feat: Overhaul CLI, add extensive testing, and improve safety

.claude/settings.local.json

@@ -0,0 +1,24 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(just lint)",
+      "Bash(go mod:*)",
+      "Bash(just build)",
+      "Bash(./dontrm version)",
+      "Bash(just clean:*)",
+      "Bash(just coverage:*)",
+      "Bash(cat:*)",
+      "Bash(just rebuild-e2e-image:*)",
+      "Bash(docker run:*)",
+      "Bash(just e2e:*)",
+      "Bash(just test-all:*)",
+      "Bash(gh pr checks:*)",
+      "Bash(gh run view:*)",
+      "Bash(golangci-lint:*)",
+      "Bash(just lint-ci:*)",
+      "Bash(just test:*)"
+    ],
+    "deny": [],
+    "ask": []
+  }
+}

.github/workflows/release.yml

@@ -20,9 +20,9 @@ jobs:
           fetch-depth: 0
       - run: git fetch --force --tags
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: ">=1.24.2"
+          go-version: "1.25"
           cache: true
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v4

.github/workflows/test.yml

@@ -0,0 +1,121 @@
+name: Test and Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: Run go fmt
+        run: |
+          if [ -n "$(gofmt -l .)" ]; then
+            echo "Go code is not formatted:"
+            gofmt -d .
+            exit 1
+          fi
+
+      - name: Install golangci-lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.5.0
+
+      - name: Run golangci-lint
+        run: $(go env GOPATH)/bin/golangci-lint run --timeout=5m
+
+  test:
+    name: Test in Docker
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: Build Docker test image
+        run: docker build -f Dockerfile.test -t dontrm-test:latest .
+
+      - name: Run tests with coverage
+        run: |
+          docker run --rm \
+            -v ${{ github.workspace }}:/app \
+            -w /app \
+            dontrm-test:latest \
+            go test -v -coverprofile=coverage.out -covermode=atomic ./...
+
+      - name: Check coverage threshold (85%)
+        run: |
+          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
+          echo "Current coverage: ${COVERAGE}%"
+
+          # Use awk for floating point comparison (85% accounts for untestable main() function)
+          MEETS_THRESHOLD=$(awk -v cov="$COVERAGE" 'BEGIN { print (cov >= 85.0) ? "yes" : "no" }')
+
+          if [ "$MEETS_THRESHOLD" = "no" ]; then
+            echo "❌ Coverage ${COVERAGE}% is below required 85%"
+            exit 1
+          else
+            echo "✅ Coverage ${COVERAGE}% meets required 85%"
+          fi
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          file: ./coverage.out
+          flags: unittests
+          name: codecov-dontrm
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  e2e-test:
+    name: E2E Tests in Docker
+    runs-on: ubuntu-latest
+    needs: [test, build]  # Run after unit tests and build pass
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build E2E Docker image
+        run: docker build -f Dockerfile.e2e -t dontrm-e2e:latest .
+
+      - name: Run E2E tests
+        run: docker run --rm dontrm-e2e:latest
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+
+      - name: Build binary
+        run: go build -ldflags="-s -w" -o dontrm .
+
+      - name: Verify binary
+        run: ./dontrm version

.gitignore

@@ -10,6 +10,7 @@
 
 # Test binary, built with `go test -c`
 *.test
+!Dockerfile.test
 
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
@@ -25,3 +26,14 @@ go.work.sum
 .env
 # Added by goreleaser init:
 dist/
+
+# Test artifacts
+coverage.out
+coverage.html
+*.test
+!Dockerfile.test
+.dockertest.hash
+.dockere2e.hash
+
+# Binary
+dontrm

.golangci.yml

@@ -0,0 +1,104 @@
+version: 2
+
+run:
+  timeout: 5m
+  tests: true
+  modules-download-mode: readonly
+
+linters:
+  enable:
+    # Default linters
+    - errcheck      # Check for unchecked errors
+    - govet         # Examine Go source code and reports suspicious constructs
+    - ineffassign   # Detect ineffectual assignments
+    - staticcheck   # Static analysis checks
+    - unused        # Check for unused code
+
+    # Additional important linters
+    - misspell      # Find commonly misspelled English words
+    - revive        # Fast, configurable, extensible, flexible linter
+    - gosec         # Security-focused linter
+    - unconvert     # Remove unnecessary type conversions
+    - unparam       # Report unused function parameters
+    - bodyclose     # Check HTTP response body is closed
+    - gocritic      # Most opinionated Go linter
+    - gocyclo       # Compute cyclomatic complexity
+    - godot         # Check if comments end in a period
+    - goprintffuncname # Check printf-like functions are named correctly
+    - nakedret      # Find naked returns in functions > X lines
+    - nilerr        # Find code returning nil even when error is not nil
+    - nolintlint    # Report ill-formed or insufficient nolint directives
+    - prealloc      # Find slice declarations that could be preallocated
+    - whitespace    # Detection of leading and trailing whitespace
+
+linters-settings:
+  errcheck:
+    check-type-assertions: true
+    check-blank: true
+
+  govet:
+    enable-all: true
+    disable:
+      - shadow # Can be too strict
+
+  gocyclo:
+    min-complexity: 15
+
+  gocritic:
+    enabled-tags:
+      - diagnostic
+      - style
+      - performance
+      - experimental
+      - opinionated
+    disabled-checks:
+      - whyNoLint # We don't require explanations for nolint directives
+
+  gosec:
+    excludes:
+      - G204 # Subprocess launching with variable - we need this for rm
+
+  revive:
+    rules:
+      - name: exported
+        disabled: false
+      - name: package-comments
+        disabled: true # Not all packages need comments
+
+  nakedret:
+    max-func-lines: 30
+
+  misspell:
+    locale: US
+
+  prealloc:
+    simple: true
+    range-loops: true
+    for-loops: true
+
+issues:
+  exclude-use-default: false
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
+  exclude-rules:
+    # Exclude some linters from running on tests
+    - path: _test\.go
+      linters:
+        - gocyclo
+        - errcheck
+        - gosec
+        - gocritic
+        - govet
+      text: "fieldalignment"
+
+    # Allow print statements in main
+    - path: main\.go
+      linters:
+        - forbidigo
+
+  # Show all issues
+  exclude: []
+
+output:
+  sort-results: true