Updating golangci-lint to 1.61.0 (#22973)

server/config/config.go

@@ -1657,12 +1657,12 @@ func (man Manager) IsSet(key string) bool {
 // envNameFromConfigKey converts a config key into the corresponding
 // environment variable name
 func envNameFromConfigKey(key string) string {
-	return envPrefix + "_" + strings.ToUpper(strings.Replace(key, ".", "_", -1))
+	return envPrefix + "_" + strings.ToUpper(strings.ReplaceAll(key, ".", "_"))
 }
 
 // flagNameFromConfigKey converts a config key into the corresponding flag name
 func flagNameFromConfigKey(key string) string {
-	return strings.Replace(key, ".", "_", -1)
+	return strings.ReplaceAll(key, ".", "_")
 }
 
 // Manager manages the addition and retrieval of config values for Fleet

server/contexts/ctxerr/stack_test.go

@@ -205,7 +205,9 @@ func TestElasticStack(t *testing.T) {
 
 			// the culprit should be the function name of the top of the stack of the
 			// cause error.
-			fnName := strings.TrimSpace(c.causeStackContains[0][strings.Index(c.causeStackContains[0], "TestElasticStack"):])
+			fnIndex := strings.Index(c.causeStackContains[0], "TestElasticStack")
+			require.GreaterOrEqual(t, fnIndex, 0)
+			fnName := strings.TrimSpace(c.causeStackContains[0][fnIndex:])
 			require.Equal(t, fnName, apmErr.Culprit)
 
 			// the APM stack should match the cause stack (i.e. APM should have

server/cron/calendar_cron_test.go

@@ -356,7 +356,7 @@ func TestCalendarEventsMultipleHosts(t *testing.T) {
 		require.NotZero(t, endTime)
 
 		eventsMu.Lock()
-		calendarEventID := uint(len(calendarEvents) + 1)
+		calendarEventID := uint(len(calendarEvents) + 1) //nolint:gosec // dismiss G115
 		calendarEvents[email] = &fleet.CalendarEvent{
 			ID:        calendarEventID,
 			Email:     email,
@@ -364,7 +364,7 @@ func TestCalendarEventsMultipleHosts(t *testing.T) {
 			EndTime:   endTime,
 			Data:      data,
 		}
-		hostCalendarEventID := uint(len(hostCalendarEvents) + 1)
+		hostCalendarEventID := uint(len(hostCalendarEvents) + 1) //nolint:gosec // dismiss G115
 		hostCalendarEvents[hostID] = &fleet.HostCalendarEvent{
 			ID:              hostCalendarEventID,
 			HostID:          hostID,
@@ -572,7 +572,7 @@ func TestCalendarEvents1KHosts(t *testing.T) {
 		newHost := fleet.HostPolicyMembershipData{
 			Email:              fmt.Sprintf("user%d@example.com", i),
 			Passing:            i%2 == 0,
-			HostID:             uint(i),
+			HostID:             uint(i), //nolint:gosec // dismiss G115
 			HostDisplayName:    fmt.Sprintf("display_name%d", i),
 			HostHardwareSerial: fmt.Sprintf("serial%d", i),
 		}
@@ -680,7 +680,7 @@ func TestCalendarEvents1KHosts(t *testing.T) {
 		hosts = append(hosts, fleet.HostPolicyMembershipData{
 			Email:              fmt.Sprintf("user%d@example.com", i),
 			Passing:            true,
-			HostID:             uint(i),
+			HostID:             uint(i), //nolint:gosec // dismiss G115
 			HostDisplayName:    fmt.Sprintf("display_name%d", i),
 			HostHardwareSerial: fmt.Sprintf("serial%d", i),
 		})
@@ -692,13 +692,13 @@ func TestCalendarEvents1KHosts(t *testing.T) {
 		if hostID%2 == 0 {
 			return nil, nil, notFoundErr{}
 		}
-		require.Contains(t, eventPerHost, uint(hostID))
+		require.Contains(t, eventPerHost, uint(hostID)) //nolint:gosec // dismiss G115
 		return &fleet.HostCalendarEvent{
-			ID:              uint(hostID),
-			HostID:          uint(hostID),
-			CalendarEventID: uint(hostID),
+			ID:              uint(hostID), //nolint:gosec // dismiss G115
+			HostID:          uint(hostID), //nolint:gosec // dismiss G115
+			CalendarEventID: uint(hostID), //nolint:gosec // dismiss G115
 			WebhookStatus:   fleet.CalendarWebhookStatusNone,
-		}, eventPerHost[uint(hostID)], nil
+		}, eventPerHost[uint(hostID)], nil //nolint:gosec // dismiss G115
 	}
 
 	ds.DeleteCalendarEventFunc = func(ctx context.Context, calendarEventID uint) error {
@@ -935,7 +935,7 @@ func TestEventBody(t *testing.T) {
 		require.NotZero(t, endTime)
 
 		eventsMu.Lock()
-		calendarEventID := uint(len(calendarEvents) + 1)
+		calendarEventID := uint(len(calendarEvents) + 1) //nolint:gosec // dismiss G115
 		calendarEvents[hostID] = &fleet.CalendarEvent{
 			ID:        calendarEventID,
 			Email:     email,
@@ -943,7 +943,7 @@ func TestEventBody(t *testing.T) {
 			EndTime:   endTime,
 			Data:      data,
 		}
-		hostCalendarEventID := uint(len(hostCalendarEvents) + 1)
+		hostCalendarEventID := uint(len(hostCalendarEvents) + 1) //nolint:gosec // dismiss G115
 		hostCalendarEvents[hostID] = &fleet.HostCalendarEvent{
 			ID:              hostCalendarEventID,
 			HostID:          hostID,

server/datastore/cached_mysql/cached_mysql_test.go

@@ -70,8 +70,7 @@ func TestClone(t *testing.T) {
 
 			// ensure that writing to src does not alter the cloned value (i.e. that
 			// the nested fields are deeply cloned too).
-			switch src := tc.src.(type) {
-			case *fleet.AppConfig:
+			if src, ok := tc.src.(*fleet.AppConfig); ok {
 				if len(src.ServerSettings.DebugHostIDs) > 0 {
 					src.ServerSettings.DebugHostIDs[0] = 999
 					require.NotEqual(t, src.ServerSettings.DebugHostIDs, clone.(*fleet.AppConfig).ServerSettings.DebugHostIDs)

server/datastore/mysql/activities.go

@@ -218,7 +218,7 @@ func (ds *Datastore) ListActivities(ctx context.Context, opt fleet.ListActivitie
 	var metaData *fleet.PaginationMetadata
 	if opt.ListOptions.IncludeMetadata {
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.Page > 0}
-		if len(activities) > int(opt.ListOptions.PerPage) {
+		if len(activities) > int(opt.ListOptions.PerPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			activities = activities[:len(activities)-1]
 		}
@@ -483,7 +483,7 @@ WHERE
 
 	var metaData *fleet.PaginationMetadata
 	metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.Page > 0, TotalResults: count}
-	if len(activities) > int(opt.PerPage) {
+	if len(activities) > int(opt.PerPage) { //nolint:gosec // dismiss G115
 		metaData.HasNextResults = true
 		activities = activities[:len(activities)-1]
 	}
@@ -523,7 +523,7 @@ func (ds *Datastore) ListHostPastActivities(ctx context.Context, hostID uint, op
 	var metaData *fleet.PaginationMetadata
 	if opt.IncludeMetadata {
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.Page > 0}
-		if len(activities) > int(opt.PerPage) {
+		if len(activities) > int(opt.PerPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			activities = activities[:len(activities)-1]
 		}

server/datastore/mysql/aggregated_stats.go

@@ -49,7 +49,7 @@ const (
 )
 
 func getPercentileQuery(aggregate fleet.AggregatedStatsType, time string, percentile string) string {
-	switch aggregate {
+	switch aggregate { //nolint:gocritic // ignore singleCaseSwitch
 	case fleet.AggregatedStatsTypeScheduledQuery:
 		return fmt.Sprintf(scheduledQueryPercentileQuery, time, percentile)
 	}
@@ -140,7 +140,7 @@ func (ds *Datastore) CalculateAggregatedPerfStatsPercentiles(ctx context.Context
 }
 
 func getTotalExecutionsQuery(aggregate fleet.AggregatedStatsType) string {
-	switch aggregate {
+	switch aggregate { //nolint:gocritic // ignore singleCaseSwitch
 	case fleet.AggregatedStatsTypeScheduledQuery:
 		return scheduledQueryTotalExecutions
 	}

server/datastore/mysql/app_configs.go

@@ -135,7 +135,7 @@ func (ds *Datastore) IsEnrollSecretAvailable(ctx context.Context, secret string,
 		return false, nil
 	}
 	// Secret is in use, but we're checking if it's already assigned to the team
-	if (teamID == nil && !secretTeamID.Valid) || (teamID != nil && secretTeamID.Valid && uint(secretTeamID.Int64) == *teamID) {
+	if (teamID == nil && !secretTeamID.Valid) || (teamID != nil && secretTeamID.Valid && uint(secretTeamID.Int64) == *teamID) { //nolint:gosec // dismiss G115
 		return true, nil
 	}
 

server/datastore/mysql/apple_mdm.go

@@ -101,7 +101,7 @@ INSERT INTO
 
 	return &fleet.MDMAppleConfigProfile{
 		ProfileUUID:  profUUID,
-		ProfileID:    uint(profileID),
+		ProfileID:    uint(profileID), //nolint:gosec // dismiss G115
 		Identifier:   cp.Identifier,
 		Name:         cp.Name,
 		Mobileconfig: cp.Mobileconfig,
@@ -511,7 +511,7 @@ ON DUPLICATE KEY UPDATE
 	}
 	id, _ := res.LastInsertId()
 	return &fleet.MDMAppleEnrollmentProfile{
-		ID:         uint(id),
+		ID:         uint(id), //nolint:gosec // dismiss G115
 		Token:      payload.Token,
 		Type:       payload.Type,
 		DEPProfile: payload.DEPProfile,
@@ -683,7 +683,7 @@ func (ds *Datastore) NewMDMAppleInstaller(ctx context.Context, name string, size
 	}
 	id, _ := res.LastInsertId()
 	return &fleet.MDMAppleInstaller{
-		ID:        uint(id),
+		ID:        uint(id), //nolint:gosec // dismiss G115
 		Size:      size,
 		Name:      name,
 		Manifest:  manifest,
@@ -4335,7 +4335,8 @@ func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtCont
 	for k := range setProfileUUIDs {
 		profUUIDs = append(profUUIDs, k)
 	}
-	deleteArgs := append(deleteParams, profUUIDs)
+	deleteArgs := deleteParams
+	deleteArgs = append(deleteArgs, profUUIDs)
 
 	deleteStmt, args, err := sqlx.In(deleteStmt, deleteArgs...)
 	if err != nil {
@@ -5069,7 +5070,7 @@ VALUES (?, ?, ?, ?, ?, ?, ?, ?)
 
 	tokenID, _ := res.LastInsertId()
 
