveOptions) run(out io.Writer) error {
 		if !r.Remove(name) {
 			return fmt.Errorf("no repo named %q found", name)
 		}
-		if err := r.WriteFile(o.repoFile, 0600); err != nil {
+		if err := r.WriteFile(o.repoFile, 0o600); err != nil {
 			return err
 		}
 

pkg/cmd/template.go

@@ -239,7 +239,7 @@ func isTestHook(h *release.Hook) bool {
 // this duplicate code should be removed. It is added here so that the API
 // surface area is as minimally impacted as possible in fixing the issue.
 func writeToFile(outputDir string, name string, data string, appendData bool) error {
-	outfileName := strings.Join([]string{outputDir, name}, string(filepath.Separator))
+	outfileName := outputDir + string(filepath.Separator) + name
 
 	err := ensureDirectoryForFile(outfileName)
 	if err != nil {
@@ -265,7 +265,7 @@ func writeToFile(outputDir string, name string, data string, appendData bool) er
 
 func createOrOpenFile(filename string, appendData bool) (*os.File, error) {
 	if appendData {
-		return os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0600)
+		return os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0o600)
 	}
 	return os.Create(filename)
 }
@@ -277,5 +277,5 @@ func ensureDirectoryForFile(file string) error {
 		return err
 	}
 
-	return os.MkdirAll(baseDir, 0755)
+	return os.MkdirAll(baseDir, 0o755)
 }

pkg/downloader/cache.go

@@ -78,11 +78,11 @@ func (c *DiskCache) Get(key [sha256.Size]byte, cacheType string) (string, error)
 func (c *DiskCache) Put(key [sha256.Size]byte, data io.Reader, cacheType string) (string, error) {
 	// TODO: verify the key and digest of the key are the same.
 	p := c.fileName(key, cacheType)
-	if err := os.MkdirAll(filepath.Dir(p), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
 		slog.Error("failed to create cache directory")
 		return p, err
 	}
-	return p, fileutil.AtomicWriteFile(p, data, 0644)
+	return p, fileutil.AtomicWriteFile(p, data, 0o644)
 }
 
 // fileName generates the filename in a structured manner where the first part is the

pkg/downloader/cache_test.go

@@ -105,7 +105,7 @@ func TestDiskCache_PutAndGet(t *testing.T) {
 	t.Run("GetDirectory", func(t *testing.T) {
 		dirKey := sha256.Sum256([]byte("i am a directory"))
 		dirPath := cache.fileName(dirKey, CacheChart)
-		err := os.MkdirAll(dirPath, 0755)
+		err := os.MkdirAll(dirPath, 0o755)
 		require.NoError(t, err)
 
 		_, err = cache.Get(dirKey, CacheChart)

pkg/downloader/chart_downloader.go

@@ -165,7 +165,7 @@ func (c *ChartDownloader) DownloadTo(ref, version, dest string) (string, *proven
 	// Use PlatformAtomicWriteFile to handle platform-specific concurrency concerns
 	// (Windows requires locking to avoid "Access Denied" errors when multiple
 	// processes write the same file)
-	if err := fileutil.PlatformAtomicWriteFile(destfile, data, 0644); err != nil {
+	if err := fileutil.PlatformAtomicWriteFile(destfile, data, 0o644); err != nil {
 		return destfile, nil, err
 	}
 
@@ -197,7 +197,7 @@ func (c *ChartDownloader) DownloadTo(ref, version, dest string) (string, *proven
 		provfile := destfile + ".prov"
 
 		// Use PlatformAtomicWriteFile for the provenance file as well
-		if err := fileutil.PlatformAtomicWriteFile(provfile, body, 0644); err != nil {
+		if err := fileutil.PlatformAtomicWriteFile(provfile, body, 0o644); err != nil {
 			return destfile, nil, err
 		}
 
@@ -321,7 +321,7 @@ func (c *ChartDownloader) DownloadToCache(ref, version string) (string, *provena
 			// Copy chart to a known location with the right name for verification and then
 			// clean it up.
 			tmpdir := filepath.Dir(filepath.Join(c.ContentCache, "tmp"))
-			if err := os.MkdirAll(tmpdir, 0755); err != nil {
+			if err := os.MkdirAll(tmpdir, 0o755); err != nil {
 				return pth, ver, err
 			}
 			tmpfile := filepath.Join(tmpdir, name)

