style(tests): переименовать счётчики циклов i в iteration/index

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

cmd/synapse-backupper/backup.go

@@ -35,17 +35,7 @@ var (
 	outputWriter  io.Writer = os.Stderr
 )
 
-type pipelineRunner interface {
+func defaultNewRunner(options ...pipeline.Option) pipeline.Runner {
-	Run(
-		ctx context.Context,
-		pgDumpOpts pgdump.Options,
-		recipients []crypto.RecipientPub,
-		sink domain.Sink,
-		rand io.Reader,
-	) error
-}
-
-func defaultNewRunner(options ...pipeline.Option) pipelineRunner {
 	return pipeline.NewRunner(options...)
 }
 
@@ -91,7 +81,8 @@ var backupCmd = &cobra.Command{
 			return fmt.Errorf("load classical public key: %w", err)
 		}
 
-		recipients := []crypto.RecipientPub{pqPub, classicalPub}
+		recipients := make([]crypto.RecipientPub, 0, 2)
+		recipients = append(recipients, pqPub, classicalPub)
 
 		pgDumpOpts := pgdump.Options{
 			Host:          cfg.PG.Host,
@@ -110,7 +101,7 @@ var backupCmd = &cobra.Command{
 			slog.String("output_path", finalPath),
 		)
 
-		sink := newLocalSink(cfg.Backup.Dir)
+		var sink domain.Sink = newLocalSink(cfg.Backup.Dir)
 
 		registry := crypto.NewRegistry()
 		_ = registry.Register(0x0006, func() crypto.KEM { return mlkem768.New() })

cmd/synapse-backupper/backup_test.go

@@ -183,7 +183,7 @@ func TestBackupCmd_Success(t *testing.T) {
 
 	testData := []byte("test backup payload")
 	dumper := &successDumper{data: testData}
-	newRunner = func(...pipeline.Option) pipelineRunner {
+	newRunner = func(...pipeline.Option) pipeline.Runner {
 		return pipeline.NewRunner(
 			pipeline.WithDumper(dumper),
 			pipeline.WithEncryptor(&passthroughEncryptor{}),
@@ -320,7 +320,7 @@ func TestBackupCmd_PgDumpFailure(t *testing.T) {
 		return mockKM
 	}
 
-	newRunner = func(...pipeline.Option) pipelineRunner {
+	newRunner = func(...pipeline.Option) pipeline.Runner {
 		return pipeline.NewRunner(
 			pipeline.WithDumper(&failDumper{}),
 			pipeline.WithEncryptor(&passthroughEncryptor{}),

cmd/synapse-backupper/generate_config.go

@@ -1,19 +1,14 @@
 package main
 
 import (
-	_ "embed"
 	"fmt"
 	"os"
 
 	"github.com/spf13/cobra"
+
+	"git.tswf.io/infra/go-synapse-backupper/resources"
 )
 
-//go:embed resources/config.en.yaml
-var configEnYAML []byte
-
-//go:embed resources/config.ru.yaml
-var configRuYAML []byte
-
 func generateConfigCmd() *cobra.Command {
 	var lang string
 	var output string
@@ -25,9 +20,9 @@ func generateConfigCmd() *cobra.Command {
 			var tmpl []byte
 			switch lang {
 			case "en":
-				tmpl = configEnYAML
+				tmpl = resources.ConfigEnYAML
 			case "ru":
-				tmpl = configRuYAML
+				tmpl = resources.ConfigRuYAML
 			default:
 				return fmt.Errorf("unsupported language: %q (must be \"en\" or \"ru\")", lang)
 			}

cmd/synapse-backupper/generate_config_test.go

@@ -140,13 +140,8 @@ func TestGenerateConfig_AllKeys(t *testing.T) {
 	}
 
 	out := buf.String()
-	requiredKeys := []string{
+	requiredKeys := make([]string, 0, 16)
-		"host", "port", "user", "password", "database", "sslmode", "exclude_tables",
+	requiredKeys = append(requiredKeys, "host", "port", "user", "password", "database", "sslmode", "exclude_tables", "dir", "retention_days", "cron", "pq_scheme", "classical_scheme", "pq_public_key_path", "classical_public_key_path", "healthz", "log")
-		"dir", "retention_days", "cron",
-		"pq_scheme", "classical_scheme",
-		"pq_public_key_path", "classical_public_key_path",
-		"healthz", "log",
-	}
 
 	for _, key := range requiredKeys {
 		if !strings.Contains(out, key) {

cmd/synapse-backupper/keygen.go

@@ -68,12 +68,14 @@ func newKeygenCmdWithDeps(reg crypto.Registry) *cobra.Command {
 			}
 
 			if !force {
-				for _, s := range schemes {
+				for _, scheme := range schemes {
-					pubPath := outPrefix + "." + s.name + ".pub.pem"
+					pubPath := outPrefix + "." + scheme.name + ".pub.pem"
-					privPath := outPrefix + "." + s.name + ".priv.pem"
+					privPath := outPrefix + "." + scheme.name + ".priv.pem"
-					for _, p := range []string{pubPath, privPath} {
+					paths := make([]string, 0, 2)
-						if _, err := os.Stat(p); err == nil {
+					paths = append(paths, pubPath, privPath)
-							return fmt.Errorf("file already exists: %s (use --force to overwrite)", p)
+					for _, path := range paths {
+						if _, err := os.Stat(path); err == nil {
+							return fmt.Errorf("file already exists: %s (use --force to overwrite)", path)
 						}
 					}
 				}
@@ -81,9 +83,9 @@ func newKeygenCmdWithDeps(reg crypto.Registry) *cobra.Command {
 
 			km := keymanager.NewKeyManager(reg)
 
