fix: comprehensive CI fixes - formatting, race conditions, and security issues

This commit addresses all CI failures identified in PR #66:

**Formatting Fixes:**
- Applied go fmt to 24 files across multiple packages
- Fixed code formatting issues in internal/executor/, internal/monitoring/,
  internal/reporting/, internal/resilience/, and tests/chaos/

**Race Condition Fixes:**
- Added mutex synchronization to MockNotificationHandler in reporting tests
- Implemented thread-safe getter methods for notification access
- Fixed concurrent read/write access to notifications slice
- Added proper synchronization to prevent race conditions during test execution

**Security Improvements:**
- Fixed integer overflow warnings in metrics_collector.go
- Implemented safe int64 to uint64 conversion with bounds checking
- Eliminated all 4 security warnings from gosec scan

**Test Infrastructure:**
- Enhanced MockNotificationHandler with GetNotificationCount() and GetNotification() methods
- Updated test assertions to use thread-safe access methods
- Improved test reliability under race detection

All local validation now passes:
- make lint: 0 issues
- go test -race ./...: no race conditions
- make security: 0 security issues
- All tests passing

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: starbops

internal/executor/errors.go

@@ -15,28 +15,28 @@ type ErrorType string
 const (
 	// ErrorTypeInfrastructure indicates infrastructure-related failures
 	ErrorTypeInfrastructure ErrorType = "infrastructure"
-	
+
 	// ErrorTypeResource indicates resource exhaustion or limits
 	ErrorTypeResource ErrorType = "resource"
-	
+
 	// ErrorTypeTimeout indicates execution timeout
 	ErrorTypeTimeout ErrorType = "timeout"
-	
+
 	// ErrorTypeUserCode indicates user script execution errors
 	ErrorTypeUserCode ErrorType = "user_code"
-	
+
 	// ErrorTypeValidation indicates input validation errors
 	ErrorTypeValidation ErrorType = "validation"
-	
+
 	// ErrorTypeSecurity indicates security policy violations
 	ErrorTypeSecurity ErrorType = "security"
-	
+
 	// ErrorTypeNetwork indicates network connectivity issues
 	ErrorTypeNetwork ErrorType = "network"
-	
+
 	// ErrorTypeRateLimit indicates rate limiting enforcement
 	ErrorTypeRateLimit ErrorType = "rate_limit"
-	
+
 	// ErrorTypeQuota indicates quota enforcement
 	ErrorTypeQuota ErrorType = "quota"
 )
@@ -331,7 +331,7 @@ func ClassifyError(err error, taskID uuid.UUID, context string) *ExecutionError
 
 	errMsg := err.Error()
 	errMsgLower := strings.ToLower(errMsg)
-	
+
 	// Default execution error
 	execErr := NewExecutionError(ErrorTypeInfrastructure, "UNKNOWN_ERROR", "Unknown execution error", taskID).
 		WithCause(err).
@@ -446,14 +446,14 @@ func ClassifyError(err error, taskID uuid.UUID, context string) *ExecutionError
 // ClassifyDockerError specifically classifies Docker-related errors
 func ClassifyDockerError(err error, taskID uuid.UUID, containerID string) *ExecutionError {
 	execErr := ClassifyError(err, taskID, "docker_operation")
-	
+
 	if containerID != "" {
 		_ = execErr.WithContainerID(containerID)
 	}
 
 	// Add Docker-specific context
 	_ = execErr.WithContext("error_source", "docker_client")
-	
+
 	return execErr
 }
 

internal/executor/errors_test.go

@@ -240,7 +240,7 @@ func TestExecutionError(t *testing.T) {
 
 	t.Run("NewExecutionError creates error with required fields", func(t *testing.T) {
 		err := NewExecutionError(ErrorTypeTimeout, "TIMEOUT_001", "Execution timed out", taskID)
-		
+
 		assert.Equal(t, ErrorTypeTimeout, err.Type)
 		assert.Equal(t, "TIMEOUT_001", err.Code)
 		assert.Equal(t, "Execution timed out", err.Message)
@@ -252,7 +252,7 @@ func TestExecutionError(t *testing.T) {
 