pkg/downloader/chart_downloader_test.go

@@ -417,7 +417,7 @@ func TestDownloadToCache(t *testing.T) {
 	t.Run("download and cache chart", func(t *testing.T) {
 		// Clear cache for this test
 		os.RemoveAll(contentCache)
-		os.MkdirAll(contentCache, 0755)
+		os.MkdirAll(contentCache, 0o755)
 		c.Cache = &DiskCache{Root: contentCache}
 
 		pth, v, err := c.DownloadToCache("test/signtest", "0.1.0")
@@ -459,7 +459,7 @@ func TestDownloadToCache(t *testing.T) {
 	t.Run("download and verify", func(t *testing.T) {
 		// Clear cache
 		os.RemoveAll(contentCache)
-		os.MkdirAll(contentCache, 0755)
+		os.MkdirAll(contentCache, 0o755)
 		c.Cache = &DiskCache{Root: contentCache}
 		c.Verify = VerifyAlways
 		c.Keyring = "testdata/helm-test-key.pub"

pkg/downloader/manager.go

@@ -257,7 +257,7 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error {
 			return fmt.Errorf("%q is not a directory", destPath)
 		}
 	} else if errors.Is(err, stdfs.ErrNotExist) {
-		if err := os.MkdirAll(destPath, 0755); err != nil {
+		if err := os.MkdirAll(destPath, 0o755); err != nil {
 			return err
 		}
 	} else {
@@ -265,7 +265,7 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error {
 	}
 
 	// Prepare tmpPath
-	if err := os.MkdirAll(tmpPath, 0755); err != nil {
+	if err := os.MkdirAll(tmpPath, 0o755); err != nil {
 		return err
 	}
 	defer os.RemoveAll(tmpPath)
@@ -378,7 +378,7 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error {
 }
 
 func parseOCIRef(chartRef string) (string, string, error) {
-	refTagRegexp := regexp.MustCompile(`^(oci://[^:]+(:[0-9]{1,5})?[^:]+):(.*)$`)
+	refTagRegexp := regexp.MustCompile(`^(oci://[^:]+(:\d{1,5})?[^:]+):(.*)$`)
 	caps := refTagRegexp.FindStringSubmatch(chartRef)
 	if len(caps) != 4 {
 		return "", "", fmt.Errorf("improperly formatted oci chart reference: %s", chartRef)
@@ -866,7 +866,7 @@ func writeLock(chartpath string, lock *chart.Lock, legacyLockfile bool) error {
 		}
 	}
 
-	return os.WriteFile(dest, data, 0644)
+	return os.WriteFile(dest, data, 0o644)
 }
 
 // archive a dep chart from local directory and save it into destPath

pkg/downloader/manager_test.go

@@ -264,7 +264,7 @@ func TestDownloadAll(t *testing.T) {
 	}
 
 	// create a 'tmpcharts' directory to test #5567
-	if err := os.MkdirAll(filepath.Join(chartPath, "tmpcharts"), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(chartPath, "tmpcharts"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := m.downloadAll([]*chart.Dependency{signDep, localDep}); err != nil {
@@ -282,10 +282,10 @@ func TestDownloadAll(t *testing.T) {
 description: A Helm chart for Kubernetes
 name: ../bad-local-subchart
 version: 0.1.0`
-	if err := os.MkdirAll(filepath.Join(chartPath, "testdata", "bad-local-subchart"), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Join(chartPath, "testdata", "bad-local-subchart"), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	err = os.WriteFile(filepath.Join(chartPath, "testdata", "bad-local-subchart", "Chart.yaml"), []byte(badchartyaml), 0644)
+	err = os.WriteFile(filepath.Join(chartPath, "testdata", "bad-local-subchart", "Chart.yaml"), []byte(badchartyaml), 0o644)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -735,7 +735,7 @@ func TestWriteLock(t *testing.T) {
 	t.Run("overwrite existing lock file", func(t *testing.T) {
 		dir := t.TempDir()
 		lockfilePath := filepath.Join(dir, "Chart.lock")
-		assert.NoError(t, os.WriteFile(lockfilePath, []byte("old content"), 0644))
+		assert.NoError(t, os.WriteFile(lockfilePath, []byte("old content"), 0o644))
 
 		err = writeLock(dir, lock, false)
 		assert.NoError(t, err)
@@ -748,7 +748,7 @@ func TestWriteLock(t *testing.T) {
 	t.Run("lock file is a symlink", func(t *testing.T) {
 		dir := t.TempDir()
 		dummyFile := filepath.Join(dir, "dummy.txt")
-		assert.NoError(t, os.WriteFile(dummyFile, []byte("dummy"), 0644))
+		assert.NoError(t, os.WriteFile(dummyFile, []byte("dummy"), 0o644))
 
