fix(lint): resolve remaining 15 golangci-lint issues

- errcheck: handle return values in hpc/slurm_client (4 fmt.Sscanf),
  stackdrift/service (2 json.Unmarshal), tidb/service (1 ShouldBindJSON)
- godot: add trailing periods to comments in identity/service_account (5),
  pkg/iam/actions (3)
- bodyclose: add nolint annotation in scheduler/service for closure-captured
  response (body is closed on both error and success paths)

golangci-lint now passes with 0 issues.

Author: slchris

internal/management/hpc/slurm_client.go

@@ -584,18 +584,18 @@ func parseWallTime(wallTime string) int {
 			_, _ = fmt.Sscanf(dParts[1], "%d", &h)
 			h += d * 24
 		} else {
-			fmt.Sscanf(hourPart, "%d", &h)
+			_, _ = fmt.Sscanf(hourPart, "%d", &h)
 		}
-		fmt.Sscanf(parts[1], "%d", &m)
+		_, _ = fmt.Sscanf(parts[1], "%d", &m)
 		return h*60 + m
 	case 2: // HH:MM
 		var h, m int
-		fmt.Sscanf(parts[0], "%d", &h)
-		fmt.Sscanf(parts[1], "%d", &m)
+		_, _ = fmt.Sscanf(parts[0], "%d", &h)
+		_, _ = fmt.Sscanf(parts[1], "%d", &m)
 		return h*60 + m
 	default:
 		var mins int
-		fmt.Sscanf(wallTime, "%d", &mins)
+		_, _ = fmt.Sscanf(wallTime, "%d", &mins)
 		return mins
 	}
 }

internal/management/identity/service_account.go

@@ -89,7 +89,7 @@ func (sa *ServiceAccount) IsExpired() bool {
 // ──────────────────────────────────────────────────────────────────────
 
 // generateAccessKeyID generates a unique access key ID.
-// Format: VC-AKIA-{16 hex chars} (24 chars total)
+// Format: VC-AKIA-{16 hex chars} (24 chars total).
 func generateAccessKeyID() (string, error) {
 	b := make([]byte, 8) // 16 hex chars
 	if _, err := rand.Read(b); err != nil {
@@ -99,7 +99,7 @@ func generateAccessKeyID() (string, error) {
 }
 
 // generateSecretKey generates a cryptographically random secret key.
-// Format: base64url-encoded 32 bytes (43 chars)
+// Format: base64url-encoded 32 bytes (43 chars).
 func generateSecretKey() (string, error) {
 	b := make([]byte, 32)
 	if _, err := rand.Read(b); err != nil {
@@ -113,11 +113,11 @@ func generateSecretKey() (string, error) {
 // ──────────────────────────────────────────────────────────────────────
 
 // HMACAuth is the authorization header scheme for API key authentication.
-// Format: VC-HMAC-SHA256 AccessKeyId={key}, Timestamp={unix}, Signature={sig}
+// Format: VC-HMAC-SHA256 AccessKeyId={key}, Timestamp={unix}, Signature={sig}.
 const HMACAuth = "VC-HMAC-SHA256"
 
 // computeHMAC computes the HMAC-SHA256 signature for API key authentication.
-// The signing string is: "accessKeyID\ntimestamp\nHTTPMethod\npath"
+// The signing string is: "accessKeyID\ntimestamp\nHTTPMethod\npath".
 func computeHMAC(secretKey, accessKeyID, timestamp, method, path string) string {
 	signingString := accessKeyID + "\n" + timestamp + "\n" + method + "\n" + path
 	mac := hmac.New(sha256.New, []byte(secretKey))
@@ -666,7 +666,7 @@ func (s *Service) handleAPIKeyAuth(c *gin.Context, authHeader string) {
 }
 
 // parseHMACParams parses the HMAC authorization header parameters.
-// Input: "VC-HMAC-SHA256 AccessKeyId=XXX, Timestamp=YYY, Signature=ZZZ"
+// Input: "VC-HMAC-SHA256 AccessKeyId=XXX, Timestamp=YYY, Signature=ZZZ".
 func parseHMACParams(header string) map[string]string {
 	result := map[string]string{}
 

internal/management/scheduler/service.go

@@ -331,7 +331,7 @@ func (s *Service) dispatchVMCreate(c *gin.Context) {
 		reqHTTP, _ := http.NewRequest("POST", addr, buf)
 		reqHTTP.Header.Set("Content-Type", "application/json")
 		var reqErr error
-		httpResp, reqErr = http.DefaultClient.Do(reqHTTP) // #nosec
+		httpResp, reqErr = http.DefaultClient.Do(reqHTTP) //nolint:bodyclose // closed on both error and success paths
 		return reqErr
 	})
 	if cbErr != nil {

internal/management/stackdrift/service.go

@@ -136,7 +136,9 @@ func (s *Service) DetectDrift(stackID uint) (*DriftReport, error) {
 
 	// Parse template to get declared resources.
 	var declared map[string]interface{}
-	json.Unmarshal([]byte(active.Template), &declared)
+	if err := json.Unmarshal([]byte(active.Template), &declared); err != nil {
+		return nil, fmt.Errorf("parse template: %w", err)
+	}
 
 	// Simulate drift detection comparing template vs actual state.
 	// In production, each resource type would have a provider that checks real state.
@@ -174,7 +176,9 @@ func (s *Service) GetDepGraph(stackID uint) ([]DepNode, error) {
 	}
 
 	var tmpl map[string]interface{}
-	json.Unmarshal([]byte(active.Template), &tmpl)
+	if err := json.Unmarshal([]byte(active.Template), &tmpl); err != nil {
+		return nil, fmt.Errorf("parse template: %w", err)
+	}
 
 	var nodes []DepNode
 	if resources, ok := tmpl["resources"].([]interface{}); ok {

internal/management/tidb/service.go

@@ -261,7 +261,7 @@ func (s *Service) handleCreateBackup(c *gin.Context) {
 	var req struct {
 		Type string `json:"type"`
 	}
-	c.ShouldBindJSON(&req)
+	_ = c.ShouldBindJSON(&req)
 	b, err := s.CreateBackup(uint(id), req.Type)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})

pkg/iam/actions.go

@@ -159,21 +159,21 @@ const (
 	IAMCreateProject = "vc:iam:CreateProject"
 	IAMDeleteProject = "vc:iam:DeleteProject"
 
-	// Service Account Actions (P3)
+	// Service Account Actions (P3).
 	IAMListServiceAccounts  = "vc:iam:ListServiceAccounts"
 	IAMGetServiceAccount    = "vc:iam:GetServiceAccount"
 	IAMCreateServiceAccount = "vc:iam:CreateServiceAccount"
 	IAMDeleteServiceAccount = "vc:iam:DeleteServiceAccount"
 	IAMRotateServiceAccount = "vc:iam:RotateServiceAccountKey"
 
-	// Group Actions (P5)
+	// Group Actions (P5).
 	IAMListGroups  = "vc:iam:ListGroups"
 	IAMGetGroup    = "vc:iam:GetGroup"
 	IAMCreateGroup = "vc:iam:CreateGroup"
 	IAMUpdateGroup = "vc:iam:UpdateGroup"
 	IAMDeleteGroup = "vc:iam:DeleteGroup"
 
-	// Permission Boundary Actions (P5)
+	// Permission Boundary Actions (P5).
 	IAMSetPermissionBoundary    = "vc:iam:SetPermissionBoundary"
 	IAMGetPermissionBoundary    = "vc:iam:GetPermissionBoundary"
 	IAMDeletePermissionBoundary = "vc:iam:DeletePermissionBoundary"