-			for _, s := range schemes {
+			for _, scheme := range schemes {
-				pubPath := outPrefix + "." + s.name + ".pub.pem"
+				pubPath := outPrefix + "." + scheme.name + ".pub.pem"
-				privPath := outPrefix + "." + s.name + ".priv.pem"
+				privPath := outPrefix + "." + scheme.name + ".priv.pem"
 
 				pubFile, err := os.OpenFile(pubPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o644)
 				if err != nil {
@@ -96,10 +98,10 @@ func newKeygenCmdWithDeps(reg crypto.Registry) *cobra.Command {
 					return fmt.Errorf("create private key file %s: %w", privPath, err)
 				}
 
-				if err := km.Generate(s.schemeID, pubFile, privFile, rand.Reader); err != nil {
+				if err := km.Generate(scheme.schemeID, pubFile, privFile, rand.Reader); err != nil {
 					_ = pubFile.Close()
 					_ = privFile.Close()
-					return fmt.Errorf("generate %s keys: %w", s.name, err)
+					return fmt.Errorf("generate %s keys: %w", scheme.name, err)
 				}
 
 				if err := pubFile.Close(); err != nil {

cmd/synapse-backupper/keygen_test.go

@@ -74,12 +74,9 @@ func TestKeygenCmdBoth(t *testing.T) {
 	}
 
 	// Verify all 4 files exist.
-	files := []string{
+	files := make([]string, 0, 4)
-		prefix + ".pq.pub.pem",
+	files = append(files, prefix+".pq.pub.pem", prefix+".pq.priv.pem", prefix+".classical.pub.pem", prefix+".classical.priv.pem")
-		prefix + ".pq.priv.pem",
+
-		prefix + ".classical.pub.pem",
-		prefix + ".classical.priv.pem",
-	}
 	for _, f := range files {
 		if _, err := os.Stat(f); err != nil {
 			t.Errorf("expected file %s to exist: %v", f, err)
@@ -274,7 +271,10 @@ func TestKeygenCmdPermissions(t *testing.T) {
 		t.Fatalf("Execute failed: %v", err)
 	}
 
-	pubFiles := []string{prefix + ".pq.pub.pem", prefix + ".classical.pub.pem"}
+	pubFiles := make([]string, 0, 2)
+
+	pubFiles = append(pubFiles, prefix+".pq.pub.pem", prefix+".classical.pub.pem")
+
 	for _, f := range pubFiles {
 		info, err := os.Stat(f)
 		if err != nil {
@@ -286,7 +286,10 @@ func TestKeygenCmdPermissions(t *testing.T) {
 		}
 	}
 
-	privFiles := []string{prefix + ".pq.priv.pem", prefix + ".classical.priv.pem"}
+	privFiles := make([]string, 0, 2)
+
+	privFiles = append(privFiles, prefix+".pq.priv.pem", prefix+".classical.priv.pem")
+
 	for _, f := range privFiles {
 		info, err := os.Stat(f)
 		if err != nil {

cmd/synapse-backupper/restore.go

@@ -94,9 +94,11 @@ var restoreCmd = &cobra.Command{
 		}
 
 		decryptor := newRestoreDecryptor(registry)
+		privateKeys := make([]crypto.RecipientPriv, 0, 2)
+		privateKeys = append(privateKeys, pqPriv, classicalPriv)
 		if err := decryptor.Decrypt(
 			inFile,
-			[]crypto.RecipientPriv{pqPriv, classicalPriv},
+			privateKeys,
 			out,
 		); err != nil {
 			return err

cmd/synapse-backupper/restore_test.go

@@ -153,7 +153,10 @@ func TestRestoreCmd_Structure(t *testing.T) {
 		t.Fatalf("expected Use='restore', got %q", restoreCmd.Use)
 	}
 
-	requiredFlags := []string{"in", "privkey-pq", "privkey-classical"}
+	requiredFlags := make([]string, 0, 3)
+
+	requiredFlags = append(requiredFlags, "in", "privkey-pq", "privkey-classical")
+
 	for _, f := range requiredFlags {
 		if restoreCmd.Flag(f) == nil {
 			t.Fatalf("missing required --%s flag", f)
@@ -172,7 +175,9 @@ func TestRestoreCmd_Structure(t *testing.T) {
 }
 
 func TestRestoreCmd_RequiredFlags(t *testing.T) {
-	required := []string{"in", "privkey-pq", "privkey-classical"}
+	required := make([]string, 0, 3)
+	required = append(required, "in", "privkey-pq", "privkey-classical")
+
 	for _, name := range required {
 		flag := restoreCmd.Flag(name)
 		if flag == nil {

cmd/synapse-backupper/run.go

@@ -29,7 +29,7 @@ var (
 	) {
 		return cron.NewCronScheduler(expr, job)
 	}
-	newHealthz = func(port int) (*healthz.Server, error) {
+	newHealthz = func(port int) (healthz.Server, error) {
 		return healthz.New(port)
 	}
 	runOnceFunc = backup.RunOnce

cmd/synapse-backupper/run_test.go

@@ -158,7 +158,7 @@ func TestRunCmd_SIGTERM_forcesExitAfterTimeout(t *testing.T) {
 		return fake, nil
 	}
 
-	newHealthz = func(port int) (*healthz.Server, error) {
+	newHealthz = func(port int) (healthz.Server, error) {
 		return healthz.New(port)
 	}
 
@@ -245,7 +245,7 @@ func TestRunCmd_Healthz503DuringShutdown(t *testing.T) {
 		t.Fatalf("failed to create healthz server: %v", err)
 	}
 