-	tok.ID = uint(tokenID)
+	tok.ID = uint(tokenID) //nolint:gosec // dismiss G115
 
 	cfg, err := ds.AppConfig(ctx)
 	if err != nil {

server/datastore/mysql/apple_mdm_test.go

@@ -1928,7 +1928,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err := ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)), res.Pending)
+	require.EqualValues(t, len(hosts), res.Pending)
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -1938,7 +1938,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)), res.Pending) // still pending because filevault not installed
+	require.EqualValues(t, len(hosts), res.Pending) // still pending because filevault not installed
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -1948,7 +1948,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)), res.Pending) // still pending because filevault not installed
+	require.EqualValues(t, len(hosts), res.Pending) // still pending because filevault not installed
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -1958,7 +1958,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)), res.Pending) // still pending because filevault pending
+	require.EqualValues(t, len(hosts), res.Pending) // still pending because filevault pending
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -1967,7 +1967,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)), res.Pending) // still pending because no disk encryption key
+	require.EqualValues(t, len(hosts), res.Pending) // still pending because no disk encryption key
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -1978,7 +1978,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	require.NoError(t, err)
 	require.NotNil(t, res)
 	// hosts still pending because disk encryption key decryptable is not set
-	require.Equal(t, uint(len(hosts)-1), res.Pending)
+	require.EqualValues(t, len(hosts)-1, res.Pending)
 	require.Equal(t, uint(0), res.Failed)
 	// one host is verifying because the disk is encrypted and we're verifying the key
 	require.Equal(t, uint(1), res.Verifying)
@@ -1989,7 +1989,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)), res.Pending) // still pending because disk encryption key decryptable is false
+	require.EqualValues(t, len(hosts), res.Pending) // still pending because disk encryption key decryptable is false
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -1999,7 +1999,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-1), res.Pending)
+	require.EqualValues(t, len(hosts)-1, res.Pending)
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(1), res.Verifying) // hosts[0] now has filevault fully enforced but not verified
 	require.Equal(t, uint(0), res.Verified)
@@ -2009,7 +2009,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-1), res.Pending)
+	require.EqualValues(t, len(hosts)-1, res.Pending)
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(1), res.Verified) // hosts[0] now has filevault fully enforced and verified
@@ -2021,7 +2021,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-1), res.Pending) // hosts[1] still pending because disk encryption key decryptable is false
+	require.EqualValues(t, len(hosts)-1, res.Pending) // hosts[1] still pending because disk encryption key decryptable is false
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(1), res.Verified)
@@ -2031,7 +2031,7 @@ func testAggregateMacOSSettingsStatusWithFileVault(t *testing.T, ds *Datastore)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-2), res.Pending)
+	require.EqualValues(t, len(hosts)-2, res.Pending)
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(1), res.Verifying) // hosts[1] now has filevault fully enforced
 	require.Equal(t, uint(1), res.Verified)
@@ -2202,7 +2202,7 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 	res, err := ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)), res.Pending) // each host only counts once
+	require.EqualValues(t, len(hosts), res.Pending) // each host only counts once
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -2220,7 +2220,7 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil)
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)), res.Pending) // each host only counts once
+	require.EqualValues(t, len(hosts), res.Pending) // each host only counts once
 	require.Equal(t, uint(0), res.Failed)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -2246,7 +2246,7 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil) // get summary for profiles with no team
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-2), res.Pending) // two hosts are failing at least one profile (hosts[0] and hosts[1])
+	require.EqualValues(t, len(hosts)-2, res.Pending) // two hosts are failing at least one profile (hosts[0] and hosts[1])
 	require.Equal(t, uint(2), res.Failed)             // only count one failure per host (hosts[0] failed two profiles but only counts once)
 	require.Equal(t, uint(0), res.Verifying)
 	require.Equal(t, uint(0), res.Verified)
@@ -2264,7 +2264,7 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil) // get summary for profiles with no team
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-2), res.Pending) // no change
+	require.EqualValues(t, len(hosts)-2, res.Pending) // no change
 	require.Equal(t, uint(2), res.Failed)             // no change
 	require.Equal(t, uint(0), res.Verifying)          // no change, host must apply all profiles count as latest
 	require.Equal(t, uint(0), res.Verified)
@@ -2282,11 +2282,12 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.NoError(t, ds.deleteMDMOSCustomSettingsForHost(ctx, tx, hosts[6].UUID, "darwin"))
 	require.NoError(t, tx.Commit())
-	pendingHosts := append(hosts[2:6:6], hosts[7:]...)
+	pendingHosts := hosts[2:6:6]
+	pendingHosts = append(pendingHosts, hosts[7:]...)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil) // get summary for profiles with no team
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-3), res.Pending) // hosts[6] not reported here anymore
+	require.EqualValues(t, len(hosts)-3, res.Pending) // hosts[6] not reported here anymore
 	require.Equal(t, uint(2), res.Failed)             // no change
 	require.Equal(t, uint(0), res.Verifying)          // no change, host must apply all profiles count as latest
 	require.Equal(t, uint(0), res.Verified)
@@ -2302,11 +2303,12 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 	// hosts[9] installed all profiles but one is with status nil (pending)
 	upsertHostCPs(hosts[9:10], noTeamCPs[:9], fleet.MDMOperationTypeInstall, &fleet.MDMDeliveryVerifying, ctx, ds, t)
 	upsertHostCPs(hosts[9:10], noTeamCPs[9:10], fleet.MDMOperationTypeInstall, nil, ctx, ds, t)
-	pendingHosts = append(hosts[2:6:6], hosts[7:]...)
+	pendingHosts = hosts[2:6:6]
+	pendingHosts = append(pendingHosts, hosts[7:]...)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil) // get summary for profiles with no team
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-3), res.Pending) // hosts[6] not reported here anymore, hosts[9] still pending
+	require.EqualValues(t, len(hosts)-3, res.Pending) // hosts[6] not reported here anymore, hosts[9] still pending
 	require.Equal(t, uint(2), res.Failed)             // no change
 	require.Equal(t, uint(0), res.Verifying)          // no change, host must apply all profiles count as latest
 	require.Equal(t, uint(0), res.Verified)
@@ -2321,11 +2323,12 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 
 	// hosts[9] installed all profiles
 	upsertHostCPs(hosts[9:10], noTeamCPs, fleet.MDMOperationTypeInstall, &fleet.MDMDeliveryVerifying, ctx, ds, t)
-	pendingHosts = append(hosts[2:6:6], hosts[7:9]...)
+	pendingHosts = hosts[2:6:6]
+	pendingHosts = append(pendingHosts, hosts[7:9]...)
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil) // get summary for profiles with no team
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	require.Equal(t, uint(len(hosts)-4), res.Pending) // subtract hosts[6 and 9] from pending
+	require.EqualValues(t, len(hosts)-4, res.Pending) // subtract hosts[6 and 9] from pending
 	require.Equal(t, uint(2), res.Failed)             // no change
 	require.Equal(t, uint(1), res.Verifying)          // add one host that has installed all profiles
 	require.Equal(t, uint(0), res.Verified)
@@ -2362,8 +2365,9 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, nil) // get summary for profiles with no team
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	pendingHosts = append(hosts[2:6:6], hosts[7:9]...)
-	require.Equal(t, uint(len(hosts)-4), res.Pending) // hosts[9] is still not pending, transferred to team
+	pendingHosts = hosts[2:6:6]
+	pendingHosts = append(pendingHosts, hosts[7:9]...)
+	require.EqualValues(t, len(hosts)-4, res.Pending) // hosts[9] is still not pending, transferred to team
 	require.Equal(t, uint(2), res.Failed)             // no change
 	require.Equal(t, uint(0), res.Verifying)          // hosts[9] was transferred so this is now zero
 	require.True(t, checkListHosts(fleet.OSSettingsPending, nil, pendingHosts))
@@ -2455,8 +2459,9 @@ func testMDMAppleHostsProfilesStatus(t *testing.T, ds *Datastore) {
 	res, err = ds.GetMDMAppleProfilesSummary(ctx, ptr.Uint(0)) // team id zero represents no team
 	require.NoError(t, err)
 	require.NotNil(t, res)
-	pendingHosts = append(hosts[2:6:6], hosts[7:9]...)
-	require.Equal(t, uint(len(hosts)-4), res.Pending) // subtract two failed hosts, one without profiles and hosts[9] transferred
+	pendingHosts = hosts[2:6:6]
+	pendingHosts = append(pendingHosts, hosts[7:9]...)
+	require.EqualValues(t, len(hosts)-4, res.Pending) // subtract two failed hosts, one without profiles and hosts[9] transferred
 	require.Equal(t, uint(2), res.Failed)             // two failed hosts
 	require.Equal(t, uint(0), res.Verifying)          // hosts[9] transferred to new team so is not counted under no team
 	require.Equal(t, uint(0), res.Verified)
@@ -6850,7 +6855,8 @@ func testHostMDMCommands(t *testing.T, ds *Datastore) {
 	}
 
 	badHostID := h.ID + 1
-	allCommands := append(hostCommands, fleet.HostMDMCommand{
+	allCommands := hostCommands
+	allCommands = append(allCommands, fleet.HostMDMCommand{
 		HostID:      badHostID,
 		CommandType: "command-1",
 	})

server/datastore/mysql/calendar_events.go

@@ -98,7 +98,7 @@ func (ds *Datastore) CreateOrUpdateCalendarEvent(
 		return nil, ctxerr.Wrap(ctx, err)
 	}
 
-	calendarEvent, err := getCalendarEventByID(ctx, ds.writer(ctx), uint(id))
+	calendarEvent, err := getCalendarEventByID(ctx, ds.writer(ctx), uint(id)) //nolint:gosec // dismiss G115
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "get created calendar event by id")
 	}

server/datastore/mysql/campaigns.go

@@ -38,7 +38,7 @@ func (ds *Datastore) NewDistributedQueryCampaign(ctx context.Context, camp *flee
 	}
 
 	id, _ := result.LastInsertId()
-	camp.ID = uint(id)
+	camp.ID = uint(id) //nolint:gosec // dismiss G115
 	return camp, nil
 }
 
@@ -130,7 +130,7 @@ func (ds *Datastore) NewDistributedQueryCampaignTarget(ctx context.Context, targ
 	}
 
 	id, _ := result.LastInsertId()
-	target.ID = uint(id)
+	target.ID = uint(id) //nolint:gosec // dismiss G115
 	return target, nil
 }
 
@@ -194,5 +194,5 @@ func (ds *Datastore) CleanupDistributedQueryCampaigns(ctx context.Context, now t
 	if err != nil {
 		return 0, ctxerr.Wrap(ctx, err, "rows affected updating distributed query campaign")
 	}
-	return uint(exp), nil
+	return uint(exp), nil //nolint:gosec // dismiss G115
 }

server/datastore/mysql/campaigns_test.go

@@ -243,7 +243,8 @@ func testCompletedCampaigns(t *testing.T, ds *Datastore) {
 		}
 		filter = append(filter, c1.ID)
 	}
-	for j := filter[len(filter)-1] / 2; j < uint(totalFilterSize); j++ { // some IDs are duplicated
+	for j := filter[len(filter)-1] / 2; j < uint(totalFilterSize); j++ { //nolint:gosec // dismiss G115
+		// some IDs are duplicated
 		filter = append(filter, j)
 	}
 	rand.Shuffle(len(filter), func(i, j int) { filter[i], filter[j] = filter[j], filter[i] })

server/datastore/mysql/carves.go

@@ -179,7 +179,7 @@ func (ds *Datastore) Carve(ctx context.Context, carveId int64) (*fleet.CarveMeta
 	var metadata fleet.CarveMetadata
 	if err := sqlx.GetContext(ctx, ds.reader(ctx), &metadata, stmt, carveId); err != nil {
 		if err == sql.ErrNoRows {
-			return nil, ctxerr.Wrap(ctx, notFound("Carve").WithID(uint(carveId)))
+			return nil, ctxerr.Wrap(ctx, notFound("Carve").WithID(uint(carveId))) //nolint:gosec // dismiss G115
 		}
 		return nil, ctxerr.Wrap(ctx, err, "get carve by ID")
 	}
@@ -280,7 +280,7 @@ func (ds *Datastore) GetBlock(ctx context.Context, metadata *fleet.CarveMetadata
 	var data []byte
 	if err := sqlx.GetContext(ctx, ds.reader(ctx), &data, stmt, metadata.ID, blockId); err != nil {
 		if err == sql.ErrNoRows {
-			return nil, ctxerr.Wrap(ctx, notFound("CarveBlock").WithID(uint(blockId)))
+			return nil, ctxerr.Wrap(ctx, notFound("CarveBlock").WithID(uint(blockId))) //nolint:gosec // dismiss G115
 		}
 		return nil, ctxerr.Wrap(ctx, err, "select data")
 	}

server/datastore/mysql/delete.go

@@ -61,5 +61,5 @@ func (ds *Datastore) deleteEntities(ctx context.Context, dbTable entity, ids []u
 		return 0, ctxerr.Wrapf(ctx, err, "fetching delete entities query rows affected %s", dbTable)
 	}
 
-	return uint(deleted), nil
+	return uint(deleted), nil //nolint:gosec // dismiss G115
 }

server/datastore/mysql/hosts.go

@@ -1216,7 +1216,8 @@ func (ds *Datastore) applyHostFilters(
 	sqlStmt, whereParams, _ = hostSearchLike(sqlStmt, whereParams, opt.MatchQuery, append(hostSearchColumns, "display_name")...)
 	sqlStmt, whereParams = appendListOptionsWithCursorToSQL(sqlStmt, whereParams, &opt.ListOptions)
 
-	params := append(selectParams, joinParams...)
+	params := selectParams
+	params = append(params, joinParams...)
 	params = append(params, whereParams...)
 
 	return sqlStmt, params, nil
@@ -1278,7 +1279,7 @@ func filterHostsByConnectedToFleet(sql string, opt fleet.HostListOptions, params
 }
 
 func filterHostsByOS(sql string, opt fleet.HostListOptions, params []interface{}) (string, []interface{}) {
-	if opt.OSIDFilter != nil {
+	if opt.OSIDFilter != nil { //nolint:gocritic // ignore ifElseChain
 		sql += ` AND hos.os_id = ?`
 		params = append(params, *opt.OSIDFilter)
 	} else if opt.OSNameFilter != nil && opt.OSVersionFilter != nil {

server/datastore/mysql/hosts_test.go

@@ -458,7 +458,7 @@ func testSaveHostPackStatsDB(t *testing.T, ds *Datastore) {
 	})
 	assert.Equal(t, host.PackStats[1].PackName, "test2")
 	// Server calculates WallTimeMs if WallTimeMs==0 coming in. (osquery wall_time -> wall_time_ms -> DB wall_time)
-	stats2[0].WallTime = stats2[0].WallTime * 1000
+	stats2[0].WallTime *= 1000
 	assert.ElementsMatch(t, host.PackStats[1].QueryStats, stats2)
 }
 
@@ -2654,7 +2654,7 @@ func testHostsAddToTeam(t *testing.T, ds *Datastore) {
 		host, err := ds.Host(context.Background(), uint(i))
 		require.NoError(t, err)
 		var expectedID *uint
-		switch {
+		switch { //nolint:gocritic // ignore singleCaseSwitch
 		case i >= 5:
 			expectedID = &team1.ID
 		}

server/datastore/mysql/invites.go

@@ -34,7 +34,7 @@ func (ds *Datastore) NewInvite(ctx context.Context, i *fleet.Invite) (*fleet.Inv
 		}
 
 		id, _ := result.LastInsertId()
-		i.ID = uint(id)
+		i.ID = uint(id) //nolint:gosec // dismiss G115
 
 		if len(i.Teams) == 0 {
 			i.Teams = []fleet.UserTeam{}

server/datastore/mysql/jobs.go

@@ -30,7 +30,7 @@ VALUES (?, ?, ?, ?, ?, COALESCE(?, NOW()))
 	}
 
 	id, _ := result.LastInsertId()
-	job.ID = uint(id)
+	job.ID = uint(id) //nolint:gosec // dismiss G115
 
 	return job, nil
 }

server/datastore/mysql/labels.go

@@ -217,7 +217,7 @@ func (ds *Datastore) NewLabel(ctx context.Context, label *fleet.Label, opts ...f
 	}
 
 	id, _ := result.LastInsertId()
-	label.ID = uint(id)
+	label.ID = uint(id) //nolint:gosec // dismiss G115
 	return label, nil
 }
 

server/datastore/mysql/maintained_apps.go

@@ -54,7 +54,7 @@ ON DUPLICATE KEY UPDATE
 		res, err := tx.ExecContext(ctx, upsertStmt, app.Name, app.Token, app.Version, app.Platform, app.InstallerURL,
 			app.SHA256, app.BundleIdentifier, installScriptID, uninstallScriptID)
 		id, _ := res.LastInsertId()
-		appID = uint(id)
+		appID = uint(id) //nolint:gosec // dismiss G115
 		return ctxerr.Wrap(ctx, err, "upsert maintained app")
 	})
 	if err != nil {
@@ -155,8 +155,8 @@ WHERE NOT EXISTS (
 		return nil, nil, ctxerr.Wrap(ctx, err, "selecting available fleet managed apps")
 	}
 
