[itsjeremyjohnson]

The template filtered CI to main even though its default branch is feat/initial-template, and installed a v1 linter against a v2 configuration. This fixes the triggers and tool pins, updates the jose2go seed to 1.7.0, and separates the macOS native empty-keyring probe from a bounded encrypted-file credential roundtrip for headless runners.

Linux maintainer gates use Go 1.25 because golangci-lint 2.9 requires it. The module and macOS/Windows build lanes keep Go 1.22. The restored gates exposed existing formatting and lint defects; the follow-up fixes preserve command precedence and credential settings, propagate JSON output errors, preserve wrapped keyring errors, and add focused keyring regression cases. A JSON output failure can occur after credential storage succeeds.

Validation at 6fcc8e78828c04702977c59b13a73100dc69a978: all three CI jobs passed, including Linux formatting/lint/tests, Go 1.22 macOS/Windows builds, the native empty-store probe, and asserted encrypted-file write/read/remove behavior. internal/secrets has tests; six other packages report no test files. Go 1.22 is verified as a build contract; its test suite was not run. Native macOS stored-secret reads remain unexercised.

The complete remote tree matches the reviewed changes. Placeholder names, production keychain trust settings, and the tag-triggered release workflow are preserved.

---

Note

Low Risk
Mostly CI, dev tooling, and error-handling polish; credential behavior is tightened for CI assertions without changing production keychain trust settings.

Overview
Repairs template CI so it runs on the default branch (feat/initial-template) and aligns maintainer tooling with golangci-lint v2 (Linux uses Go 1.25 for fmt/lint/test; macOS/Windows stay on Go 1.22 for build smoke). Dev tool pins in the Makefile are bumped (gofumpt, goimports, golangci-lint v2.9.0), and jose2go is updated to 1.7.0.

macOS credential checks are split: a 1-minute native keychain probe for an empty store, then a bounded encrypted file backend roundtrip (set-key → JSON auth status → remove) with explicit PLACEHOLDER_CLI_KEYRING_* env and Python assertions on has_key / env_override so CI cannot pass without real storage behavior.

Follow-up code fixes from restored gates: auth commands propagate JSON write errors, keyring HasKey wraps non–not-found failures, blank generic secret keys use a shared sentinel, plus new secrets regression tests. README documents the split Go versions and template adaptation expectations.

^{Reviewed by Cursor Bugbot for commit 6fcc8e7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 1ba87472-8a74-4d7a-872f-1d8d4c73f57c)