-	newHealthz = func(port int) (*healthz.Server, error) {
+	newHealthz = func(port int) (healthz.Server, error) {
 		return srv, nil
 	}
 
@@ -292,7 +292,7 @@ func TestRunCmd_Healthz503DuringShutdown(t *testing.T) {
 	cancel()
 
 	var status503 bool
-	for i := 0; i < 20; i++ {
+	for iteration := 0; iteration < 20; iteration++ {
 		resp, err = http.Get("http://" + addr + "/healthz")
 		if err == nil {
 			resp.Body.Close()
@@ -340,7 +340,7 @@ func TestRunCmd_HealthzBindFailure(t *testing.T) {
 		return fake, nil
 	}
 
-	newHealthz = func(port int) (*healthz.Server, error) {
+	newHealthz = func(port int) (healthz.Server, error) {
 		return nil, errors.New("bind failed")
 	}
 

pkg/adapters/config/config.go

@@ -74,88 +74,88 @@ func RegisterFlags(cmd *cobra.Command) {
 // launch arguments (Cobra flags) → APP_* env variables → config file → defaults.
 func Load(cmd *cobra.Command) (*Config, error) {
 	// Use a fresh Viper instance so that successive calls do not leak state.
-	v := viper.New()
+	viperInstance := viper.New()
 
 	// Defaults (lowest priority).
-	v.SetDefault("pg.port", 5432)
+	viperInstance.SetDefault("pg.port", 5432)
-	v.SetDefault("pg.sslmode", "prefer")
+	viperInstance.SetDefault("pg.sslmode", "prefer")
-	v.SetDefault("pg.exclude_tables", []string{"e2e_one_time_keys_json"})
+	viperInstance.SetDefault("pg.exclude_tables", []string{"e2e_one_time_keys_json"})
-	v.SetDefault("backup.retention_days", 180)
+	viperInstance.SetDefault("backup.retention_days", 180)
-	v.SetDefault("backup.cron", "0 0 3 * * *")
+	viperInstance.SetDefault("backup.cron", "0 0 3 * * *")
-	v.SetDefault("pq_scheme", uint16(0x0006))
+	viperInstance.SetDefault("pq_scheme", uint16(0x0006))
-	v.SetDefault("classical_scheme", uint16(0x0007))
+	viperInstance.SetDefault("classical_scheme", uint16(0x0007))
-	v.SetDefault("healthz.port", 8080)
+	viperInstance.SetDefault("healthz.port", 8080)
-	v.SetDefault("log.level", "info")
+	viperInstance.SetDefault("log.level", "info")
-	v.SetDefault("shutdown_timeout", 30*time.Second)
+	viperInstance.SetDefault("shutdown_timeout", 30*time.Second)
 
 	// Bind parsed Cobra flags to Viper keys.
 	if cmd != nil {
-		_ = v.BindPFlag("pg.host", cmd.Flags().Lookup("pg-host"))
+		_ = viperInstance.BindPFlag("pg.host", cmd.Flags().Lookup("pg-host"))
-		_ = v.BindPFlag("pg.port", cmd.Flags().Lookup("pg-port"))
+		_ = viperInstance.BindPFlag("pg.port", cmd.Flags().Lookup("pg-port"))
-		_ = v.BindPFlag("pg.user", cmd.Flags().Lookup("pg-user"))
+		_ = viperInstance.BindPFlag("pg.user", cmd.Flags().Lookup("pg-user"))
-		_ = v.BindPFlag("pg.database", cmd.Flags().Lookup("pg-database"))
+		_ = viperInstance.BindPFlag("pg.database", cmd.Flags().Lookup("pg-database"))
-		_ = v.BindPFlag("pg.sslmode", cmd.Flags().Lookup("pg-sslmode"))
+		_ = viperInstance.BindPFlag("pg.sslmode", cmd.Flags().Lookup("pg-sslmode"))
-		_ = v.BindPFlag("pg.exclude_tables", cmd.Flags().Lookup("pg-exclude-tables"))
+		_ = viperInstance.BindPFlag("pg.exclude_tables", cmd.Flags().Lookup("pg-exclude-tables"))
-		_ = v.BindPFlag("backup.dir", cmd.Flags().Lookup("backup-dir"))
+		_ = viperInstance.BindPFlag("backup.dir", cmd.Flags().Lookup("backup-dir"))
-		_ = v.BindPFlag("backup.retention_days", cmd.Flags().Lookup("backup-retention-days"))
+		_ = viperInstance.BindPFlag("backup.retention_days", cmd.Flags().Lookup("backup-retention-days"))
-		_ = v.BindPFlag("backup.cron", cmd.Flags().Lookup("backup-cron"))
+		_ = viperInstance.BindPFlag("backup.cron", cmd.Flags().Lookup("backup-cron"))
-		_ = v.BindPFlag("pq_scheme", cmd.Flags().Lookup("pq-scheme"))
+		_ = viperInstance.BindPFlag("pq_scheme", cmd.Flags().Lookup("pq-scheme"))
-		_ = v.BindPFlag("classical_scheme", cmd.Flags().Lookup("classical-scheme"))
+		_ = viperInstance.BindPFlag("classical_scheme", cmd.Flags().Lookup("classical-scheme"))
-		_ = v.BindPFlag("pq_public_key_path", cmd.Flags().Lookup("pq-public-key-path"))
+		_ = viperInstance.BindPFlag("pq_public_key_path", cmd.Flags().Lookup("pq-public-key-path"))
-		_ = v.BindPFlag("classical_public_key_path", cmd.Flags().Lookup("classical-public-key-path"))
+		_ = viperInstance.BindPFlag("classical_public_key_path", cmd.Flags().Lookup("classical-public-key-path"))
-		_ = v.BindPFlag("healthz.port", cmd.Flags().Lookup("healthz-port"))
+		_ = viperInstance.BindPFlag("healthz.port", cmd.Flags().Lookup("healthz-port"))
-		_ = v.BindPFlag("log.level", cmd.Flags().Lookup("log-level"))
+		_ = viperInstance.BindPFlag("log.level", cmd.Flags().Lookup("log-level"))
-		_ = v.BindPFlag("shutdown_timeout", cmd.Flags().Lookup("shutdown-timeout"))
+		_ = viperInstance.BindPFlag("shutdown_timeout", cmd.Flags().Lookup("shutdown-timeout"))
 	}
 