 	t.Run("ExecutionError builder methods work correctly", func(t *testing.T) {
 		cause := errors.New("underlying error")
-		
+
 		err := NewExecutionError(ErrorTypeResource, "MEM_001", "Out of memory", taskID).
 			WithCause(cause).
 			WithDetails("Container exceeded 512MB limit").
@@ -285,7 +285,7 @@ func TestExecutionError(t *testing.T) {
 	t.Run("ExecutionError Unwrap works correctly", func(t *testing.T) {
 		cause := errors.New("underlying error")
 		err := NewExecutionError(ErrorTypeTimeout, "TIMEOUT_001", "Execution timed out", taskID).WithCause(cause)
-		
+
 		assert.Equal(t, cause, err.Unwrap())
 		assert.True(t, errors.Is(err, cause))
 	})
@@ -295,139 +295,139 @@ func TestClassifyError(t *testing.T) {
 	taskID := uuid.New()
 
 	tests := []struct {
-		name           string
-		inputError     error
-		context        string
-		expectedType   ErrorType
-		expectedCode   string
-		expectedRetry  bool
+		name          string
+		inputError    error
+		context       string
+		expectedType  ErrorType
+		expectedCode  string
+		expectedRetry bool
 	}{
 		{
-			name:           "Docker daemon unavailable",
-			inputError:     errors.New("Cannot connect to the Docker daemon"),
-			context:        "container_create",
-			expectedType:   ErrorTypeInfrastructure,
-			expectedCode:   "DOCKER_DAEMON_UNAVAILABLE",
-			expectedRetry:  true,
+			name:          "Docker daemon unavailable",
+			inputError:    errors.New("Cannot connect to the Docker daemon"),
+			context:       "container_create",
+			expectedType:  ErrorTypeInfrastructure,
+			expectedCode:  "DOCKER_DAEMON_UNAVAILABLE",
+			expectedRetry: true,
 		},
 		{
-			name:           "Container not found",
-			inputError:     errors.New("No such container: abc123"),
-			context:        "container_stop",
-			expectedType:   ErrorTypeInfrastructure,
-			expectedCode:   "CONTAINER_NOT_FOUND",
-			expectedRetry:  false,
+			name:          "Container not found",
+			inputError:    errors.New("No such container: abc123"),
+			context:       "container_stop",
+			expectedType:  ErrorTypeInfrastructure,
+			expectedCode:  "CONTAINER_NOT_FOUND",
+			expectedRetry: false,
 		},
 		{
-			name:           "Image not found",
-			inputError:     errors.New("pull access denied for python:latest"),
-			context:        "image_pull",
-			expectedType:   ErrorTypeInfrastructure,
-			expectedCode:   "IMAGE_NOT_FOUND",
-			expectedRetry:  false,
+			name:          "Image not found",
+			inputError:    errors.New("pull access denied for python:latest"),
+			context:       "image_pull",
+			expectedType:  ErrorTypeInfrastructure,
+			expectedCode:  "IMAGE_NOT_FOUND",
+			expectedRetry: false,
 		},
 		{
-			name:           "Execution timeout",
-			inputError:     errors.New("context deadline exceeded"),
-			context:        "task_execution",
-			expectedType:   ErrorTypeTimeout,
-			expectedCode:   "EXECUTION_TIMEOUT",
-			expectedRetry:  true,
+			name:          "Execution timeout",
+			inputError:    errors.New("context deadline exceeded"),
+			context:       "task_execution",
+			expectedType:  ErrorTypeTimeout,
+			expectedCode:  "EXECUTION_TIMEOUT",
+			expectedRetry: true,
 		},
 		{
-			name:           "Out of memory",
-			inputError:     errors.New("container killed due to OOM"),
-			context:        "task_execution",
-			expectedType:   ErrorTypeResource,
-			expectedCode:   "OUT_OF_MEMORY",
-			expectedRetry:  false,
+			name:          "Out of memory",
+			inputError:    errors.New("container killed due to OOM"),
+			context:       "task_execution",
+			expectedType:  ErrorTypeResource,
+			expectedCode:  "OUT_OF_MEMORY",
+			expectedRetry: false,
 		},
 		{
-			name:           "Disk space exhausted",
-			inputError:     errors.New("no space left on device"),
-			context:        "container_create",
-			expectedType:   ErrorTypeResource,
-			expectedCode:   "OUT_OF_DISK_SPACE",