-	meta := &fleet.PaginationMetadata{HasPreviousResults: opt.Page > 0, TotalResults: uint(counts)}
-	if len(avail) > int(opt.PerPage) {
+	meta := &fleet.PaginationMetadata{HasPreviousResults: opt.Page > 0, TotalResults: uint(counts)} //nolint:gosec // dismiss G115
+	if len(avail) > int(opt.PerPage) {                                                              //nolint:gosec // dismiss G115
 		meta.HasNextResults = true
 		avail = avail[:len(avail)-1]
 	}

server/datastore/mysql/maintained_apps_test.go

@@ -171,7 +171,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err := ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 3)
-	require.Equal(t, int(meta.TotalResults), 3)
+	require.EqualValues(t, meta.TotalResults, 3)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps, apps)
 	require.False(t, meta.HasNextResults)
@@ -179,7 +179,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{PerPage: 1, IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 1)
-	require.Equal(t, int(meta.TotalResults), 3)
+	require.EqualValues(t, meta.TotalResults, 3)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps[:1], apps)
 	require.True(t, meta.HasNextResults)
@@ -187,7 +187,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{PerPage: 1, Page: 1, IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 1)
-	require.Equal(t, int(meta.TotalResults), 3)
+	require.EqualValues(t, meta.TotalResults, 3)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps[1:2], apps)
 	require.True(t, meta.HasNextResults)
@@ -196,7 +196,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{PerPage: 1, Page: 2, IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 1)
-	require.Equal(t, int(meta.TotalResults), 3)
+	require.EqualValues(t, meta.TotalResults, 3)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps[2:3], apps)
 	require.False(t, meta.HasNextResults)
@@ -220,7 +220,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 3)
-	require.Equal(t, int(meta.TotalResults), 3)
+	require.EqualValues(t, meta.TotalResults, 3)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps, apps)
 
@@ -239,7 +239,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 3)
-	require.Equal(t, int(meta.TotalResults), 3)
+	require.EqualValues(t, meta.TotalResults, 3)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps, apps)
 
@@ -258,7 +258,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 3)
-	require.Equal(t, int(meta.TotalResults), 3)
+	require.EqualValues(t, meta.TotalResults, 3)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps, apps)
 
@@ -271,7 +271,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 2)
-	require.Equal(t, int(meta.TotalResults), 2)
+	require.EqualValues(t, meta.TotalResults, 2)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps[1:], apps)
 
@@ -297,7 +297,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 2)
-	require.Equal(t, int(meta.TotalResults), 2)
+	require.EqualValues(t, meta.TotalResults, 2)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps[1:], apps)
 
@@ -318,7 +318,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 2)
-	require.Equal(t, int(meta.TotalResults), 2)
+	require.EqualValues(t, meta.TotalResults, 2)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps[1:], apps)
 
@@ -329,7 +329,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 1)
-	require.Equal(t, int(meta.TotalResults), 1)
+	require.EqualValues(t, meta.TotalResults, 1)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps[2:], apps)
 
@@ -351,7 +351,7 @@ func testListAvailableApps(t *testing.T, ds *Datastore) {
 	apps, meta, err = ds.ListAvailableFleetMaintainedApps(ctx, team1.ID, fleet.ListOptions{IncludeMetadata: true})
 	require.NoError(t, err)
 	require.Len(t, apps, 1)
-	require.Equal(t, int(meta.TotalResults), 1)
+	require.EqualValues(t, meta.TotalResults, 1)
 	assertUpdatedAt(apps)
 	require.Equal(t, expectedApps[2:], apps)
 }

server/datastore/mysql/mdm.go

@@ -241,7 +241,7 @@ FROM (
 	var metaData *fleet.PaginationMetadata
 	if opt.IncludeMetadata {
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.Page > 0}
-		if len(profs) > int(opt.PerPage) {
+		if len(profs) > int(opt.PerPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			profs = profs[:len(profs)-1]
 		}
@@ -375,7 +375,7 @@ func (ds *Datastore) bulkSetPendingMDMHostProfilesDB(
 
 		// split into mac and win profiles
 		for _, puid := range profileUUIDs {
-			if strings.HasPrefix(puid, fleet.MDMAppleProfileUUIDPrefix) {
+			if strings.HasPrefix(puid, fleet.MDMAppleProfileUUIDPrefix) { //nolint:gocritic // ignore ifElseChain
 				macProfUUIDs = append(macProfUUIDs, puid)
 			} else if strings.HasPrefix(puid, fleet.MDMAppleDeclarationUUIDPrefix) {
 				hasAppleDecls = true
@@ -1104,7 +1104,8 @@ func batchSetProfileLabelAssociationsDB(
 	for k := range setProfileUUIDs {
 		profUUIDs = append(profUUIDs, k)
 	}
-	deleteArgs := append(deleteParams, profUUIDs)
+	deleteArgs := deleteParams
+	deleteArgs = append(deleteArgs, profUUIDs)
 
 	deleteStmt, args, err := sqlx.In(deleteStmt, deleteArgs...)
 	if err != nil {

server/datastore/mysql/mdm_test.go

@@ -1114,7 +1114,8 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Error(t, err)
 
 	// bulk set for all created hosts, no profiles yet so nothing changed
-	allHosts := append(darwinHosts, unenrolledHost, linuxHost)
+	allHosts := darwinHosts
+	allHosts = append(allHosts, unenrolledHost, linuxHost)
 	allHosts = append(allHosts, windowsHosts...)
 	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
 	require.NoError(t, err)

server/datastore/mysql/migrations/tables/20171116163618_CreateTableOsqueryOptions.go

@@ -4,7 +4,6 @@ import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
-	"strconv"
 
 	"github.com/jmoiron/sqlx"
 	"github.com/jmoiron/sqlx/reflectx"
@@ -128,7 +127,7 @@ func migrateOptions(tx *sql.Tx) error {
 		case decoratorAlways:
 			decConfig.Always = append(decConfig.Always, dec.Query)
 		case decoratorInterval:
-			key := strconv.Itoa(int(dec.Interval))
+			key := fmt.Sprint(dec.Interval)
 			decConfig.Interval[key] = append(decConfig.Interval[key], dec.Query)
 		default:
 			fmt.Printf("Unable to migrate decorator. Please migrate manually: '%s'\n", dec.Query)

server/datastore/mysql/migrations/tables/20210601000008_TeamsEnrollSecrets.go

@@ -32,10 +32,10 @@ func Up_20210601000008(tx *sql.Tx) error {
 
 	// ********* TEST ONLY BEGIN *********
 	// This will make an enroll secrets test fail because it should end up with one unexpected secret
-	//if _, err := tx.Exec(
+	// if _, err := tx.Exec(
 	//	`INSERT INTO enroll_secrets (secret, name) VALUES ('aaaa', '1'), ('aaaa', '2'), ('aaaa', '3')`); err != nil {
 	//	return errors.Wrap(err, "add red hat label")
-	//}
+	// }
 	// ********* TEST ONLY ENDS  *********
 
 	//nolint

server/datastore/mysql/migrations/tables/20220323152301_CleanupHostRelatedTables_test.go

@@ -105,7 +105,7 @@ func createHostsWithSoftware(t *testing.T, db *sqlx.DB) []*fleet.Host {
 		)
 		require.NoError(t, err)
 		id, _ := res.LastInsertId()
-		host.ID = uint(id)
+		host.ID = uint(id) //nolint:gosec // dismiss G115
 		hosts[i] = host
 	}
 
@@ -124,7 +124,7 @@ func createHostsWithSoftware(t *testing.T, db *sqlx.DB) []*fleet.Host {
 		res, err := db.Exec(insSw, sw.Name, sw.Version, sw.Source, sw.Release, sw.Vendor, sw.Arch, sw.BundleIdentifier)
 		require.NoError(t, err)
 		id, _ := res.LastInsertId()
-		sw.ID = uint(id)
+		sw.ID = uint(id) //nolint:gosec // dismiss G115
 	}
 
 	for _, host := range hosts {

server/datastore/mysql/migrations/tables/20230425082126_AddMDMAppleSetupAssistants_test.go

@@ -34,7 +34,8 @@ func TestUp_20230425082126(t *testing.T) {
 	var asst assistant
 	err = db.Get(&asst, `SELECT id, name, profile, team_id, global_or_team_id FROM mdm_apple_setup_assistants WHERE id = ?`, id)
 	require.NoError(t, err)
-	require.Equal(t, assistant{ID: uint(id), Name: "Test", Profile: "{}", TeamID: nil, GlobalOrTeamID: 0}, asst)
+	require.Equal(t, assistant{ID: uint(id), Name: "Test", Profile: "{}", TeamID: nil, GlobalOrTeamID: 0}, //nolint:gosec // dismiss G115
+		asst)
 
 	// create a team
 	r, err = db.Exec(`INSERT INTO teams (name) VALUES (?)`, "Test Team")
@@ -48,7 +49,8 @@ func TestUp_20230425082126(t *testing.T) {
 
 	err = db.Get(&asst, `SELECT id, name, profile, team_id, global_or_team_id FROM mdm_apple_setup_assistants WHERE id = ?`, id2)
 	require.NoError(t, err)
-	require.Equal(t, assistant{ID: uint(id2), Name: "Test2", Profile: "{}", TeamID: ptr.Uint(uint(tmID)), GlobalOrTeamID: uint(tmID)}, asst)
+	require.Equal(t, assistant{ID: uint(id2), Name: "Test2", Profile: "{}", TeamID: ptr.Uint(uint(tmID)), //nolint:gosec // dismiss G115
+		GlobalOrTeamID: uint(tmID)}, asst) //nolint:gosec // dismiss G115
 
 	// delete the team, that deletes the row
 	_, err = db.Exec(`DELETE FROM teams WHERE id = ?`, tmID)

server/datastore/mysql/migrations/tables/20230501154913_AlterMDMAppleSetupAssistantsAddProfileUUID_test.go

@@ -24,7 +24,7 @@ func TestUp_20230501154913(t *testing.T) {
 	var asst assistant
 	err = db.Get(&asst, `SELECT id, name, profile_uuid FROM mdm_apple_setup_assistants WHERE id = ?`, id)
 	require.NoError(t, err)
-	require.Equal(t, assistant{ID: uint(id), Name: "Test", ProfileUUID: ""}, asst)
+	require.Equal(t, assistant{ID: uint(id), Name: "Test", ProfileUUID: ""}, asst) //nolint:gosec // dismiss G115
 
 	// create a team
 	r, err = db.Exec(`INSERT INTO teams (name) VALUES (?)`, "Test Team")
@@ -38,5 +38,5 @@ func TestUp_20230501154913(t *testing.T) {
 
 	err = db.Get(&asst, `SELECT id, name, profile_uuid FROM mdm_apple_setup_assistants WHERE id = ?`, id)
 	require.NoError(t, err)
-	require.Equal(t, assistant{ID: uint(id), Name: "Test2", ProfileUUID: "abc"}, asst)
+	require.Equal(t, assistant{ID: uint(id), Name: "Test2", ProfileUUID: "abc"}, asst) //nolint:gosec // dismiss G115
 }

server/datastore/mysql/migrations/tables/20230503101418_AlterJobsAddNotBefore_test.go

@@ -30,5 +30,5 @@ func TestUp_20230503101418(t *testing.T) {
 	require.NotZero(t, j.NotBefore)
 	j.UpdatedAt = time.Time{}
 	j.NotBefore = time.Time{}
-	require.Equal(t, job{ID: uint(id), Name: "Test"}, j)
+	require.Equal(t, job{ID: uint(id), Name: "Test"}, j) //nolint:gosec // dismiss G115
 }

server/datastore/mysql/migrations/tables/20230515144206_AddMDMAppleDefaultSetupAssistants_test.go

@@ -24,7 +24,7 @@ func TestUp_20230515144206(t *testing.T) {
 
 	err = db.Get(&asst, `SELECT id, profile_uuid FROM mdm_apple_default_setup_assistants WHERE id = ?`, id)
 	require.NoError(t, err)
-	require.Equal(t, assistant{ID: uint(id), ProfileUUID: "abc"}, asst)
+	require.Equal(t, assistant{ID: uint(id), ProfileUUID: "abc"}, asst) //nolint:gosec // dismiss G115
 
 	// create a team
 	r, err = db.Exec(`INSERT INTO teams (name) VALUES (?)`, "Test Team")
@@ -38,5 +38,5 @@ func TestUp_20230515144206(t *testing.T) {
 
 	err = db.Get(&asst, `SELECT id, profile_uuid FROM mdm_apple_default_setup_assistants WHERE id = ?`, id)
 	require.NoError(t, err)
-	require.Equal(t, assistant{ID: uint(id), ProfileUUID: "def"}, asst)
+	require.Equal(t, assistant{ID: uint(id), ProfileUUID: "def"}, asst) //nolint:gosec // dismiss G115
 }

server/datastore/mysql/migrations/tables/20230608103123_CleanupOrphanedMDMAppleConfigurationProfiles_test.go