 		lockfilePath := filepath.Join(dir, "Chart.lock")
 		assert.NoError(t, os.Symlink(dummyFile, lockfilePath))
@@ -761,7 +761,7 @@ func TestWriteLock(t *testing.T) {
 	t.Run("chart path is not a directory", func(t *testing.T) {
 		dir := t.TempDir()
 		filePath := filepath.Join(dir, "not-a-dir")
-		assert.NoError(t, os.WriteFile(filePath, []byte("file"), 0644))
+		assert.NoError(t, os.WriteFile(filePath, []byte("file"), 0o644))
 
 		err = writeLock(filePath, lock, false)
 		assert.Error(t, err)

pkg/engine/engine.go

@@ -539,7 +539,7 @@ func (p byPathLen) Less(i, j int) bool {
 	a, b := p[i], p[j]
 	ca, cb := strings.Count(a, "/"), strings.Count(b, "/")
 	if ca == cb {
-		return strings.Compare(a, b) == -1
+		return a < b
 	}
 	return ca < cb
 }

pkg/getter/httpgetter_test.go

@@ -569,7 +569,7 @@ func TestHttpClientInsecureSkipVerify(t *testing.T) {
 	g.opts.keyFile = "testdata/client.key"
 	g.opts.insecureSkipVerifyTLS = true
 	transport := verifyInsecureSkipVerify(t, &g, "HTTPGetter with 2 way ssl", true)
-	if len(transport.TLSClientConfig.Certificates) <= 0 {
+	if len(transport.TLSClientConfig.Certificates) == 0 {
 		t.Fatal("transport.TLSClientConfig.Certificates is not present")
 	}
 }

pkg/pusher/ocipusher_test.go

@@ -301,12 +301,12 @@ func TestOCIPusher_Push_ChartOperations(t *testing.T) {
 				dst.Close()
 
 				// Make the file unreadable
-				if err := os.Chmod(tempChart, 0000); err != nil {
+				if err := os.Chmod(tempChart, 0o000); err != nil {
 					t.Fatal(err)
 				}
 
 				return tempChart, func() {
-					os.Chmod(tempChart, 0644) // Restore permissions for cleanup
+					os.Chmod(tempChart, 0o644) // Restore permissions for cleanup
 				}
 			},
 			href:          "oci://localhost:5000/test",
@@ -342,7 +342,7 @@ func TestOCIPusher_Push_ChartOperations(t *testing.T) {
 				dst.Close()
 
 				// Create provenance file
-				if err := os.WriteFile(tempProv, []byte("test provenance data"), 0644); err != nil {
+				if err := os.WriteFile(tempProv, []byte("test provenance data"), 0o644); err != nil {
 					t.Fatal(err)
 				}
 

pkg/registry/registry_test.go

@@ -36,7 +36,6 @@ import (
 	_ "github.com/distribution/distribution/v3/registry/auth/token"
 	_ "github.com/distribution/distribution/v3/registry/storage/driver/inmemory"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 	"golang.org/x/crypto/bcrypt"
 
@@ -75,9 +74,9 @@ type TestRegistry struct {
 func setup(suite *TestRegistry, tlsEnabled, insecure bool, auth string) {
 	suite.WorkspaceDir = testWorkspaceDir
 	err := os.RemoveAll(suite.WorkspaceDir)
-	require.NoError(suite.T(), err, "no error removing test workspace dir")
+	suite.Require().NoError(err, "no error removing test workspace dir")
-	err = os.Mkdir(suite.WorkspaceDir, 0700)
+	err = os.Mkdir(suite.WorkspaceDir, 0o700)
-	require.NoError(suite.T(), err, "no error creating test workspace dir")
+	suite.Require().NoError(err, "no error creating test workspace dir")
 
 	var out bytes.Buffer
 
@@ -123,7 +122,7 @@ func setup(suite *TestRegistry, tlsEnabled, insecure bool, auth string) {
 	pwBytes, err := bcrypt.GenerateFromPassword([]byte(testPassword), bcrypt.DefaultCost)
 	suite.Require().NoError(err, "no error generating bcrypt password for test htpasswd file")
 	htpasswdPath := filepath.Join(suite.WorkspaceDir, testHtpasswdFileBasename)
-	err = os.WriteFile(htpasswdPath, fmt.Appendf(nil, "%s:%s\n", testUsername, string(pwBytes)), 0644)
+	err = os.WriteFile(htpasswdPath, fmt.Appendf(nil, "%s:%s\n", testUsername, string(pwBytes)), 0o644)
 	suite.Require().NoError(err, "no error creating test htpasswd file")
 