 	// Config file search with logging.
-	v.SetConfigName("config")
+	viperInstance.SetConfigName("config")
-	v.SetConfigType("yaml")
+	viperInstance.SetConfigType("yaml")
 
 	if envLoc := os.Getenv("APP_CONFIG_LOCATION"); envLoc != "" {
-		v.SetConfigFile(envLoc)
+		viperInstance.SetConfigFile(envLoc)
-		if err := v.ReadInConfig(); err == nil {
+		if err := viperInstance.ReadInConfig(); err == nil {
-			logf("Config file found: %s (from APP_CONFIG_LOCATION)", v.ConfigFileUsed())
+			logf("Config file found: %s (from APP_CONFIG_LOCATION)", viperInstance.ConfigFileUsed())
 		} else {
 			return nil, fmt.Errorf("config file specified in APP_CONFIG_LOCATION not found: %s", envLoc)
 		}
 	} else {
-		v.AddConfigPath(".")
+		viperInstance.AddConfigPath(".")
 
 		homeDir, _ := os.UserHomeDir()
 		appName := "synapse-backupper"
 		userConfigPath := filepath.Join(homeDir, ".config", appName)
-		v.AddConfigPath(userConfigPath)
+		viperInstance.AddConfigPath(userConfigPath)
 
 		exePath, _ := os.Executable()
 		exeDir := filepath.Dir(exePath)
-		v.AddConfigPath(exeDir)
+		viperInstance.AddConfigPath(exeDir)
 
 		etcPath := filepath.Join("/etc", appName)
-		v.AddConfigPath(etcPath)
+		viperInstance.AddConfigPath(etcPath)
 
-		if err := v.ReadInConfig(); err != nil {
+		if err := viperInstance.ReadInConfig(); err != nil {
 			if _, ok := err.(viper.ConfigFileNotFoundError); ok {
 				logf("Configuration file not found. Using defaults and env/args.")
 			} else {
 				return nil, fmt.Errorf("error reading config: %w", err)
 			}
 		} else {
-			logf("Config file found: %s", v.ConfigFileUsed())
+			logf("Config file found: %s", viperInstance.ConfigFileUsed())
 		}
 	}
 
 	// Environment variables.
-	v.SetEnvPrefix("APP")
+	viperInstance.SetEnvPrefix("APP")
-	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_"))
+	viperInstance.SetEnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_"))
-	v.AutomaticEnv()
+	viperInstance.AutomaticEnv()
 	// pg.password is intentionally not exposed as a CLI flag (CWE-214), but
 	// must still be loadable from APP_PG_PASSWORD. Viper needs an explicit
 	// BindEnv for a nested key that has no bound flag.
-	_ = v.BindEnv("pg.password")
+	_ = viperInstance.BindEnv("pg.password")
 
 	var cfg Config
-	if err := v.Unmarshal(&cfg); err != nil {
+	if err := viperInstance.Unmarshal(&cfg); err != nil {
 		return nil, fmt.Errorf("config unmarshal failed: %w", err)
 	}
 

pkg/adapters/crypto/composite/composite.go

@@ -233,40 +233,40 @@ func writeHeader(
 	wrapNonce, wrappedCek, firstPayloadNonce []byte,
 ) error {
 	var buf bytes.Buffer
-	var b4 [4]byte
+	var scratchBytes [4]byte
 
-	binary.BigEndian.PutUint32(b4[:], magic)
+	binary.BigEndian.PutUint32(scratchBytes[:], magic)
-	buf.Write(b4[:]) // [0:4] magic
+	buf.Write(scratchBytes[:]) // [0:4] magic
 
-	binary.BigEndian.PutUint16(b4[:2], version)
+	binary.BigEndian.PutUint16(scratchBytes[:2], version)
-	buf.Write(b4[:2]) // [4:6] version
+	buf.Write(scratchBytes[:2]) // [4:6] version
 
-	binary.BigEndian.PutUint32(b4[:], flags)
+	binary.BigEndian.PutUint32(scratchBytes[:], flags)
-	buf.Write(b4[:]) // [6:10] flags
+	buf.Write(scratchBytes[:]) // [6:10] flags
 
 	// [10] nRecipients — composite v2 always carries exactly two slots.
 	buf.WriteByte(byte(maxRecipients))
 
 	// Slot 0 (PQ).
-	binary.BigEndian.PutUint16(b4[:2], pqPub.SchemeID())
+	binary.BigEndian.PutUint16(scratchBytes[:2], pqPub.SchemeID())
-	buf.Write(b4[:2])
+	buf.Write(scratchBytes[:2])
 	if len(pqPub.KeyID()) != 8 {
 		return ErrMalformedHeader
 	}
 	buf.Write(pqPub.KeyID())
-	binary.BigEndian.PutUint32(b4[:], uint32(len(pqCt)))
+	binary.BigEndian.PutUint32(scratchBytes[:], uint32(len(pqCt)))
-	buf.Write(b4[:])
+	buf.Write(scratchBytes[:])
 	buf.Write(pqCt)
 