@@ -31,5 +31,5 @@ func TestUp_20230608103123(t *testing.T) {
 	var teamIDs []uint
 	err = db.Select(&teamIDs, "SELECT team_id FROM mdm_apple_configuration_profiles GROUP BY team_id")
 	require.NoError(t, err)
-	require.ElementsMatch(t, []uint{0, uint(tmID)}, teamIDs)
+	require.ElementsMatch(t, []uint{0, uint(tmID)}, teamIDs) //nolint:gosec // dismiss G115
 }

server/datastore/mysql/migrations/tables/20240131083822_AddUniqueHashToPolicies_test.go

@@ -2,8 +2,9 @@ package tables
 
 import (
 	"context"
-	"github.com/stretchr/testify/require"
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
 func TestUp_20240131083822(t *testing.T) {
@@ -38,7 +39,7 @@ func TestUp_20240131083822(t *testing.T) {
 
 	gotIDs := make([]int64, len(wantIDs))
 	for i, pc := range policyCheck {
-		if pc.ID == policy1 {
+		if pc.ID == policy1 { //nolint:gocritic // ignore ifelseChain
 			require.Equal(t, pc.Name, "policy1")
 		} else if pc.ID == policy2 {
 			require.Equal(t, pc.Name, "policy2")

server/datastore/mysql/migrations/tables/20240221112844_FixUniquePolicyNameBug_test.go

@@ -5,11 +5,12 @@ import (
 	"crypto/md5" //nolint:gosec // (only used for tests)
 	"encoding/hex"
 	"fmt"
+	"strings"
+	"testing"
+
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"strings"
-	"testing"
 )
 
 func TestUp_20240221112844(t *testing.T) {
@@ -69,7 +70,7 @@ func TestUp_20240221112844(t *testing.T) {
 
 	gotIDs := make([]int64, len(wantIDs))
 	for i, pc := range policyCheck {
-		if pc.ID == policy1 {
+		if pc.ID == policy1 { //nolint:gocritic // ignore ifelseChain
 			assert.Equal(t, "policy", pc.Name)
 		} else if pc.ID == policy2 {
 			assert.Equal(t, "policy3", pc.Name) // name changed

server/datastore/mysql/migrations/tables/20240222073518_AddCertInfoToNanoCertAssociations_test.go

@@ -57,7 +57,7 @@ func TestUp_20240222073518(t *testing.T) {
 	require.Equal(t, sha1, assoc.SHA256)
 	require.Equal(t, threeDaysAgo, assoc.CreatedAt)
 	require.Equal(t, threeDaysAgo, assoc.UpdatedAt)
-	require.Equal(t, "2025-02-20 19:57:24", (*assoc.CertNotValidAfter).Format("2006-01-02 15:04:05"))
+	require.Equal(t, "2025-02-20 19:57:24", assoc.CertNotValidAfter.Format("2006-01-02 15:04:05"))
 	require.Nil(t, assoc.RenewCommandUUID)
 
 	err = sqlx.Get(db, &assoc, selectStmt, "uuid-2")
@@ -66,7 +66,7 @@ func TestUp_20240222073518(t *testing.T) {
 	require.Equal(t, sha2, assoc.SHA256)
 	require.Equal(t, threeDaysAgo, assoc.CreatedAt)
 	require.Equal(t, threeDaysAgo, assoc.UpdatedAt)
-	require.Equal(t, "2025-02-20 19:57:25", (*assoc.CertNotValidAfter).Format("2006-01-02 15:04:05"))
+	require.Equal(t, "2025-02-20 19:57:25", assoc.CertNotValidAfter.Format("2006-01-02 15:04:05"))
 	require.Nil(t, assoc.RenewCommandUUID)
 
 	err = sqlx.Get(db, &assoc, selectStmt, "uuid-3")
@@ -75,7 +75,7 @@ func TestUp_20240222073518(t *testing.T) {
 	require.Equal(t, sha2, assoc.SHA256)
 	require.Equal(t, threeDaysAgo, assoc.CreatedAt)
 	require.Equal(t, threeDaysAgo, assoc.UpdatedAt)
-	require.Equal(t, "2025-02-20 19:57:25", (*assoc.CertNotValidAfter).Format("2006-01-02 15:04:05"))
+	require.Equal(t, "2025-02-20 19:57:25", assoc.CertNotValidAfter.Format("2006-01-02 15:04:05"))
 	require.Nil(t, assoc.RenewCommandUUID)
 
 	// creating a new association sets NULL as default values

server/datastore/mysql/migrations/tables/20240302111134_AddScriptContentsTableAndRelationships.go

@@ -227,7 +227,7 @@ func createScriptContentsEntries(txx *sqlx.Tx, stmtTable, stmt string, scriptCon
 					return fmt.Errorf("create script_contents from %s: %w", stmtTable, err)
 				}
 				id, _ := res.LastInsertId()
-				scriptContentsIDLookup[hexChecksum] = uint(id)
+				scriptContentsIDLookup[hexChecksum] = uint(id) //nolint:gosec // dismiss G115
 			}
 		}
 	}

server/datastore/mysql/migrations/tables/20240314085226_AddCalendarEventTables_test.go

@@ -18,7 +18,7 @@ func TestUp_20240314085226(t *testing.T) {
 		EndTime:   time.Now().UTC().Add(30 * time.Minute),
 		Data:      []byte("{\"foo\": \"bar\"}"),
 	}
-	sampleEvent.ID = uint(execNoErrLastID(t, db,
+	sampleEvent.ID = uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 		`INSERT INTO calendar_events (email, start_time, end_time, event) VALUES (?, ?, ?, ?);`,
 		sampleEvent.Email, sampleEvent.StartTime, sampleEvent.EndTime, sampleEvent.Data,
 	))
@@ -28,7 +28,7 @@ func TestUp_20240314085226(t *testing.T) {
 		CalendarEventID: sampleEvent.ID,
 		WebhookStatus:   fleet.CalendarWebhookStatusPending,
 	}
-	sampleHostEvent.ID = uint(execNoErrLastID(t, db,
+	sampleHostEvent.ID = uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 		`INSERT INTO host_calendar_events (host_id, calendar_event_id, webhook_status) VALUES (?, ?, ?);`,
 		sampleHostEvent.HostID, sampleHostEvent.CalendarEventID, sampleHostEvent.WebhookStatus,
 	))

server/datastore/mysql/migrations/tables/20240430111727_CleanupQueryResults_test.go

@@ -13,7 +13,7 @@ func TestUp_20240430111727(t *testing.T) {
 
 	hostID := 1
 	newTeam := func(name string) uint {
-		return uint(execNoErrLastID(t, db,
+		return uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 			`INSERT INTO teams (name) VALUES (?);`,
 			name,
 		))
@@ -21,13 +21,13 @@ func TestUp_20240430111727(t *testing.T) {
 	newHost := func(teamID *uint) uint {
 		id := fmt.Sprintf("%d", hostID)
 		hostID++
-		return uint(execNoErrLastID(t, db,
+		return uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 			`INSERT INTO hosts (osquery_host_id, node_key, team_id) VALUES (?, ?, ?);`,
 			id, id, teamID,
 		))
 	}
 	newQuery := func(name string, teamID *uint) uint {
-		return uint(execNoErrLastID(t, db,
+		return uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 			`INSERT INTO queries (name, description, logging_type, team_id, query, saved) VALUES (?, '', 'snapshot', ?, 'SELECT 1;', 1);`,
 			name, teamID,
 		))

server/datastore/mysql/migrations/tables/20240626195531_AddTimezoneToCalendarEvents_test.go

@@ -18,7 +18,7 @@ func TestUp_20240626195531(t *testing.T) {
 		EndTime:   time.Now().UTC().Add(30 * time.Minute),
 		Data:      []byte("{\"foo\": \"bar\"}"),
 	}
-	sampleEvent.ID = uint(execNoErrLastID(t, db,
+	sampleEvent.ID = uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 		`INSERT INTO calendar_events (email, start_time, end_time, event) VALUES (?, ?, ?, ?);`,
 		sampleEvent.Email, sampleEvent.StartTime, sampleEvent.EndTime, sampleEvent.Data,
 	))
@@ -28,7 +28,7 @@ func TestUp_20240626195531(t *testing.T) {
 		CalendarEventID: sampleEvent.ID,
 		WebhookStatus:   fleet.CalendarWebhookStatusPending,
 	}
-	sampleHostEvent.ID = uint(execNoErrLastID(t, db,
+	sampleHostEvent.ID = uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 		`INSERT INTO host_calendar_events (host_id, calendar_event_id, webhook_status) VALUES (?, ?, ?);`,
 		sampleHostEvent.HostID, sampleHostEvent.CalendarEventID, sampleHostEvent.WebhookStatus,
 	))

server/datastore/mysql/migrations/tables/20240707134035_AddUUIDToCalendarEvents_test.go

@@ -15,8 +15,8 @@ func TestUp_20240707134035(t *testing.T) {
 	endTime := time.Now().UTC().Add(30 * time.Minute)
 	data := []byte("{\"foo\": \"bar\"}")
 	const insertStmt = `INSERT INTO calendar_events (email, start_time, end_time, event) VALUES (?, ?, ?, ?)`
-	event1ID := uint(execNoErrLastID(t, db, insertStmt, "foo@example.com", startTime, endTime, data))
-	event2ID := uint(execNoErrLastID(t, db, insertStmt, "bar@example.com", startTime, endTime, data))
+	event1ID := uint(execNoErrLastID(t, db, insertStmt, "foo@example.com", startTime, endTime, data)) //nolint:gosec // dismiss G115
+	event2ID := uint(execNoErrLastID(t, db, insertStmt, "bar@example.com", startTime, endTime, data)) //nolint:gosec // dismiss G115
 
 	// Apply current migration.
 	applyNext(t, db)

server/datastore/mysql/migrations/tables/20240707134036_CreateIOSAndIPADOSBuiltinLabels.go

@@ -101,9 +101,9 @@ func createBuiltinManualIOSAndIPadOSLabels(tx *sql.Tx) (iOSLabelID uint, iPadOSL
 		}
 		labelID, _ := res.LastInsertId()
 		if label.name == fleet.BuiltinLabelIOS {
-			iOSLabelID = uint(labelID)
+			iOSLabelID = uint(labelID) //nolint:gosec // dismiss G115
 		} else {
-			iPadOSLabelID = uint(labelID)
+			iPadOSLabelID = uint(labelID) //nolint:gosec // dismiss G115
 		}
 	}
 	return iOSLabelID, iPadOSLabelID, nil

server/datastore/mysql/migrations/tables/20240707134036_CreateIOSAndIPADOSBuiltinLabels_test.go

@@ -16,7 +16,7 @@ func TestUp_20240707134036(t *testing.T) {
 	newHost := func(platform, uuid string) uint {
 		id := fmt.Sprintf("%d", hostID)
 		hostID++
-		return uint(execNoErrLastID(t, db,
+		return uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 			`INSERT INTO hosts (osquery_host_id, node_key, uuid, platform) VALUES (?, ?, ?, ?);`,
 			id, id, uuid, platform,
 		))

server/datastore/mysql/migrations/tables/20240710155623_FixResetLastEnrolledAt_test.go

@@ -15,7 +15,7 @@ func TestUp_20240710155623(t *testing.T) {
 	newHost := func(platform, lastEnrolledAt string, hostDisk bool) uint {
 		id := fmt.Sprintf("%d", i)
 		i++
-		hostID := uint(execNoErrLastID(t, db,
+		hostID := uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 			`INSERT INTO hosts (osquery_host_id, node_key, uuid, platform, last_enrolled_at) VALUES (?, ?, ?, ?, ?);`,
 			id, id, id, platform, lastEnrolledAt,
 		))

server/datastore/mysql/migrations/tables/20240730174056_AddGlobalStatToSoftwareHostCounts_test.go

@@ -56,7 +56,7 @@ func TestUp_20240730174056(t *testing.T) {
 		res := db.QueryRow("SELECT `software_id`, `hosts_count`, `team_id`, `global_stats` FROM `software_host_counts` WHERE `software_id` = ? AND `team_id` = ? AND global_stats = ?", softwareID, teamID, globalStats)
 		err = res.Scan(&result.SoftwareID, &result.HostsCount, &result.TeamID, &result.GlobalStats)
 		require.NoError(t, err)
-		require.Equal(t, softwareID, int(result.SoftwareID))
+		require.EqualValues(t, softwareID, result.SoftwareID)
 		require.Equal(t, hostsCount, result.HostsCount)
 		require.Equal(t, teamID, result.TeamID)
 		require.Equal(t, globalStats, result.GlobalStats)

server/datastore/mysql/migrations/tables/20240730215453_AddGlobalStatToSoftwareTitleHostCounts_test.go

@@ -56,7 +56,7 @@ func TestUp_20240730215453(t *testing.T) {
 		res := db.QueryRow("SELECT `software_title_id`, `hosts_count`, `team_id`, `global_stats` FROM `software_titles_host_counts` WHERE `software_title_id` = ? AND `team_id` = ? AND global_stats = ?", softwareID, teamID, globalStats)
 		err = res.Scan(&result.SoftwareID, &result.HostsCount, &result.TeamID, &result.GlobalStats)
 		require.NoError(t, err)
-		require.Equal(t, softwareID, int(result.SoftwareID))
+		require.EqualValues(t, softwareID, result.SoftwareID)
 		require.Equal(t, hostsCount, result.HostsCount)
 		require.Equal(t, teamID, result.TeamID)
 		require.Equal(t, globalStats, result.GlobalStats)

server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens_test.go

@@ -72,7 +72,7 @@ func TestUp_20240829165448(t *testing.T) {
 		tmID := execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES (?)`, "team1")
 
 		// create a host with a DEP assignment
-		hostID := insertHost(t, db, ptr.Uint(uint(tmID)))
+		hostID := insertHost(t, db, ptr.Uint(uint(tmID))) //nolint:gosec // dismiss G115
 		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
 
 		// Apply current migration.
@@ -132,7 +132,7 @@ LIMIT 1`)
 		tmID := execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES (?)`, "team1")
 