-			expectedRetry:  true,
+			name:          "Disk space exhausted",
+			inputError:    errors.New("no space left on device"),
+			context:       "container_create",
+			expectedType:  ErrorTypeResource,
+			expectedCode:  "OUT_OF_DISK_SPACE",
+			expectedRetry: true,
 		},
 		{
-			name:           "CPU quota exceeded",
-			inputError:     errors.New("CPU quota exceeded for container"),
-			context:        "task_execution",
-			expectedType:   ErrorTypeResource,
-			expectedCode:   "CPU_QUOTA_EXCEEDED",
-			expectedRetry:  true,
+			name:          "CPU quota exceeded",
+			inputError:    errors.New("CPU quota exceeded for container"),
+			context:       "task_execution",
+			expectedType:  ErrorTypeResource,
+			expectedCode:  "CPU_QUOTA_EXCEEDED",
+			expectedRetry: true,
 		},
 		{
-			name:           "Network error",
-			inputError:     errors.New("network connection failed"),
-			context:        "container_start",
-			expectedType:   ErrorTypeNetwork,
-			expectedCode:   "NETWORK_ERROR",
-			expectedRetry:  true,
+			name:          "Network error",
+			inputError:    errors.New("network connection failed"),
+			context:       "container_start",
+			expectedType:  ErrorTypeNetwork,
+			expectedCode:  "NETWORK_ERROR",
+			expectedRetry: true,
 		},
 		{
-			name:           "Permission denied",
-			inputError:     errors.New("permission denied: cannot access file"),
-			context:        "file_access",
-			expectedType:   ErrorTypeSecurity,
-			expectedCode:   "PERMISSION_DENIED",
-			expectedRetry:  false,
+			name:          "Permission denied",
+			inputError:    errors.New("permission denied: cannot access file"),
+			context:       "file_access",
+			expectedType:  ErrorTypeSecurity,
+			expectedCode:  "PERMISSION_DENIED",
+			expectedRetry: false,
 		},
 		{
-			name:           "Rate limit exceeded",
-			inputError:     errors.New("rate limit exceeded for API calls"),
-			context:        "api_call",
-			expectedType:   ErrorTypeRateLimit,
-			expectedCode:   "RATE_LIMIT_EXCEEDED",
-			expectedRetry:  true,
+			name:          "Rate limit exceeded",
+			inputError:    errors.New("rate limit exceeded for API calls"),
+			context:       "api_call",
+			expectedType:  ErrorTypeRateLimit,
+			expectedCode:  "RATE_LIMIT_EXCEEDED",
+			expectedRetry: true,
 		},
 		{
-			name:           "Quota exceeded",
-			inputError:     errors.New("quota limit exceeded for user"),
-			context:        "resource_allocation",
-			expectedType:   ErrorTypeQuota,
-			expectedCode:   "QUOTA_EXCEEDED",
-			expectedRetry:  false,
+			name:          "Quota exceeded",
+			inputError:    errors.New("quota limit exceeded for user"),
+			context:       "resource_allocation",
+			expectedType:  ErrorTypeQuota,
+			expectedCode:  "QUOTA_EXCEEDED",
+			expectedRetry: false,
 		},
 		{
-			name:           "Validation error",
-			inputError:     errors.New("invalid input format provided"),
-			context:        "input_validation",
-			expectedType:   ErrorTypeValidation,
-			expectedCode:   "VALIDATION_ERROR",
-			expectedRetry:  false,
+			name:          "Validation error",
+			inputError:    errors.New("invalid input format provided"),
+			context:       "input_validation",
+			expectedType:  ErrorTypeValidation,
+			expectedCode:  "VALIDATION_ERROR",
+			expectedRetry: false,
 		},
 		{
-			name:           "User code error",
-			inputError:     errors.New("command failed with exit status 1"),
-			context:        "script_execution",
-			expectedType:   ErrorTypeUserCode,
-			expectedCode:   "USER_CODE_ERROR",
-			expectedRetry:  false,
+			name:          "User code error",
+			inputError:    errors.New("command failed with exit status 1"),
+			context:       "script_execution",
+			expectedType:  ErrorTypeUserCode,
+			expectedCode:  "USER_CODE_ERROR",
+			expectedRetry: false,
 		},
 		{
-			name:           "Cancellation error",