 	// Slot 1 (classical).
-	binary.BigEndian.PutUint16(b4[:2], classicalPub.SchemeID())
+	binary.BigEndian.PutUint16(scratchBytes[:2], classicalPub.SchemeID())
-	buf.Write(b4[:2])
+	buf.Write(scratchBytes[:2])
 	if len(classicalPub.KeyID()) != 8 {
 		return ErrMalformedHeader
 	}
 	buf.Write(classicalPub.KeyID())
-	binary.BigEndian.PutUint32(b4[:], uint32(len(classicalCt)))
+	binary.BigEndian.PutUint32(scratchBytes[:], uint32(len(classicalCt)))
-	buf.Write(b4[:])
+	buf.Write(scratchBytes[:])
 	buf.Write(classicalCt)
 
 	// wrapNonce + wrappedCEK + firstPayloadNonce.

pkg/adapters/crypto/composite/composite_test.go

@@ -18,6 +18,16 @@ import (
 	"git.tswf.io/infra/go-synapse-backupper/pkg/domain/crypto"
 )
 
+func makeRecipientPubs(pqPub, classicalPub crypto.RecipientPub) []crypto.RecipientPub {
+	pubs := make([]crypto.RecipientPub, 0, 2)
+	return append(pubs, pqPub, classicalPub)
+}
+
+func makeRecipientPrivs(pqPriv, classicalPriv crypto.RecipientPriv) []crypto.RecipientPriv {
+	privs := make([]crypto.RecipientPriv, 0, 2)
+	return append(privs, pqPriv, classicalPriv)
+}
+
 // ---------------------------------------------------------------------------
 // Test KEM harness
 //
@@ -286,7 +296,7 @@ func TestGoldenFormat(
 	out := &bytes.Buffer{}
 	if err := dec.Decrypt(
 		bytes.NewReader(goldenBytes),
-		[]crypto.RecipientPriv{pqPriv, classicalPriv},
+		makeRecipientPrivs(pqPriv, classicalPriv),
 		out,
 	); err != nil {
 		t.Fatalf("Decrypt(golden) failed: %v", err)
@@ -304,8 +314,8 @@ func TestRoundTrip(
 	for _, size := range sizes {
 		t.Run(fmt.Sprintf("size=%d", size), func(t *testing.T) {
 			plaintext := make([]byte, size)
-			for i := 0; i < size; i++ {
+			for index := 0; index < size; index++ {
-				plaintext[i] = byte(i)
+				plaintext[index] = byte(index)
 			}
 
 			reg := fakeRegistry(t)
@@ -318,7 +328,7 @@ func TestRoundTrip(
 			var encrypted bytes.Buffer
 			if err := enc.Encrypt(
 				bytes.NewReader(plaintext),
-				[]crypto.RecipientPub{pqPub, classicalPub},
+				makeRecipientPubs(pqPub, classicalPub),
 				&encrypted,
 				rand.Reader,
 			); err != nil {
@@ -328,7 +338,7 @@ func TestRoundTrip(
 			out := &bytes.Buffer{}
 			if err := dec.Decrypt(
 				bytes.NewReader(encrypted.Bytes()),
-				[]crypto.RecipientPriv{pqPriv, classicalPriv},
+				makeRecipientPrivs(pqPriv, classicalPriv),
 				out,
 			); err != nil {
 				t.Fatalf("Decrypt: %v", err)
@@ -354,7 +364,7 @@ func TestEmptyPlaintextSingleFinalChunk(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader(nil),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rand.Reader,
 	); err != nil {
@@ -394,7 +404,7 @@ func TestExactly64KiBTwoChunks(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader(plaintext),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rand.Reader,
 	); err != nil {
@@ -486,7 +496,7 @@ func TestTamperPayload(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader(plaintext),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rand.Reader,
 	); err != nil {
@@ -504,7 +514,7 @@ func TestTamperPayload(
 	out := &bytes.Buffer{}
 	err := dec.Decrypt(
 		bytes.NewReader(buf),
-		[]crypto.RecipientPriv{pqPriv, classicalPriv},
+		makeRecipientPrivs(pqPriv, classicalPriv),
 		out,
 	)
 	if !errors.Is(err, ErrTamperingDetected) {
@@ -526,7 +536,7 @@ func TestTamperWrappedCEK(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader([]byte{0xAA}),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rand.Reader,
 	); err != nil {
@@ -545,7 +555,7 @@ func TestTamperWrappedCEK(
 	out := &bytes.Buffer{}
 	err := dec.Decrypt(
 		bytes.NewReader(buf),
-		[]crypto.RecipientPriv{pqPriv, classicalPriv},
+		makeRecipientPrivs(pqPriv, classicalPriv),
 		out,
 	)
 	if !errors.Is(err, ErrTamperingDetected) {
@@ -575,7 +585,7 @@ func TestWrongPrivKey(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader([]byte{0x11, 0x22, 0x33}),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rand.Reader,
 	); err != nil {
@@ -605,7 +615,7 @@ func TestFormatConformance(
 	var out bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader([]byte{0x42}),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&out,
 		rand.Reader,
 	); err != nil {
@@ -649,7 +659,7 @@ func TestUnsupportedVersionNoGCM(
 	out := &bytes.Buffer{}
 	err := dec.Decrypt(
 		reader,
-		[]crypto.RecipientPriv{pqPriv, classicalPriv},
+		makeRecipientPrivs(pqPriv, classicalPriv),
 		out,
 	)
 	if !errors.Is(err, ErrUnsupportedVersion) {
@@ -723,7 +733,7 @@ func TestMalformedHeaderCtLenOverflow(
 		_, classicalPriv := generateFakeKeyPair(t, fakeRegistry(t), fakeClassicalSchemeID, rand.Reader)
 		err := dec.Decrypt(
 			reader,
-			[]crypto.RecipientPriv{pqPriv, classicalPriv},
+			makeRecipientPrivs(pqPriv, classicalPriv),
 			&bytes.Buffer{},
 		)
 		if !errors.Is(err, ErrMalformedHeader) {
@@ -754,7 +764,7 @@ func TestZeroLengthNonFinalChunk(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader([]byte{0xAA}),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rand.Reader,
 	); err != nil {
@@ -770,7 +780,7 @@ func TestZeroLengthNonFinalChunk(
 	out := &bytes.Buffer{}
 	err := dec.Decrypt(
 		bytes.NewReader(corrupt.Bytes()),
-		[]crypto.RecipientPriv{pqPriv, classicalPriv},
+		makeRecipientPrivs(pqPriv, classicalPriv),
 		out,
 	)
 	if !errors.Is(err, ErrMalformedChunk) {
@@ -792,7 +802,7 @@ func TestOversizedChunk(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader([]byte{0xAA}),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rand.Reader,
 	); err != nil {
@@ -808,7 +818,7 @@ func TestOversizedChunk(
 	out := &bytes.Buffer{}
 	err := dec.Decrypt(
 		bytes.NewReader(corrupt.Bytes()),
-		[]crypto.RecipientPriv{pqPriv, classicalPriv},
+		makeRecipientPrivs(pqPriv, classicalPriv),
 		out,
 	)
 	if !errors.Is(err, ErrMalformedChunk) {
@@ -833,7 +843,7 @@ func TestPrematureEOF(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader(plaintext),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rand.Reader,
 	); err != nil {
@@ -853,7 +863,7 @@ func TestPrematureEOF(
 	out := &bytes.Buffer{}
 	err := dec.Decrypt(
 		bytes.NewReader(encrypted.Bytes()[:truncatedLen]),
-		[]crypto.RecipientPriv{pqPriv, classicalPriv},
+		makeRecipientPrivs(pqPriv, classicalPriv),
 		out,
 	)
 	if !errors.Is(err, ErrUnexpectedEOF) {