 		// create a host with a DEP assignment
-		hostID := insertHost(t, db, ptr.Uint(uint(tmID)))
+		hostID := insertHost(t, db, ptr.Uint(uint(tmID))) //nolint:gosec // dismiss G115
 		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
 
 		// Apply current migration.

server/datastore/mysql/migrations/tables/20240905200001_AddPoliciesToNoTeam_test.go

@@ -10,12 +10,12 @@ import (
 func TestUp_20240905200001(t *testing.T) {
 	db := applyUpToPrev(t)
 
-	team1ID := uint(execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES ('team1');`))
-	globalPolicy0 := uint(execNoErrLastID(t, db,
+	team1ID := uint(execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES ('team1');`)) //nolint:gosec // dismiss G115
+	globalPolicy0 := uint(execNoErrLastID(t, db,                                          //nolint:gosec // dismiss G115
 		`INSERT INTO policies (name, query, description, checksum) VALUES
 		('globalPolicy0', 'SELECT 0', 'Description', 'checksum');`,
 	))
-	policy1Team1 := uint(execNoErrLastID(t, db,
+	policy1Team1 := uint(execNoErrLastID(t, db, //nolint:gosec // dismiss G115
 		`INSERT INTO policies (name, query, description, team_id, checksum)
 		VALUES ('policy1Team1', 'SELECT 1', 'Description', ?, 'checksum2');`,
 		team1ID,

server/datastore/mysql/migrations/tables/20241002104104_UpdateUninstallScript.go

@@ -80,7 +80,7 @@ ON DUPLICATE KEY UPDATE
 			return 0, fmt.Errorf("get last insert ID: %w", err)
 		}
 
-		return uint(newID), nil
+		return uint(newID), nil //nolint:gosec // dismiss G115
 	}
 
 	// Go to script contents and check if it is the default uninstall script

server/datastore/mysql/migrations/tables/deprecated_types.go

@@ -90,8 +90,7 @@ func (ov *optionValue) Scan(src interface{}) error {
 	if err := json.Unmarshal(src.([]byte), &ov.Val); err != nil {
 		return err
 	}
-	switch v := ov.Val.(type) {
-	case float64:
+	if v, ok := ov.Val.(float64); ok {
 		ov.Val = int(v)
 	}
 	return nil

server/datastore/mysql/migrations/tables/migration_test.go

@@ -151,7 +151,7 @@ func insertQuery(t *testing.T, db *sqlx.DB) uint {
 	id, err := res.LastInsertId()
 	require.NoError(t, err)
 
-	return uint(id)
+	return uint(id) //nolint:gosec // dismiss G115
 }
 
 func insertHost(t *testing.T, db *sqlx.DB, teamID *uint) uint {
@@ -187,7 +187,7 @@ func insertHost(t *testing.T, db *sqlx.DB, teamID *uint) uint {
 	id, err := res.LastInsertId()
 	require.NoError(t, err)
 
-	return uint(id)
+	return uint(id) //nolint:gosec // dismiss G115
 }
 
 func assertRowCount(t *testing.T, db *sqlx.DB, table string, count int) {

server/datastore/mysql/mysql.go

@@ -886,7 +886,7 @@ func (ds *Datastore) whereFilterHostsByTeams(filter fleet.TeamFilter, hostKey st
 			team.Role == fleet.RoleMaintainer ||
 			team.Role == fleet.RoleObserverPlus ||
 			(team.Role == fleet.RoleObserver && filter.IncludeObserver) {
-			idStrs = append(idStrs, strconv.Itoa(int(team.ID)))
+			idStrs = append(idStrs, fmt.Sprint(team.ID))
 			if filter.TeamID != nil && *filter.TeamID == team.ID {
 				teamIDSeen = true
 			}
@@ -962,7 +962,7 @@ func (ds *Datastore) whereFilterGlobalOrTeamIDByTeamsWithSqlFilter(
 			team.Role == fleet.RoleMaintainer ||
 			team.Role == fleet.RoleObserverPlus ||
 			(team.Role == fleet.RoleObserver && filter.IncludeObserver) {
-			idStrs = append(idStrs, strconv.Itoa(int(team.ID)))
+			idStrs = append(idStrs, fmt.Sprint(team.ID))
 			if filter.TeamID != nil && *filter.TeamID == team.ID {
 				teamIDSeen = true
 			}
@@ -1021,7 +1021,7 @@ func (ds *Datastore) whereFilterTeams(filter fleet.TeamFilter, teamKey string) s
 			team.Role == fleet.RoleGitOps ||
 			team.Role == fleet.RoleObserverPlus ||
 			(team.Role == fleet.RoleObserver && filter.IncludeObserver) {
-			idStrs = append(idStrs, strconv.Itoa(int(team.ID)))
+			idStrs = append(idStrs, fmt.Sprint(team.ID))
 		}
 	}
 
@@ -1042,7 +1042,7 @@ func (ds *Datastore) whereOmitIDs(colName string, omit []uint) string {
 
 	var idStrs []string
 	for _, id := range omit {
-		idStrs = append(idStrs, strconv.Itoa(int(id)))
+		idStrs = append(idStrs, fmt.Sprint(id))
 	}
 
 	return fmt.Sprintf("%s NOT IN (%s)", colName, strings.Join(idStrs, ","))
@@ -1132,8 +1132,8 @@ type patternReplacer func(string) string
 
 // likePattern returns a pattern to match m with LIKE.
 func likePattern(m string) string {
-	m = strings.Replace(m, "_", "\\_", -1)
-	m = strings.Replace(m, "%", "\\%", -1)
+	m = strings.ReplaceAll(m, "_", "\\_")
+	m = strings.ReplaceAll(m, "%", "\\%")
 	return "%" + m + "%"
 }
 
@@ -1322,7 +1322,7 @@ func (ds *Datastore) optimisticGetOrInsertWithWriter(ctx context.Context, writer
 				return 0, ctxerr.Wrap(ctx, err, "insert")
 			}
 			id, _ := res.LastInsertId()
-			return uint(id), nil
+			return uint(id), nil //nolint:gosec // dismiss G115
 		}
 		return 0, ctxerr.Wrap(ctx, err, "get id from reader")
 	}

server/datastore/mysql/operating_systems_test.go

@@ -160,7 +160,7 @@ func TestUniqueOS(t *testing.T) {
 	for i := range testHostIDs {
 		wg.Add(1)
 		go func(id int) {
-			err := ds.UpdateHostOperatingSystem(ctx, uint(id), testOS)
+			err := ds.UpdateHostOperatingSystem(ctx, uint(id), testOS) //nolint:gosec // dismiss G115
 			assert.NoError(t, err)
 			wg.Done()
 		}(i)

server/datastore/mysql/packs.go

@@ -272,7 +272,7 @@ func (ds *Datastore) NewPack(ctx context.Context, pack *fleet.Pack, opts ...flee
 		}
 
 		id, _ := result.LastInsertId()
-		pack.ID = uint(id)
+		pack.ID = uint(id) //nolint:gosec // dismiss G115
 
 		if err := replacePackTargetsDB(ctx, tx, pack); err != nil {
 			return err

server/datastore/mysql/password_reset.go

@@ -25,7 +25,7 @@ func (ds *Datastore) NewPasswordResetRequest(ctx context.Context, req *fleet.Pas
 	}
 
 	id, _ := response.LastInsertId()
-	req.ID = uint(id)
+	req.ID = uint(id) //nolint:gosec // dismiss G115
 	return req, nil
 }
 

server/datastore/mysql/password_reset_test.go

@@ -95,7 +95,7 @@ func testPasswordResetTokenExpiration(t *testing.T, ds *Datastore) {
 		require.NoError(t, err)
 
 		id, _ := res.LastInsertId()
-		req.ID = uint(id)
+		req.ID = uint(id) //nolint:gosec // dismiss G115
 
 		found, err := ds.FindPasswordResetByToken(context.Background(), req.Token)
 

server/datastore/mysql/policies.go

@@ -70,7 +70,7 @@ func (ds *Datastore) NewGlobalPolicy(ctx context.Context, authorID *uint, args f
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "getting last id after inserting policy")
 	}
-	return policyDB(ctx, ds.writer(ctx), uint(lastIdInt64), nil)
+	return policyDB(ctx, ds.writer(ctx), uint(lastIdInt64), nil) //nolint:gosec // dismiss G115
 }
 
 func policiesChecksumComputedColumn() string {
@@ -461,7 +461,7 @@ func listPoliciesDB(ctx context.Context, q sqlx.QueryerContext, teamID *uint, op
 
 // getInheritedPoliciesForTeam returns the list of global policies with the
 // passing and failing host counts for the provided teamID
-func getInheritedPoliciesForTeam(ctx context.Context, q sqlx.QueryerContext, TeamID uint, opts fleet.ListOptions) ([]*fleet.Policy, error) {
+func getInheritedPoliciesForTeam(ctx context.Context, q sqlx.QueryerContext, teamID uint, opts fleet.ListOptions) ([]*fleet.Policy, error) {
 	var args []interface{}
 
 	query := `
@@ -478,7 +478,7 @@ func getInheritedPoliciesForTeam(ctx context.Context, q sqlx.QueryerContext, Tea
         WHERE p.team_id IS NULL
     `
 
-	args = append(args, TeamID)
+	args = append(args, teamID)
 
 	// We must normalize the name for full Unicode support (Unicode equivalence).
 	match := norm.NFC.String(opts.MatchQuery)
@@ -685,7 +685,7 @@ func (ds *Datastore) NewTeamPolicy(ctx context.Context, teamID uint, authorID *u
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "getting last id after inserting policy")
 	}
-	return policyDB(ctx, ds.writer(ctx), uint(lastIdInt64), &teamID)
+	return policyDB(ctx, ds.writer(ctx), uint(lastIdInt64), &teamID) //nolint:gosec // dismiss G115
 }
 
 func (ds *Datastore) ListTeamPolicies(ctx context.Context, teamID uint, opts fleet.ListOptions, iopts fleet.ListOptions) (teamPolicies, inheritedPolicies []*fleet.Policy, err error) {
@@ -931,7 +931,8 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 							}
 						}
 						if err = cleanupPolicy(
-							ctx, tx, tx, uint(lastID), spec.Platform, shouldRemoveAllPolicyMemberships, removePolicyStats, ds.logger,
+							ctx, tx, tx, uint(lastID), spec.Platform, shouldRemoveAllPolicyMemberships, //nolint:gosec // dismiss G115
+							removePolicyStats, ds.logger,
 						); err != nil {
 							return err
 						}
@@ -1422,7 +1423,7 @@ func amountPolicyViolationDaysDB(ctx context.Context, tx sqlx.QueryerContext) (i
 		return 0, 0, ctxerr.Wrap(ctx, err, "unmarshal policy violation counts")
 	}
 
-	return int(counts.FailingHostCount), int(counts.TotalHostCount), nil
+	return int(counts.FailingHostCount), int(counts.TotalHostCount), nil //nolint:gosec // dismiss G115
 }
 
 func (ds *Datastore) UpdateHostPolicyCounts(ctx context.Context) error {

server/datastore/mysql/policies_test.go

@@ -889,7 +889,7 @@ type expectedPolicyResults struct {
 func expectedPolicyQueries(policies ...*fleet.Policy) expectedPolicyResults {
 	queries := make(map[string]string)
 	for _, policy := range policies {
-		queries[strconv.Itoa(int(policy.ID))] = policy.Query
+		queries[fmt.Sprint(policy.ID)] = policy.Query
 	}
 	hostPolicies := make([]*fleet.HostPolicy, len(policies))
 	for i := range policies {
@@ -1208,7 +1208,9 @@ func testPolicyQueriesForHost(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	id, err := res.LastInsertId()
 	require.NoError(t, err)
-	require.NoError(t, ds.RecordPolicyQueryExecutions(context.Background(), host2, map[uint]*bool{uint(id): nil}, time.Now(), false))
+	require.NoError(t,
+		ds.RecordPolicyQueryExecutions(context.Background(), host2, map[uint]*bool{uint(id): nil}, //nolint:gosec // dismiss G115
+			time.Now(), false))
 
 	policies, err = ds.ListPoliciesForHost(context.Background(), host2)
 	require.NoError(t, err)
@@ -2633,7 +2635,7 @@ func testPolicyViolationDays(t *testing.T, ds *Datastore) {
 	res, err := ds.writer(ctx).ExecContext(ctx, createPolStmt, "test_pol", "select 1", user.ID, "", then, then)
 	require.NoError(t, err)
 	id, _ := res.LastInsertId()
-	pol, err := ds.Policy(ctx, uint(id))
+	pol, err := ds.Policy(ctx, uint(id)) //nolint:gosec // dismiss G115
 	require.NoError(t, err)
 
 	require.NoError(t, ds.InitializePolicyViolationDays(ctx)) // sets starting violation count to zero
@@ -2739,7 +2741,7 @@ func testPolicyCleanupPolicyMembership(t *testing.T, ds *Datastore) {
 		res, err := ds.writer(ctx).ExecContext(ctx, createPolStmt, "p"+strconv.Itoa(i+1), "select 1", user.ID, "", dt, dt)
 		require.NoError(t, err)
 		id, _ := res.LastInsertId()
-		pol, err := ds.Policy(ctx, uint(id))
+		pol, err := ds.Policy(ctx, uint(id)) //nolint:gosec // dismiss G115
 		require.NoError(t, err)
 		pols[i] = pol
 	}

server/datastore/mysql/queries.go

@@ -241,7 +241,7 @@ func (ds *Datastore) NewQuery(
 	}
 
 	id, _ := result.LastInsertId()
-	query.ID = uint(id)
+	query.ID = uint(id) //nolint:gosec // dismiss G115
 	query.Packs = []fleet.Pack{}
 	return query, nil
 }

server/datastore/mysql/scheduled_queries.go

@@ -113,7 +113,7 @@ func insertScheduledQueryDB(ctx context.Context, q sqlx.ExtContext, sq *fleet.Sc
 	}
 
 	id, _ := result.LastInsertId()
-	sq.ID = uint(id)
+	sq.ID = uint(id) //nolint:gosec // dismiss G115
 
 	query = `SELECT query, name FROM queries WHERE id = ? LIMIT 1`
 	metadata := []struct {

server/datastore/mysql/scripts.go

@@ -30,7 +30,7 @@ func (ds *Datastore) NewHostScriptExecutionRequest(ctx context.Context, request
 			}
 
 			id, _ := scRes.LastInsertId()
-			request.ScriptContentID = uint(id)
+			request.ScriptContentID = uint(id) //nolint:gosec // dismiss G115
 		}
 		res, err = newHostScriptExecutionRequest(ctx, tx, request)
 		return err
@@ -148,7 +148,7 @@ func (ds *Datastore) SetHostScriptExecutionResult(ctx context.Context, result *f
 			// software that receives them is responsible for casting
 			// it to a 32-bit signed integer.
 			// See /orbit/pkg/scripts/exec_windows.go
-			int32(result.ExitCode),
+			int32(result.ExitCode), //nolint:gosec // dismiss G115
 			result.Timeout,
 			result.HostID,
 			result.ExecutionID,
@@ -303,14 +303,14 @@ func (ds *Datastore) NewScript(ctx context.Context, script *fleet.Script) (*flee
 		id, _ := scRes.LastInsertId()
 