 	// Registry config

pkg/repo/v1/chartrepo.go

@@ -109,14 +109,14 @@ func (r *ChartRepository) DownloadIndexFile() (string, error) {
 		fmt.Fprintln(&charts, name)
 	}
 	chartsFile := filepath.Join(r.CachePath, helmpath.CacheChartsFile(r.Config.Name))
-	os.MkdirAll(filepath.Dir(chartsFile), 0755)
+	os.MkdirAll(filepath.Dir(chartsFile), 0o755)
 
-	fileutil.AtomicWriteFile(chartsFile, bytes.NewReader([]byte(charts.String())), 0644)
+	fileutil.AtomicWriteFile(chartsFile, bytes.NewReader([]byte(charts.String())), 0o644)
 
 	// Create the index file in the cache directory
 	fname := filepath.Join(r.CachePath, helmpath.CacheIndexFile(r.Config.Name))
-	os.MkdirAll(filepath.Dir(fname), 0755)
+	os.MkdirAll(filepath.Dir(fname), 0o755)
-	return fname, fileutil.AtomicWriteFile(fname, bytes.NewReader(index), 0644)
+	return fname, fileutil.AtomicWriteFile(fname, bytes.NewReader(index), 0o644)
 }
 
 type findChartInRepoURLOptions struct {

pkg/repo/v1/index_test.go

@@ -548,7 +548,7 @@ func TestIndexWrite(t *testing.T) {
 	}
 	dir := t.TempDir()
 	testpath := filepath.Join(dir, "test")
-	i.WriteFile(testpath, 0600)
+	i.WriteFile(testpath, 0o600)
 
 	got, err := os.ReadFile(testpath)
 	if err != nil {
@@ -566,7 +566,7 @@ func TestIndexJSONWrite(t *testing.T) {
 	}
 	dir := t.TempDir()
 	testpath := filepath.Join(dir, "test")
-	i.WriteJSONFile(testpath, 0600)
+	i.WriteJSONFile(testpath, 0o600)
 
 	got, err := os.ReadFile(testpath)
 	if err != nil {

pkg/repo/v1/repo.go

@@ -118,7 +118,7 @@ func (r *File) WriteFile(path string, perm os.FileMode) error {
 	if err != nil {
 		return err
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return err
 	}
 	return os.WriteFile(path, data, perm)

pkg/repo/v1/repo_test.go

@@ -202,7 +202,7 @@ func TestWriteFile(t *testing.T) {
 		t.Errorf("failed to create test-file (%v)", err)
 	}
 	defer os.Remove(file.Name())
-	if err := sampleRepository.WriteFile(file.Name(), 0600); err != nil {
+	if err := sampleRepository.WriteFile(file.Name(), 0o600); err != nil {
 		t.Errorf("failed to write file (%v)", err)
 	}
 

pkg/storage/driver/cfgmaps.go

@@ -237,7 +237,7 @@ func (cfgmaps *ConfigMaps) Delete(key string) (rls release.Releaser, err error)
 		return nil, err
 	}
 	// delete the release
-	if err = cfgmaps.impl.Delete(context.Background(), key, metav1.DeleteOptions{}); err != nil {
+	if err := cfgmaps.impl.Delete(context.Background(), key, metav1.DeleteOptions{}); err != nil {
 		return rls, err
 	}
 	return rls, nil

pkg/storage/driver/util.go

@@ -49,7 +49,7 @@ func encodeRelease(rls *rspb.Release) (string, error) {
 		w.Close()
 		return "", err
 	}
-	if err = w.Close(); err != nil {
+	if err := w.Close(); err != nil {
 		return "", err
 	}
 

pkg/strvals/literal_parser_test.go

@@ -16,6 +16,7 @@ limitations under the License.
 package strvals
 
 import (
+	"bytes"
 	"fmt"
 	"strings"
 	"testing"
@@ -298,7 +299,7 @@ func TestParseLiteral(t *testing.T) {
 			require.NoError(t, err, "Error serializing parsed value")
 		}
 
-		if string(y1) != string(y2) {
+		if !bytes.Equal(y1, y2) {
 			assert.Equal(t, string(y1), string(y2), tt.str)
 		}
 	}
@@ -409,7 +410,7 @@ func TestParseLiteralInto(t *testing.T) {
 			require.NoError(t, err, "Error serializing parsed value")
 		}
 