pkg/adapters/crypto/composite/golden_generate_test.go

@@ -88,7 +88,7 @@ func TestGenerateGoldenFixture(
 	var encrypted bytes.Buffer
 	if err := enc.Encrypt(
 		bytes.NewReader([]byte{0xAA}),
-		[]crypto.RecipientPub{pqPub, classicalPub},
+		makeRecipientPubs(pqPub, classicalPub),
 		&encrypted,
 		rng,
 	); err != nil {

pkg/adapters/crypto/x25519/x25519.go

@@ -136,8 +136,8 @@ func (k *kemAdapter) Decapsulate(
 
 	// Reject the all-zero public key (identity point), which yields an all-zero shared secret.
 	allZero := true
-	for _, b := range ciphertext {
+	for _, byteValue := range ciphertext {
-		if b != 0 {
+		if byteValue != 0 {
 			allZero = false
 			break
 		}

pkg/adapters/crypto/x25519/x25519_test.go

@@ -114,24 +114,24 @@ func TestRoundTrip(t *testing.T) {
 func TestRoundTripMany(t *testing.T) {
 	adapter := New()
 
-	for i := 0; i < 1000; i++ {
+	for iteration := 0; iteration < 1000; iteration++ {
 		pub, priv, err := adapter.GenerateKeyPair(rand.Reader)
 		if err != nil {
-			t.Fatalf("iteration %d: GenerateKeyPair failed: %v", i, err)
+			t.Fatalf("iteration %d: GenerateKeyPair failed: %v", iteration, err)
 		}
 
 		ct, ssEnc, err := adapter.Encapsulate(pub, rand.Reader)
 		if err != nil {
-			t.Fatalf("iteration %d: Encapsulate failed: %v", i, err)
+			t.Fatalf("iteration %d: Encapsulate failed: %v", iteration, err)
 		}
 
 		ssDec, err := adapter.Decapsulate(priv, ct)
 		if err != nil {
-			t.Fatalf("iteration %d: Decapsulate failed: %v", i, err)
+			t.Fatalf("iteration %d: Decapsulate failed: %v", iteration, err)
 		}
 
 		if !bytes.Equal(ssEnc, ssDec) {
-			t.Fatalf("iteration %d: shared secret mismatch", i)
+			t.Fatalf("iteration %d: shared secret mismatch", iteration)
 		}
 	}
 }

pkg/adapters/healthz/healthz.go

@@ -9,23 +9,34 @@ import (
 	"time"
 )
 
-// Server is a minimal HTTP health check server.
+// Server is the public interface of the minimal HTTP health check server.
-type Server struct {
+type Server interface {
+	// Addr returns the bound network address (e.g. "127.0.0.1:8080").
+	Addr() string
+	// Start begins serving HTTP requests. It blocks until Stop is called.
+	Start() error
+	// Stop initiates graceful shutdown. After Stop is called the /healthz
+	// endpoint returns 503 while in-flight requests complete.
+	Stop(ctx context.Context) error
+}
+
+// server is the private implementation of Server.
+type server struct {
 	listener     net.Listener
-	server       *http.Server
+	httpServer   *http.Server
 	shuttingDown atomic.Bool
 }
 