 		// then create the script entity
-		res, err = insertScript(ctx, tx, script, uint(id))
+		res, err = insertScript(ctx, tx, script, uint(id)) //nolint:gosec // dismiss G115
 		return err
 	})
 	if err != nil {
 		return nil, err
 	}
 	id, _ := res.LastInsertId()
-	return ds.getScriptDB(ctx, ds.writer(ctx), uint(id))
+	return ds.getScriptDB(ctx, ds.writer(ctx), uint(id)) //nolint:gosec // dismiss G115
 }
 
 func insertScript(ctx context.Context, tx sqlx.ExtContext, script *fleet.Script, scriptContentsID uint) (sql.Result, error) {
@@ -488,7 +488,7 @@ WHERE
 	var metaData *fleet.PaginationMetadata
 	if opt.IncludeMetadata {
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.Page > 0}
-		if len(scripts) > int(opt.PerPage) {
+		if len(scripts) > int(opt.PerPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			scripts = scripts[:len(scripts)-1]
 		}
@@ -605,7 +605,7 @@ WHERE
 	var metaData *fleet.PaginationMetadata
 	if opt.IncludeMetadata {
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.Page > 0}
-		if len(rows) > int(opt.PerPage) {
+		if len(rows) > int(opt.PerPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			rows = rows[:len(rows)-1]
 		}
@@ -742,7 +742,8 @@ ON DUPLICATE KEY UPDATE
 				return ctxerr.Wrapf(ctx, err, "inserting script contents for script with name %q", s.Name)
 			}
 			id, _ := scRes.LastInsertId()
-			if _, err := tx.ExecContext(ctx, insertNewOrEditedScript, tmID, globalOrTeamID, s.Name, uint(id)); err != nil {
+			if _, err := tx.ExecContext(ctx, insertNewOrEditedScript, tmID, globalOrTeamID, s.Name,
+				uint(id)); err != nil { //nolint:gosec // dismiss G115
 				return ctxerr.Wrapf(ctx, err, "insert new/edited script with name %q", s.Name)
 			}
 		}
@@ -952,7 +953,7 @@ func (ds *Datastore) LockHostViaScript(ctx context.Context, request *fleet.HostS
 		}
 
 		id, _ := scRes.LastInsertId()
-		request.ScriptContentID = uint(id)
+		request.ScriptContentID = uint(id) //nolint:gosec // dismiss G115
 
 		res, err = newHostScriptExecutionRequest(ctx, tx, request)
 		if err != nil {
@@ -1002,7 +1003,7 @@ func (ds *Datastore) UnlockHostViaScript(ctx context.Context, request *fleet.Hos
 		}
 
 		id, _ := scRes.LastInsertId()
-		request.ScriptContentID = uint(id)
+		request.ScriptContentID = uint(id) //nolint:gosec // dismiss G115
 
 		res, err = newHostScriptExecutionRequest(ctx, tx, request)
 		if err != nil {
@@ -1053,7 +1054,7 @@ func (ds *Datastore) WipeHostViaScript(ctx context.Context, request *fleet.HostS
 		}
 
 		id, _ := scRes.LastInsertId()
-		request.ScriptContentID = uint(id)
+		request.ScriptContentID = uint(id) //nolint:gosec // dismiss G115
 
 		res, err = newHostScriptExecutionRequest(ctx, tx, request)
 		if err != nil {

server/datastore/mysql/scripts_test.go

@@ -924,7 +924,7 @@ func testLockUnlockWipeViaScripts(t *testing.T, ds *Datastore) {
 	user := test.NewUser(t, ds, "Bob", "bob@example.com", true)
 
 	for i, platform := range []string{"windows", "linux"} {
-		hostID := uint(i + 1)
+		hostID := uint(i + 1) //nolint:gosec // dismiss G115
 
 		t.Run(platform, func(t *testing.T) {
 			status, err := ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: hostID, Platform: platform, UUID: "uuid"})
@@ -1203,7 +1203,7 @@ func testInsertScriptContents(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	require.Len(t, sc, 1)
-	require.Equal(t, uint(id), sc[0].ID)
+	require.EqualValues(t, id, sc[0].ID)
 	require.Equal(t, expectedCS, sc[0].Checksum)
 }
 
@@ -1324,7 +1324,7 @@ func testGetAnyScriptContents(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	id, _ := res.LastInsertId()
 
-	result, err := ds.GetAnyScriptContents(ctx, uint(id))
+	result, err := ds.GetAnyScriptContents(ctx, uint(id)) //nolint:gosec // dismiss G115
 	require.NoError(t, err)
 	require.Equal(t, contents, string(result))
 }

server/datastore/mysql/sessions.go

@@ -81,8 +81,8 @@ func (ds *Datastore) NewSession(ctx context.Context, userID uint, sessionKey str
 		return nil, ctxerr.Wrap(ctx, err, "inserting session")
 	}
 
-	id, _ := result.LastInsertId() // cannot fail with the mysql driver
-	return ds.sessionByID(ctx, ds.writer(ctx), uint(id))
+	id, _ := result.LastInsertId()                       // cannot fail with the mysql driver
+	return ds.sessionByID(ctx, ds.writer(ctx), uint(id)) //nolint:gosec // dismiss G115
 }
 
 func (ds *Datastore) DestroySession(ctx context.Context, session *fleet.Session) error {

server/datastore/mysql/software.go

@@ -1014,7 +1014,7 @@ func selectSoftwareSQL(opts fleet.SoftwareListOptions) (string, []interface{}, e
 				"shc.team_id",
 			)
 
-		if opts.TeamID == nil {
+		if opts.TeamID == nil { //nolint:gocritic // ignore ifElseChain
 			ds = ds.Where(
 				goqu.And(
 					goqu.I("shc.team_id").Eq(0),
@@ -1413,7 +1413,7 @@ func (ds *Datastore) ListSoftware(ctx context.Context, opt fleet.SoftwareListOpt
 			perPage = defaultSelectLimit
 		}
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.ListOptions.Page > 0}
-		if len(software) > int(perPage) {
+		if len(software) > int(perPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			software = software[:len(software)-1]
 		}
@@ -2623,7 +2623,7 @@ INNER JOIN software_cve scve ON scve.software_id = s.id
 			HasPreviousResults: opts.ListOptions.Page > 0,
 			TotalResults:       titleCount,
 		}
-		if len(hostSoftwareList) > int(perPage) {
+		if len(hostSoftwareList) > int(perPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			hostSoftwareList = hostSoftwareList[:len(hostSoftwareList)-1]
 		}

server/datastore/mysql/software_installers.go

@@ -166,7 +166,7 @@ INSERT INTO software_installers (
 
 	id, _ := res.LastInsertId()
 
-	return uint(id), nil
+	return uint(id), nil //nolint:gosec // dismiss G115
 }
 
 func (ds *Datastore) getOrGenerateSoftwareInstallerTitleID(ctx context.Context, payload *fleet.UploadSoftwareInstallerPayload) (uint, error) {

server/datastore/mysql/software_test.go

@@ -1751,7 +1751,7 @@ func testUpdateHostSoftware(t *testing.T, ds *Datastore) {
 			case lts != nil && rts == nil:
 				return false
 			default:
-				return (*lts).Before(*rts) || ((*lts).Equal(*rts) && lsw.Name < rsw.Name)
+				return lts.Before(*rts) || (lts.Equal(*rts) && lsw.Name < rsw.Name)
 			}
 		}
 	}
@@ -1972,7 +1972,7 @@ func testInsertSoftwareVulnerability(t *testing.T, ds *Datastore) {
 
 		occurrence := make(map[string]int)
 		for _, v := range storedVulns[host.ID] {
-			occurrence[v.CVE] = occurrence[v.CVE] + 1
+			occurrence[v.CVE]++
 		}
 		require.Equal(t, 1, occurrence["cve-1"])
 	})
@@ -2016,7 +2016,7 @@ func testInsertSoftwareVulnerability(t *testing.T, ds *Datastore) {
 
 		occurrence := make(map[string]int)
 		for _, v := range storedVulns[host.ID] {
-			occurrence[v.CVE] = occurrence[v.CVE] + 1
+			occurrence[v.CVE]++
 		}
 		require.Equal(t, 1, occurrence["cve-1"])
 		require.Equal(t, 1, occurrence["cve-2"])

server/datastore/mysql/software_titles.go

@@ -204,7 +204,7 @@ func (ds *Datastore) ListSoftwareTitles(
 	var metaData *fleet.PaginationMetadata
 	if opt.ListOptions.IncludeMetadata {
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.ListOptions.Page > 0}
-		if len(softwareList) > int(opt.ListOptions.PerPage) {
+		if len(softwareList) > int(opt.ListOptions.PerPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			softwareList = softwareList[:len(softwareList)-1]
 		}

server/datastore/mysql/targets.go

@@ -95,11 +95,11 @@ func targetSQLCondAndArgs(targets fleet.HostTargets) (sql string, args []interfa
 	// all situations (no need to remove the clause when there are no values)
 	queryLabelIDs := []int{-1}
 	for _, id := range targets.LabelIDs {
-		queryLabelIDs = append(queryLabelIDs, int(id))
+		queryLabelIDs = append(queryLabelIDs, int(id)) //nolint:gosec // dismiss G115
 	}
 	queryHostIDs := []int{-1}
 	for _, id := range targets.HostIDs {
-		queryHostIDs = append(queryHostIDs, int(id))
+		queryHostIDs = append(queryHostIDs, int(id)) //nolint:gosec // dismiss G115
 	}
 	queryTeamIDs := []int{-1}
 	extraTeamIDCondition := ""
@@ -108,7 +108,7 @@ func targetSQLCondAndArgs(targets fleet.HostTargets) (sql string, args []interfa
 			extraTeamIDCondition = "OR team_id IS NULL"
 			continue
 		}
-		queryTeamIDs = append(queryTeamIDs, int(id))
+		queryTeamIDs = append(queryTeamIDs, int(id)) //nolint:gosec // dismiss G115
 	}
 
 	labelsSpecified := len(queryLabelIDs) > 1

server/datastore/mysql/targets_test.go

@@ -730,7 +730,7 @@ func testTargetsHostIDsInTargets(t *testing.T, ds *Datastore) {
 
 			metrics, err := ds.CountHostsInTargets(context.Background(), filter, targets, time.Now())
 			require.NoError(t, err)
-			require.Len(t, tc.expectedHostIDs, int(metrics.TotalHosts))
+			require.Len(t, tc.expectedHostIDs, int(metrics.TotalHosts)) //nolint:gosec // dismiss G115
 		})
 	}
 

server/datastore/mysql/teams.go

@@ -45,7 +45,7 @@ func (ds *Datastore) NewTeam(ctx context.Context, team *fleet.Team) (*fleet.Team
 		}
 
 		id, _ := result.LastInsertId()
-		team.ID = uint(id)
+		team.ID = uint(id) //nolint:gosec // dismiss G115
 
 		return saveTeamSecretsDB(ctx, tx, team)
 	})

server/datastore/mysql/users.go

@@ -56,7 +56,7 @@ func (ds *Datastore) NewUser(ctx context.Context, user *fleet.User) (*fleet.User
 		}
 
 		id, _ := result.LastInsertId()
-		user.ID = uint(id)
+		user.ID = uint(id) //nolint:gosec // dismiss G115
 
 		if err := saveTeamsForUserDB(ctx, tx, user); err != nil {
 			return err

server/datastore/mysql/vpp.go

@@ -630,7 +630,7 @@ func (ds *Datastore) InsertVPPToken(ctx context.Context, tok *fleet.VPPTokenData
 
 	id, _ := res.LastInsertId()
 