-			inputError:     errors.New("operation was cancelled by user"),
-			context:        "task_execution",
-			expectedType:   ErrorTypeTimeout,
-			expectedCode:   "EXECUTION_CANCELLED",
-			expectedRetry:  false,
+			name:          "Cancellation error",
+			inputError:    errors.New("operation was cancelled by user"),
+			context:       "task_execution",
+			expectedType:  ErrorTypeTimeout,
+			expectedCode:  "EXECUTION_CANCELLED",
+			expectedRetry: false,
 		},
 		{
-			name:           "Unknown error",
-			inputError:     errors.New("something completely unexpected happened"),
-			context:        "unknown_operation",
-			expectedType:   ErrorTypeInfrastructure,
-			expectedCode:   "UNKNOWN_ERROR",
-			expectedRetry:  true,
+			name:          "Unknown error",
+			inputError:    errors.New("something completely unexpected happened"),
+			context:       "unknown_operation",
+			expectedType:  ErrorTypeInfrastructure,
+			expectedCode:  "UNKNOWN_ERROR",
+			expectedRetry: true,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			execErr := ClassifyError(tt.inputError, taskID, tt.context)
-			
+
 			require.NotNil(t, execErr)
 			assert.Equal(t, tt.expectedType, execErr.Type)
 			assert.Equal(t, tt.expectedCode, execErr.Code)
@@ -446,7 +446,7 @@ func TestClassifyError(t *testing.T) {
 	t.Run("Already classified ExecutionError returns as-is", func(t *testing.T) {
 		original := NewExecutionError(ErrorTypeValidation, "TEST_001", "Test error", taskID)
 		result := ClassifyError(original, taskID, "test")
-		
+
 		assert.Equal(t, original, result)
 	})
 }
@@ -458,7 +458,7 @@ func TestClassifyDockerError(t *testing.T) {
 	t.Run("Classifies Docker error with container ID", func(t *testing.T) {
 		err := errors.New("Docker daemon connection refused")
 		execErr := ClassifyDockerError(err, taskID, containerID)
-		
+
 		require.NotNil(t, execErr)
 		assert.Equal(t, ErrorTypeInfrastructure, execErr.Type)
 		assert.Equal(t, "DOCKER_DAEMON_UNAVAILABLE", execErr.Code)
@@ -470,7 +470,7 @@ func TestClassifyDockerError(t *testing.T) {
 	t.Run("Handles empty container ID", func(t *testing.T) {
 		err := errors.New("No such container")
 		execErr := ClassifyDockerError(err, taskID, "")
-		
+
 		require.NotNil(t, execErr)
 		assert.Equal(t, ErrorTypeInfrastructure, execErr.Type)
 		assert.Equal(t, "CONTAINER_NOT_FOUND", execErr.Code)
@@ -484,7 +484,7 @@ func TestIsRetryableError(t *testing.T) {
 	t.Run("ExecutionError retryable flag is respected", func(t *testing.T) {
 		retryableErr := NewExecutionError(ErrorTypeTimeout, "TIMEOUT_001", "Timeout", taskID).SetRetryable(true)
 		nonRetryableErr := NewExecutionError(ErrorTypeUserCode, "USER_001", "User error", taskID).SetRetryable(false)
-		
+
 		assert.True(t, IsRetryableError(retryableErr))
 		assert.False(t, IsRetryableError(nonRetryableErr))
 	})
@@ -509,13 +509,13 @@ func TestGetErrorType(t *testing.T) {
 		assert.Equal(t, ErrorTypeTimeout, GetErrorType(ErrExecutionTimeout))
 		assert.Equal(t, ErrorTypeInfrastructure, GetErrorType(ErrDockerUnavailable))
 		assert.Equal(t, ErrorTypeResource, GetErrorType(ErrResourceExhausted))
-		
+
 		secErr := NewSecurityError("test", "test", nil)
 		assert.Equal(t, ErrorTypeSecurity, GetErrorType(secErr))
-		
+
 		confErr := ErrInvalidConfig("test")
 		assert.Equal(t, ErrorTypeValidation, GetErrorType(confErr))
-		
+
 		unknownErr := errors.New("unknown")
 		assert.Equal(t, ErrorTypeInfrastructure, GetErrorType(unknownErr))
 	})
@@ -532,7 +532,7 @@ func TestIsExecutionError(t *testing.T) {
 	t.Run("Rejects non-ExecutionError types", func(t *testing.T) {
 		assert.False(t, IsExecutionError(ErrExecutionTimeout))
 		assert.False(t, IsExecutionError(errors.New("standard error")))
-		
+
 		containerErr := NewContainerError("container123", "test", "test", nil)
 		assert.False(t, IsExecutionError(containerErr))
 	})