 // New creates a health check server listening on the given port.
 // Passing port 0 binds to an available ephemeral port.
-func New(port int) (*Server, error) {
+func New(port int) (Server, error) {
 	listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create listener: %w", err)
 	}
 
-	s := &Server{listener: listener}
+	s := &server{listener: listener}
-	s.server = &http.Server{
+	s.httpServer = &http.Server{
 		Handler:           http.HandlerFunc(s.handleHealthz),
 		ReadHeaderTimeout: 5 * time.Second,
 	}
@@ -33,7 +44,7 @@ func New(port int) (*Server, error) {
 }
 
 // Addr returns the bound network address (e.g. "127.0.0.1:8080").
-func (s *Server) Addr() string {
+func (s *server) Addr() string {
 	if s.listener == nil {
 		return ""
 	}
@@ -41,21 +52,21 @@ func (s *Server) Addr() string {
 }
 
 // Start begins serving HTTP requests. It blocks until Stop is called.
-func (s *Server) Start() error {
+func (s *server) Start() error {
-	return s.server.Serve(s.listener)
+	return s.httpServer.Serve(s.listener)
 }
 
 // Stop initiates graceful shutdown. After Stop is called the /healthz
 // endpoint returns 503 while in-flight requests complete.
-func (s *Server) Stop(ctx context.Context) error {
+func (s *server) Stop(ctx context.Context) error {
 	s.shuttingDown.Store(true)
 	// Grace period so that health checks can observe the 503 state
 	// before the listener is closed.
 	time.Sleep(100 * time.Millisecond)
-	return s.server.Shutdown(ctx)
+	return s.httpServer.Shutdown(ctx)
 }
 
-func (s *Server) handleHealthz(w http.ResponseWriter, r *http.Request) {
+func (s *server) handleHealthz(w http.ResponseWriter, r *http.Request) {
 	if r.URL.Path != "/healthz" {
 		http.NotFound(w, r)
 		return

pkg/adapters/pgdump/pgdump_test.go

@@ -44,10 +44,8 @@ func mockCommandContext(
 }
 
 func TestDump_Success(t *testing.T) {
-	wantArgs := []string{
+	wantArgs := make([]string, 0, 2)
-		"--format=custom",
+	wantArgs = append(wantArgs, "--format=custom", "--exclude-table=e2e_one_time_keys_json")
-		"--exclude-table=e2e_one_time_keys_json",
-	}
 
 	adapter := &adapter{
 		commandContext: mockCommandContext(
@@ -78,10 +76,8 @@ func TestDump_Success(t *testing.T) {
 func TestDump_WaitAfterStdoutEOF(t *testing.T) {
 	// This test verifies that after io.Copy returns (stdout EOF),
 	// cmd.Wait() is called and the exit code is verified before returning.
-	wantArgs := []string{
+	wantArgs := make([]string, 0, 2)
-		"--format=custom",
+	wantArgs = append(wantArgs, "--format=custom", "--exclude-table=e2e_one_time_keys_json")
-		"--exclude-table=e2e_one_time_keys_json",
-	}
 
 	adapter := &adapter{
 		commandContext: mockCommandContext(
@@ -110,10 +106,8 @@ func TestDump_WaitAfterStdoutEOF(t *testing.T) {
 }
 
 func TestDump_NonZeroExitCode(t *testing.T) {
-	wantArgs := []string{
+	wantArgs := make([]string, 0, 2)
-		"--format=custom",
+	wantArgs = append(wantArgs, "--format=custom", "--exclude-table=e2e_one_time_keys_json")
-		"--exclude-table=e2e_one_time_keys_json",
-	}
 
 	adapter := &adapter{
 		commandContext: mockCommandContext(
@@ -200,10 +194,8 @@ func TestDump_ContextCancellation(t *testing.T) {
 }
 
 func TestDump_DefaultExcludeTables(t *testing.T) {
-	wantArgs := []string{
+	wantArgs := make([]string, 0, 2)
-		"--format=custom",
+	wantArgs = append(wantArgs, "--format=custom", "--exclude-table=e2e_one_time_keys_json")
-		"--exclude-table=e2e_one_time_keys_json",
-	}
 
 	adapter := &adapter{
 		commandContext: mockCommandContext(
@@ -227,11 +219,8 @@ func TestDump_DefaultExcludeTables(t *testing.T) {
 }
 
 func TestDump_CustomExcludeTables(t *testing.T) {
-	wantArgs := []string{
+	wantArgs := make([]string, 0, 3)
-		"--format=custom",
+	wantArgs = append(wantArgs, "--format=custom", "--exclude-table=table_a", "--exclude-table=table_b")
-		"--exclude-table=table_a",
-		"--exclude-table=table_b",
-	}
 
 	adapter := &adapter{
 		commandContext: mockCommandContext(
@@ -288,12 +277,10 @@ func TestDump_EnvVars(t *testing.T) {
 		t.Errorf("PGPASSWORD must not be passed to pg_dump subprocess")
 	}
 
-	wantEnvVars := []string{
+	wantEnvVars := make([]string, 0, 4)
-		"PGHOST=myhost",
+
-		"PGPORT=5433",
+	wantEnvVars = append(wantEnvVars, "PGHOST=myhost", "PGPORT=5433", "PGUSER=myuser", "PGDATABASE=mydb")
-		"PGUSER=myuser",
+
-		"PGDATABASE=mydb",
-	}
 	for _, wantEnv := range wantEnvVars {
 		if !strings.Contains(envStr, wantEnv) {
 			t.Errorf("env missing %q", wantEnv)

pkg/adapters/pipeline/pipeline.go

@@ -9,6 +9,18 @@ import (
 	"git.tswf.io/infra/go-synapse-backupper/pkg/domain/pgdump"
 )
 