-	vppTokenDB.ID = uint(id)
+	vppTokenDB.ID = uint(id) //nolint:gosec // dismiss G115
 
 	return vppTokenDB, nil
 }
@@ -876,7 +876,7 @@ func (ds *Datastore) UpdateVPPTokenTeams(ctx context.Context, id uint, teams []u
 		if errors.As(err, &mysqlErr) && IsDuplicate(err) {
 			var dupeTeamID uint
 			var dupeTeamName string
-			fmt.Sscanf(mysqlErr.Message, "Duplicate entry '%d' for", &dupeTeamID)
+			_, _ = fmt.Sscanf(mysqlErr.Message, "Duplicate entry '%d' for", &dupeTeamID)
 			if err := sqlx.GetContext(ctx, ds.reader(ctx), &dupeTeamName, stmtTeamName, dupeTeamID); err != nil {
 				return nil, ctxerr.Wrap(ctx, err, "getting team name for vpp token conflict error")
 			}

server/datastore/mysql/vulnerabilities.go

@@ -294,7 +294,7 @@ func (ds *Datastore) ListVulnerabilities(ctx context.Context, opt fleet.VulnList
 	var metaData *fleet.PaginationMetadata
 	if opt.ListOptions.IncludeMetadata {
 		metaData = &fleet.PaginationMetadata{HasPreviousResults: opt.ListOptions.Page > 0}
-		if len(vulns) > int(opt.ListOptions.PerPage) {
+		if len(vulns) > int(opt.ListOptions.PerPage) { //nolint:gosec // dismiss G115
 			metaData.HasNextResults = true
 			vulns = vulns[:len(vulns)-1]
 		}
@@ -318,14 +318,14 @@ func (ds *Datastore) CountVulnerabilities(ctx context.Context, opt fleet.VulnLis
 	`
 	var args []interface{}
 	if opt.TeamID == nil {
-		selectStmt = selectStmt + " AND global_stats = 1"
+		selectStmt += " AND global_stats = 1"
 	} else {
-		selectStmt = selectStmt + " AND global_stats = 0 AND vhc.team_id = ?"
+		selectStmt += " AND global_stats = 0 AND vhc.team_id = ?"
 		args = append(args, opt.TeamID)
 	}
 
 	if opt.KnownExploit {
-		selectStmt = selectStmt + " AND cm.cisa_known_exploit = 1"
+		selectStmt += " AND cm.cisa_known_exploit = 1"
 	}
 
 	if match := opt.ListOptions.MatchQuery; match != "" {

server/datastore/mysql/vulnerabilities_test.go

@@ -407,7 +407,7 @@ func testVulnerabilitiesTeamFilter(t *testing.T, ds *Datastore) {
 	}
 
 	for _, vuln := range list {
-		require.Equal(t, checkCounts[vuln.CVE.CVE], int(vuln.HostsCount), vuln.CVE)
+		require.EqualValues(t, checkCounts[vuln.CVE.CVE], vuln.HostsCount, vuln.CVE)
 	}
 
 	//
@@ -432,7 +432,7 @@ func testVulnerabilitiesTeamFilter(t *testing.T, ds *Datastore) {
 	}
 
 	for _, vuln := range list {
-		require.Equal(t, checkCounts[vuln.CVE.CVE], int(vuln.HostsCount), vuln.CVE)
+		require.EqualValues(t, checkCounts[vuln.CVE.CVE], vuln.HostsCount, vuln.CVE)
 	}
 
 	//
@@ -456,7 +456,7 @@ func testVulnerabilitiesTeamFilter(t *testing.T, ds *Datastore) {
 	}
 
 	for _, vuln := range list {
-		require.Equal(t, checkCounts[vuln.CVE.CVE], int(vuln.HostsCount), vuln.CVE)
+		require.EqualValues(t, checkCounts[vuln.CVE.CVE], vuln.HostsCount, vuln.CVE)
 	}
 }
 
@@ -759,7 +759,7 @@ func testInsertVulnerabilityCounts(t *testing.T, ds *Datastore) {
 		Platform: "darwin",
 	}
 	for i := 4; i < 9; i++ {
-		err = ds.UpdateHostOperatingSystem(context.Background(), uint(i), macOSPatched)
+		err = ds.UpdateHostOperatingSystem(context.Background(), uint(i), macOSPatched) //nolint:gosec // dismiss G115
 		require.NoError(t, err)
 	}
 

server/datastore/mysql/windows_updates_test.go

@@ -30,7 +30,7 @@ func TestWindowsUpdates(t *testing.T) {
 
 func testListWindowsUpdatesByHostID(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
-	now := uint(time.Now().Unix())
+	now := uint(time.Now().Unix()) //nolint:gosec // dismiss G115
 
 	t.Run("with no stored updates", func(t *testing.T) {
 		actual, err := ds.ListWindowsUpdatesByHostID(ctx, 1)
@@ -69,7 +69,7 @@ func testListWindowsUpdatesByHostID(t *testing.T, ds *Datastore) {
 
 func testInsertWindowsUpdates(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
-	now := uint(time.Now().Unix())
+	now := uint(time.Now().Unix()) //nolint:gosec // dismiss G115
 	smt := `SELECT kb_id, date_epoch FROM windows_updates WHERE host_id = ?`
 
 	t.Run("with no stored updates", func(t *testing.T) {

server/datastore/redis/redis.go

@@ -330,7 +330,8 @@ func newCluster(conf PoolConfig) (*redisc.Cluster, error) {
 					}
 
 					if conf.ConnectRetryAttempts > 0 {
-						boff := backoff.WithMaxRetries(backoff.NewExponentialBackOff(), uint64(conf.ConnectRetryAttempts))
+						boff := backoff.WithMaxRetries(backoff.NewExponentialBackOff(),
+							uint64(conf.ConnectRetryAttempts)) //nolint:gosec // G115 false positive
 						if err := backoff.Retry(op, boff); err != nil {
 							return nil, err
 						}

server/fleet/hosts.go

@@ -558,7 +558,7 @@ func (d *MDMHostData) PopulateOSSettingsAndMacOSSettings(profiles []HostMDMApple
 		case MDMOperationTypeInstall:
 			switch {
 			case fvprof.Status != nil && (*fvprof.Status == MDMDeliveryVerifying || *fvprof.Status == MDMDeliveryVerified):
-				if d.rawDecryptable != nil && *d.rawDecryptable == 1 {
+				if d.rawDecryptable != nil && *d.rawDecryptable == 1 { //nolint:gocritic // ignore ifElseChain
 					//  if a FileVault profile has been successfully installed on the host
 					//  AND we have fetched and are able to decrypt the key
 					switch *fvprof.Status {
@@ -690,14 +690,14 @@ func (h *Host) IsEligibleForWindowsMDMUnenrollment(isConnectedToFleetMDM bool) b
 // empty. If Hostname is empty and both HardwareSerial and HardwareModel are not empty, it returns a
 // composite string with HardwareModel and HardwareSerial. If all else fails, it returns an empty
 // string.
-func HostDisplayName(ComputerName string, Hostname string, HardwareModel string, HardwareSerial string) string {
+func HostDisplayName(computerName string, hostname string, hardwareModel string, hardwareSerial string) string {
 	switch {
-	case ComputerName != "":
-		return ComputerName
-	case Hostname != "":
-		return Hostname
-	case HardwareModel != "" && HardwareSerial != "":
-		return fmt.Sprintf("%s (%s)", HardwareModel, HardwareSerial)
+	case computerName != "":
+		return computerName
+	case hostname != "":
+		return hostname
+	case hardwareModel != "" && hardwareSerial != "":
+		return fmt.Sprintf("%s (%s)", hardwareModel, hardwareSerial)
 	default:
 		return ""
 	}
@@ -786,7 +786,7 @@ func (h *Host) Status(now time.Time) HostStatus {
 	onlineInterval += OnlineIntervalBuffer
 
 	switch {
-	case h.SeenTime.Add(time.Duration(onlineInterval) * time.Second).Before(now):
+	case h.SeenTime.Add(time.Duration(onlineInterval) * time.Second).Before(now): //nolint:gosec // dismiss G115
 		return StatusOffline
 	default:
 		return StatusOnline
@@ -827,7 +827,8 @@ func IsLinux(hostPlatform string) bool {
 }
 
 func IsUnixLike(hostPlatform string) bool {
-	unixLikeOSs := append(HostLinuxOSs, "darwin")
+	unixLikeOSs := HostLinuxOSs
+	unixLikeOSs = append(unixLikeOSs, "darwin")
 	for _, p := range unixLikeOSs {
 		if p == hostPlatform {
 			return true

server/fleet/microsoft_mdm.go

@@ -1410,11 +1410,12 @@ func GetEncodedBinarySecurityToken(typeID WindowsMDMEnrollmentType, payload stri
 	var pld WindowsMDMAccessTokenPayload
 	pld.Type = typeID
 
-	if typeID == WindowsMDMProgrammaticEnrollmentType {
+	switch typeID {
+	case WindowsMDMProgrammaticEnrollmentType:
 		pld.Payload.OrbitNodeKey = payload
-	} else if typeID == WindowsMDMAutomaticEnrollmentType {
+	case WindowsMDMAutomaticEnrollmentType:
 		pld.Payload.AuthToken = payload
-	} else {
+	default:
 		return "", fmt.Errorf("invalid enrollment type: %v", typeID)
 	}
 

server/fleet/policytest/policytest.go

@@ -13,7 +13,7 @@ func RunFailing1000hosts(t *testing.T, r fleet.FailingPolicySet) {
 	hosts := make([]fleet.PolicySetHost, 1000)
 	for i := range hosts {
 		hosts[i] = fleet.PolicySetHost{
-			ID:       uint(i + 1),
+			ID:       uint(i + 1), //nolint:gosec // dismiss G115
 			Hostname: fmt.Sprintf("test.hostname.%d", i+1),
 		}
 	}

server/fleet/scheduled_queries.go

@@ -192,7 +192,7 @@ func ScheduledQueryFromQuery(query *Query) *ScheduledQuery {
 		snapshot *bool
 		removed  *bool
 	)
-	if query.Logging == "" || query.Logging == "snapshot" {
+	if query.Logging == "" || query.Logging == "snapshot" { //nolint:gocritic // ignore ifElseChain
 		snapshot = ptr.Bool(true)
 		removed = ptr.Bool(false)
 	} else if query.Logging == "differential" {
@@ -221,7 +221,7 @@ func ScheduledQueryFromQuery(query *Query) *ScheduledQuery {
 func ScheduledQueryToQueryPayloadForNewQuery(originalQuery *Query, scheduledQuery *ScheduledQuery) QueryPayload {
 	logging := ptr.String(LoggingSnapshot) // default is snapshot.
 	if scheduledQuery.Snapshot != nil && scheduledQuery.Removed != nil {
-		if *scheduledQuery.Snapshot {
+		if *scheduledQuery.Snapshot { //nolint:gocritic // ignore ifElseChain
 			logging = ptr.String(LoggingSnapshot)
 		} else if *scheduledQuery.Removed {
 			logging = ptr.String(LoggingDifferential)
@@ -249,7 +249,7 @@ func ScheduledQueryToQueryPayloadForNewQuery(originalQuery *Query, scheduledQuer
 func ScheduledQueryPayloadToQueryPayloadForModifyQuery(payload ScheduledQueryPayload) QueryPayload {
 	var logging *string
 	if payload.Snapshot != nil && payload.Removed != nil {
-		if *payload.Snapshot {
+		if *payload.Snapshot { //nolint:gocritic // ignore ifElseChain
 			logging = ptr.String(LoggingSnapshot)
 		} else if *payload.Removed {
 			logging = ptr.String(LoggingDifferential)

server/fleet/software.go

@@ -123,8 +123,7 @@ type VulnSoftwareFilter struct {
 type SliceString []string
 
 func (c *SliceString) Scan(v interface{}) error {
-	switch tv := v.(type) {
-	case []byte:
+	if tv, ok := v.([]byte); ok {
 		return json.Unmarshal(tv, &c)
 	}
 	return errors.New("unsupported type")

server/goose/migrate.go

@@ -178,7 +178,7 @@ func (c *Client) GetDBVersion(db *sql.DB) (int64, error) {
 	for rows.Next() {
 		var row MigrationRecord
 		if err = rows.Scan(&row.VersionId, &row.IsApplied); err != nil {
-			log.Fatal("error scanning rows:", err)
+			log.Fatal("error scanning rows:", err) //nolint:gocritic // ignore exitAfterDefer
 		}
 
 		// have we already marked this version to be skipped?

server/goose/migrate_test.go

@@ -32,13 +32,14 @@ func validateMigrationSort(t *testing.T, ms Migrations, sorted []int64) {
 
 		var next, prev int64
 
-		if i == 0 {
+		switch i {
+		case 0:
 			prev = -1
 			next = ms[i+1].Version
-		} else if i == len(ms)-1 {
+		case len(ms) - 1:
 			prev = ms[i-1].Version
 			next = -1
-		} else {
+		default:
 			prev = ms[i-1].Version
 			next = ms[i+1].Version
 		}

server/goose/migration.go

@@ -34,7 +34,7 @@ const (
 )
 
 func (m *Migration) String() string {
-	return fmt.Sprintf(m.Source)
+	return fmt.Sprint(m.Source)
 }
 
 func (c *Client) runMigration(db *sql.DB, m *Migration, direction bool) error {

server/launcher/launcher.go

@@ -82,7 +82,7 @@ func (svc *launcherWrapper) RequestQueries(ctx context.Context, nodeKey string)
 	result := &distributed.GetQueriesResult{
 		Queries:           queryMap,
 		Discovery:         discoveryMap,
-		AccelerateSeconds: int(accelerate),
+		AccelerateSeconds: int(accelerate), //nolint:gosec // dismiss G115
 	}
 
 	return result, false, nil
@@ -131,10 +131,10 @@ func (svc *launcherWrapper) PublishResults(ctx context.Context, nodeKey string,
 		osqueryResults[result.QueryName] = result.Rows
 		if result.QueryStats != nil {
 			stats[result.QueryName] = &fleet.Stats{
-				WallTimeMs: uint64(result.QueryStats.WallTimeMs),
-				UserTime:   uint64(result.QueryStats.UserTime),
-				SystemTime: uint64(result.QueryStats.SystemTime),
-				Memory:     uint64(result.QueryStats.Memory),
+				WallTimeMs: uint64(result.QueryStats.WallTimeMs), //nolint:gosec // dismiss G115
+				UserTime:   uint64(result.QueryStats.UserTime),   //nolint:gosec // dismiss G115
+				SystemTime: uint64(result.QueryStats.SystemTime), //nolint:gosec // dismiss G115
+				Memory:     uint64(result.QueryStats.Memory),     //nolint:gosec // dismiss G115
 			}
 		}
 	}

server/logging/firehose.go

@@ -91,7 +91,7 @@ func (f *firehoseLogWriter) validateStream() error {
 		return fmt.Errorf("describe stream %s: %w", f.stream, err)
 	}
 