-		if string(y1) != string(y2) {
+		if !bytes.Equal(y1, y2) {
 			assert.Equal(t, string(y1), string(y2), tt.input)
 		}
 	}
@@ -471,7 +472,7 @@ func TestParseLiteralNestedLevels(t *testing.T) {
 			require.NoError(t, err, "Error serializing parsed value")
 		}
 
-		if string(y1) != string(y2) {
+		if !bytes.Equal(y1, y2) {
 			assert.Equal(t, string(y1), string(y2), tt.str)
 		}
 	}

pkg/strvals/parser.go

@@ -226,7 +226,7 @@ func (t *parser) key(data map[string]any, nestedNameLevel int) (reterr error) {
 				// discard in t.sc the chars of the decoded json value (the number of those characters is returned by InputOffset).
 				var jsonval any
 				dec := json.NewDecoder(strings.NewReader(t.sc.String()))
-				if err = dec.Decode(&jsonval); err != nil {
+				if err := dec.Decode(&jsonval); err != nil {
 					return err
 				}
 				set(data, string(k), jsonval)
@@ -358,7 +358,7 @@ func (t *parser) listItem(list []any, i, nestedNameLevel int) ([]any, error) {
 			// discard in t.sc the chars of the decoded json value (the number of those characters is returned by InputOffset).
 			var jsonval any
 			dec := json.NewDecoder(strings.NewReader(t.sc.String()))
-			if err = dec.Decode(&jsonval); err != nil {
+			if err := dec.Decode(&jsonval); err != nil {
 				return list, err
 			}
 			if list, err = setIndex(list, i, jsonval); err != nil {

pkg/strvals/parser_test.go

@@ -16,6 +16,7 @@ limitations under the License.
 package strvals
 
 import (
+	"bytes"
 	"fmt"
 	"strings"
 	"testing"
@@ -400,7 +401,7 @@ func TestParseSet(t *testing.T) {
 			require.NoError(t, err, "Error serializing parsed value")
 		}
 
-		if string(y1) != string(y2) {
+		if !bytes.Equal(y1, y2) {
 			assert.Equal(t, string(y1), string(y2), tt.str)
 		}
 	}
@@ -423,7 +424,7 @@ func TestParseSet(t *testing.T) {
 			require.NoError(t, err, "Error serializing parsed value")
 		}
 
-		if string(y1) != string(y2) {
+		if !bytes.Equal(y1, y2) {
 			assert.Equal(t, string(y1), string(y2), tt.str)
 		}
 	}
@@ -534,7 +535,7 @@ func TestParseInto(t *testing.T) {
 			require.NoError(t, err, "Error serializing parsed value")
 		}
 
-		if string(y1) != string(y2) {
+		if !bytes.Equal(y1, y2) {
 			assert.Equal(t, string(y1), string(y2), tt.input)
 		}
 	}
@@ -567,7 +568,7 @@ func TestParseIntoString(t *testing.T) {
 		require.NoError(t, err, "Error serializing parsed value")
 	}
 
-	if string(y1) != string(y2) {
+	if !bytes.Equal(y1, y2) {
 		assert.Equal(t, string(y1), string(y2), input)
 	}
 }
@@ -667,7 +668,7 @@ func TestParseJSON(t *testing.T) {
 			require.NoError(t, err, "Error serializing parsed value")
 		}
 
-		if string(y1) != string(y2) {
+		if !bytes.Equal(y1, y2) {
 			assert.Equal(t, string(y1), string(y2), tt.input)
 		}
 	}
@@ -697,7 +698,7 @@ func TestParseFile(t *testing.T) {
 		require.NoError(t, err, "Error serializing parsed value")
 	}
 
-	if string(y1) != string(y2) {
+	if !bytes.Equal(y1, y2) {
 		assert.Equal(t, string(y1), string(y2), input)
 	}
 }
@@ -728,7 +729,7 @@ func TestParseIntoFile(t *testing.T) {
 		require.NoError(t, err, "Error serializing parsed value")
 	}
 
-	if string(y1) != string(y2) {
+	if !bytes.Equal(y1, y2) {
 		assert.Equal(t, string(y1), string(y2), input)
 	}
 }
@@ -797,7 +798,7 @@ func TestParseSetNestedLevels(t *testing.T) {
 			require.NoError(t, err, "Error serializing parsed value")
 		}
 
-		if string(y1) != string(y2) {
+		if !bytes.Equal(y1, y2) {
 			assert.Equal(t, string(y1), string(y2), tt.str)
 		}
 	}