+// Runner orchestrates the dump → encrypt → sink pipeline.
+type Runner interface {
+	// Run executes the full backup pipeline: pg_dump → encrypt → sink.
+	Run(
+		ctx context.Context,
+		pgDumpOpts pgdump.Options,
+		recipients []crypto.RecipientPub,
+		sink domain.Sink,
+		rand io.Reader,
+	) error
+}
+
 // Option configures a Runner.
 type Option func(*runner)
 
@@ -26,14 +38,14 @@ func WithEncryptor(encryptor crypto.Encryptor) Option {
 	}
 }
 
-// Runner orchestrates the dump → encrypt → sink pipeline.
+// runner is the private implementation of Runner.
 type runner struct {
 	dumper    pgdump.Dumper
 	encryptor crypto.Encryptor
 }
 
 // NewRunner creates a pipeline runner with the given functional options.
-func NewRunner(options ...Option) *runner {
+func NewRunner(options ...Option) Runner {
 	r := &runner{}
 	for _, option := range options {
 		option(r)

pkg/adapters/storage/local/local.go

@@ -19,9 +19,9 @@ type localSink struct {
 	dir string
 }
 
-func (sink *localSink) Begin(key string) (domain.SinkTx, error) {
+func (l *localSink) Begin(key string) (domain.SinkTx, error) {
-	tmpPath := filepath.Join(sink.dir, key+".tmp")
+	tmpPath := filepath.Join(l.dir, key+".tmp")
-	finalPath := filepath.Join(sink.dir, key)
+	finalPath := filepath.Join(l.dir, key)
 
 	file, err := os.Create(tmpPath)
 	if err != nil {
@@ -35,8 +35,8 @@ func (sink *localSink) Begin(key string) (domain.SinkTx, error) {
 	}, nil
 }
 
-func (sink *localSink) List(prefix string) ([]string, error) {
+func (l *localSink) List(prefix string) ([]string, error) {
-	entries, err := os.ReadDir(sink.dir)
+	entries, err := os.ReadDir(l.dir)
 	if err != nil {
 		return nil, err
 	}
@@ -56,8 +56,8 @@ func (sink *localSink) List(prefix string) ([]string, error) {
 	return keys, nil
 }
 
-func (sink *localSink) Remove(key string) error {
+func (l *localSink) Remove(key string) error {
-	path := filepath.Join(sink.dir, key)
+	path := filepath.Join(l.dir, key)
 	return os.Remove(path)
 }
 
@@ -70,39 +70,39 @@ type localSinkTx struct {
 	mu        sync.Mutex
 }
 
-func (transaction *localSinkTx) Write(p []byte) (int, error) {
+func (t *localSinkTx) Write(p []byte) (int, error) {
-	transaction.mu.Lock()
+	t.mu.Lock()
-	defer transaction.mu.Unlock()
+	defer t.mu.Unlock()
 
-	if transaction.committed || transaction.aborted {
+	if t.committed || t.aborted {
 		return 0, errors.New("transaction already finished")
 	}
 
-	return transaction.file.Write(p)
+	return t.file.Write(p)
 }
 
-func (transaction *localSinkTx) Commit() error {
+func (t *localSinkTx) Commit() error {
-	transaction.mu.Lock()
+	t.mu.Lock()
-	defer transaction.mu.Unlock()
+	defer t.mu.Unlock()
 
-	if transaction.committed || transaction.aborted {
+	if t.committed || t.aborted {
 		return nil
 	}
 
-	transaction.committed = true
+	t.committed = true
 
-	if err := transaction.file.Sync(); err != nil {
+	if err := t.file.Sync(); err != nil {
 		return err
 	}
-	if err := transaction.file.Close(); err != nil {
+	if err := t.file.Close(); err != nil {
 		return err
 	}
 
-	if err := os.Rename(transaction.tmpPath, transaction.finalPath); err != nil {
+	if err := os.Rename(t.tmpPath, t.finalPath); err != nil {
 		return err
 	}
 
-	parent, err := os.Open(filepath.Dir(transaction.tmpPath))
+	parent, err := os.Open(filepath.Dir(t.tmpPath))
 	if err != nil {
 		return err
 	}
@@ -115,18 +115,18 @@ func (transaction *localSinkTx) Commit() error {
 	return nil
 }
 
-func (transaction *localSinkTx) Abort() error {
+func (t *localSinkTx) Abort() error {
-	transaction.mu.Lock()
+	t.mu.Lock()
-	defer transaction.mu.Unlock()
+	defer t.mu.Unlock()
 
-	if transaction.committed || transaction.aborted {
+	if t.committed || t.aborted {
 		return nil
 	}
 
-	transaction.aborted = true
+	t.aborted = true
 
-	_ = transaction.file.Close()
+	_ = t.file.Close()
-	_ = os.Remove(transaction.tmpPath)
+	_ = os.Remove(t.tmpPath)
 
 	return nil
 }

resources/embed.go

@@ -0,0 +1,13 @@
+package resources
+
+import _ "embed"
+
+// ConfigEnYAML is the embedded English example configuration file.
+//
+//go:embed config.en.yaml
+var ConfigEnYAML []byte
+
+// ConfigRuYAML is the embedded Russian example configuration file.
+//
+//go:embed config.ru.yaml
+var ConfigRuYAML []byte