-	if (*(*out.DeliveryStreamDescription).DeliveryStreamStatus) != firehose.DeliveryStreamStatusActive {
+	if (*out.DeliveryStreamDescription.DeliveryStreamStatus) != firehose.DeliveryStreamStatusActive {
 		return fmt.Errorf("delivery stream %s not active", f.stream)
 	}
 

server/logging/kinesis.go

@@ -98,7 +98,7 @@ func (k *kinesisLogWriter) validateStream() error {
 		return fmt.Errorf("describe stream %s: %w", k.stream, err)
 	}
 
-	if (*(*out.StreamDescription).StreamStatus) != kinesis.StreamStatusActive {
+	if (*out.StreamDescription.StreamStatus) != kinesis.StreamStatusActive {
 		return fmt.Errorf("stream %s not active", k.stream)
 	}
 

server/mdm/apple/itunes/api.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"net/url"
 	"os"
-	"strconv"
 	"strings"
 	"time"
 
@@ -65,7 +64,7 @@ func GetAssetMetadata(adamIDs []string, filter *AssetMetadataFilter) (map[string
 
 	metadata := make(map[string]AssetMetadata)
 	for _, a := range bodyResp.Results {
-		metadata[strconv.Itoa(int(a.TrackID))] = a
+		metadata[fmt.Sprint(a.TrackID)] = a
 	}
 
 	return metadata, nil

server/mdm/apple/util.go

@@ -60,7 +60,7 @@ func EncodePrivateKeyPEM(key *rsa.PrivateKey) []byte {
 //
 // The implementation details have been mostly taken from https://github.com/pquerna/otp
 func GenerateRandomPin(length int) string {
-	counter := uint64(time.Now().Unix())
+	counter := uint64(time.Now().Unix()) //nolint:gosec // dismiss G115
 	buf := make([]byte, 8)
 	binary.BigEndian.PutUint64(buf, counter)
 	m := sha256.New()
@@ -71,7 +71,7 @@ func GenerateRandomPin(length int) string {
 		((int(sum[offset+1] & 0xff)) << 16) |
 		((int(sum[offset+2] & 0xff)) << 8) |
 		(int(sum[offset+3]) & 0xff))
-	v := int32(value % int64(math.Pow10(length)))
+	v := int32(value % int64(math.Pow10(length))) //nolint:gosec // dismiss G115
 	f := fmt.Sprintf("%%0%dd", length)
 	return fmt.Sprintf(f, v)
 }

server/mdm/maintainedapps/scripts.go

@@ -179,11 +179,11 @@ func processUninstallArtifact(u *brewUninstall, sb *scriptBuilder) {
 	if u.Script.IsOther {
 		addUserVar()
 		for _, path := range u.Script.Other {
-			sb.Writef(fmt.Sprintf(`sudo -u "$LOGGED_IN_USER" '%s'`, path))
+			sb.Writef(`sudo -u "$LOGGED_IN_USER" '%s'`, path)
 		}
 	} else if len(u.Script.String) > 0 {
 		addUserVar()
-		sb.Writef(fmt.Sprintf(`sudo -u "$LOGGED_IN_USER" '%s'`, u.Script.String))
+		sb.Writef(`sudo -u "$LOGGED_IN_USER" '%s'`, u.Script.String)
 	}
 
 	process(u.PkgUtil, func(pkgID string) {

server/mdm/microsoft/wstep_csr.go

@@ -3,10 +3,14 @@ package microsoft_mdm
 import (
 	"bytes"
 	"crypto"
+	"crypto/dsa" //lint:ignore required for crypto.RegisterHash
 	"crypto/ecdsa"
 	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/rsa"
+	_ "crypto/sha1" //nolint:gosec
+	_ "crypto/sha256"
+	_ "crypto/sha512"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
@@ -27,12 +31,6 @@ import (
 	// Explicitly import these for their crypto.RegisterHash init side-effects.
 	// Keep these as blank imports, even if they're imported above.
 
-	"crypto/dsa" //lint:ignore required for crypto.RegisterHash
-
-	_ "crypto/sha1" //nolint:gosec
-	_ "crypto/sha256"
-	_ "crypto/sha512"
-
 	"golang.org/x/crypto/cryptobyte"
 	cryptobyte_asn1 "golang.org/x/crypto/cryptobyte/asn1"
 )
@@ -405,7 +403,7 @@ func parseCertificateRequest(in *certificateRequest) (*x509.CertificateRequest,
 	}
 
 	for _, extension := range out.Extensions {
-		switch {
+		switch { //nolint:gocritic // ignore singleCaseSwitch
 		case extension.Id.Equal(oidExtensionSubjectAltName):
 			out.DNSNames, out.EmailAddresses, out.IPAddresses, out.URIs, err = parseSANExtension(extension.Value)
 			if err != nil {
@@ -1293,8 +1291,8 @@ func parseInt64(bytes []byte) (ret int64, err error) {
 	}
 
 	// Shift up and down in order to sign extend the result.
-	ret <<= 64 - uint8(len(bytes))*8
-	ret >>= 64 - uint8(len(bytes))*8
+	ret <<= 64 - uint8(len(bytes))*8 //nolint:gosec // dismiss G115
+	ret >>= 64 - uint8(len(bytes))*8 //nolint:gosec // dismiss G115
 	return
 }
 
@@ -1484,10 +1482,10 @@ func parseInt32(bytes []byte) (int32, error) {
 	if err != nil {
 		return 0, err
 	}
-	if ret64 != int64(int32(ret64)) {
+	if ret64 != int64(int32(ret64)) { //nolint:gosec // dismiss G115
 		return 0, asn1.StructuralError{Msg: "integer too large"}
 	}
-	return int32(ret64), nil
+	return int32(ret64), nil //nolint:gosec // dismiss G115
 }
 
 var bigOne = big.NewInt(1)

server/mdm/microsoft/wstep_csr_test.go

@@ -135,7 +135,7 @@ func TestCreateCertificateRequest(t *testing.T) {
 			continue
 		}
 
-		if out.Subject.CommonName != template.Subject.CommonName {
+		if out.Subject.CommonName != template.Subject.CommonName { //nolint:gocritic // ignore ifElseChain
 			t.Errorf("%s: output subject common name and template subject common name don't match", test.name)
 		} else if len(out.Subject.Organization) != len(template.Subject.Organization) {
 			t.Errorf("%s: output subject organisation and template subject organisation don't match", test.name)

server/mdm/nanodep/cmd/depsyncer/main.go

@@ -166,7 +166,7 @@ func main() {
 			depsync.WithCallback(callback),
 		}
 		if *flDur > 0 {
-			syncerOpts = append(syncerOpts, depsync.WithDuration(time.Duration(*flDur)*time.Second))
+			syncerOpts = append(syncerOpts, depsync.WithDuration(time.Duration(*flDur)*time.Second)) //nolint:gosec // ignore G115
 		}
 		if *flLimit > 0 {
 			syncerOpts = append(syncerOpts, depsync.WithLimit(*flLimit))

server/mdm/nanomdm/http/api/api.go

@@ -277,15 +277,16 @@ func readPEMCertAndKey(input []byte) (cert []byte, key []byte, err error) {
 		if block == nil {
 			break
 		}
-		if block.Type == "CERTIFICATE" {
+		switch {
+		case block.Type == "CERTIFICATE":
 			cert = pem.EncodeToMemory(block)
-		} else if block.Type == "PRIVATE KEY" || strings.HasSuffix(block.Type, " PRIVATE KEY") {
+		case block.Type == "PRIVATE KEY" || strings.HasSuffix(block.Type, " PRIVATE KEY"):
 			if x509.IsEncryptedPEMBlock(block) {
 				err = errors.New("private key PEM appears to be encrypted")
 				break
 			}
 			key = pem.EncodeToMemory(block)
-		} else {
+		default:
 			err = fmt.Errorf("unrecognized PEM type: %q", block.Type)
 			break
 		}

server/mdm/nanomdm/mdm/type.go

@@ -2,7 +2,7 @@ package mdm
 
 import (
 	"errors"
-	"strconv"
+	"fmt"
 )
 
 // Shared iPad users have a static UserID that they connect to MDM with.
@@ -40,7 +40,7 @@ func (et EnrollType) String() string {
 	case SharediPad:
 		return "Shared iPad"
 	default:
-		return "unknown enroll type value " + strconv.Itoa(int(et))
+		return "unknown enroll type value " + fmt.Sprint(uint(et))
 	}
 }
 

server/mdm/scep/cmd/scepserver/scepserver.go

@@ -75,12 +75,13 @@ func main() {
 	httpAddrSet := setByUser("http-addr", "SCEP_HTTP_ADDR")
 	portSet := setByUser("port", "SCEP_HTTP_LISTEN_PORT")
 	var httpAddr string
-	if httpAddrSet && portSet {
+	switch {
+	case httpAddrSet && portSet:
 		fmt.Fprintln(os.Stderr, "cannot set both -http-addr and -port")
 		os.Exit(1)
-	} else if httpAddrSet {
+	case httpAddrSet:
 		httpAddr = *flHTTPAddr
-	} else {
+	default:
 		httpAddr = ":" + *flPort
 	}
 

server/mock/mockimpl/impl.go

@@ -413,7 +413,7 @@ func main() {
 		defer f.Close()
 		_, err = f.Write(imp)
 		if err != nil {
-			log.Fatal(err)
+			log.Fatal(err) //nolint:gocritic // ignore exitAfterDefer
 		}
 	}
 }

server/pubsub/inmem_query_results.go

@@ -2,7 +2,7 @@ package pubsub
 
 import (
 	"context"
-	"strconv"
+	"fmt"
 	"sync"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -40,7 +40,7 @@ func (im *inmemQueryResults) WriteResult(result fleet.DistributedQueryResult) er
 	case channel <- result:
 		// intentionally do nothing
 	default:
-		return noSubscriberError{strconv.Itoa(int(result.DistributedQueryCampaignID))}
+		return noSubscriberError{fmt.Sprint(result.DistributedQueryCampaignID)}
 	}
 
 	return nil

server/pubsub/query_results_test.go

@@ -153,7 +153,7 @@ func TestQueryResultsStore(t *testing.T) {
 		go func() {
 			defer readerWg.Done()
 			for res := range channel1 {
-				switch res := res.(type) {
+				switch res := res.(type) { //nolint:gocritic // ignore singleCaseSwitch
 				case fleet.DistributedQueryResult:
 					results1 = append(results1, res)
 				}
@@ -163,7 +163,7 @@ func TestQueryResultsStore(t *testing.T) {
 		go func() {
 			defer readerWg.Done()
 			for res := range channel2 {
-				switch res := res.(type) {
+				switch res := res.(type) { //nolint:gocritic // ignore singleCaseSwitch
 				case fleet.DistributedQueryResult:
 					results2 = append(results2, res)
 				}

server/service/apple_mdm.go

@@ -319,7 +319,7 @@ func (newMDMAppleConfigProfileRequest) DecodeRequest(ctx context.Context, r *htt
 		if err != nil {
 			return nil, &fleet.BadRequestError{Message: fmt.Sprintf("failed to decode team_id in multipart form: %s", err.Error())}
 		}
-		decoded.TeamID = uint(teamID)
+		decoded.TeamID = uint(teamID) //nolint:gosec // dismiss G115
 	}
 
 	fhs, ok := r.MultipartForm.File["profile"]
@@ -2209,7 +2209,7 @@ func (uploadBootstrapPackageRequest) DecodeRequest(ctx context.Context, r *http.
 		if err != nil {
 			return nil, &fleet.BadRequestError{Message: fmt.Sprintf("failed to decode team_id in multipart form: %s", err.Error())}
 		}
-		decoded.TeamID = uint(teamID)
+		decoded.TeamID = uint(teamID) //nolint:gosec // dismiss G115
 	}
 
 	return &decoded, nil
@@ -4477,7 +4477,7 @@ func (renewABMTokenRequest) DecodeRequest(ctx context.Context, r *http.Request)
 
 	return &renewABMTokenRequest{
 		Token:   token[0],
-		TokenID: uint(id),
+		TokenID: uint(id), //nolint:gosec // dismiss G115
 	}, nil
 }
 

server/service/async/async.go

@@ -141,7 +141,8 @@ func loadActiveHostIDs(pool fleet.RedisPool, zsetKey string, scanCount int) ([]h
 			return nil, fmt.Errorf("convert scan results: %w", err)
 		}
 		for i := 0; i < len(hostVals); i += 2 {
-			hosts = append(hosts, hostIDLastReported{HostID: hostVals[i], LastReported: int64(hostVals[i+1])})
+			hosts = append(hosts,
+				hostIDLastReported{HostID: hostVals[i], LastReported: int64(hostVals[i+1])}) //nolint:gosec // dismiss G115
 		}
 
 		if cursor == 0 {

server/service/async/async_host_seen_test.go

@@ -32,7 +32,7 @@ func testCollectHostsLastSeen(t *testing.T, ds *mysql.Datastore, pool fleet.Redi
 	hostIDs := createHosts(t, ds, 4, startTime)
 	t.Logf("real host IDs: %v", hostIDs)
 	hid := func(id int) int {
-		return int(hostIDs[id-1])
+		return int(hostIDs[id-1]) //nolint:gosec // dismiss G115
 	}
 
 	// note that cases cannot be run in isolation, each case builds on the