style(#3160): use explicit 0o octal notation for file permissions

Replace all old-style Go octal literals (e.g., 0644, 0755) with the
explicit 0o prefix notation (0o644, 0o755) introduced in Go 1.13.
The 0o prefix makes the numeric base unambiguous and prevents
visual confusion with decimal numbers.

This is a semantics-preserving change across 42 files covering
production code, test files, acceptance tests, and benchmarks.
All os.OpenFile, os.WriteFile, os.MkdirAll, os.Chmod, os.Mkdir,
afero.WriteFile, and tar.Header Mode calls are updated.

Note: TestWriteReport in internal/validate failed due to sandbox
network restrictions (sigstore TUF CDN blocked), not related to
this change.

Closes #3160

Author: fullsend-code

acceptance/git/git.go

@@ -92,15 +92,15 @@ func startStubGitServer(ctx context.Context) (context.Context, error) {
 	}
 
 	nginxConfDir := path.Join(repositories, "conf")
-	if err = os.Mkdir(nginxConfDir, 0755); err != nil {
+	if err = os.Mkdir(nginxConfDir, 0o755); err != nil {
 		return ctx, err
 	}
-	if err = os.WriteFile(path.Join(nginxConfDir, "nginx.conf"), nginxConf, 0400); err != nil {
+	if err = os.WriteFile(path.Join(nginxConfDir, "nginx.conf"), nginxConf, 0o400); err != nil {
 		return ctx, err
 	}
 
 	tlsDir := path.Join(repositories, "tls")
-	if err = os.Mkdir(tlsDir, 0755); err != nil {
+	if err = os.Mkdir(tlsDir, 0o755); err != nil {
 		return ctx, err
 	}
 
@@ -114,7 +114,7 @@ func startStubGitServer(ctx context.Context) (context.Context, error) {
 			Bytes: keyBytes,
 		})
 
-		if err = os.WriteFile(path.Join(tlsDir, "server.key"), keyPem, 0400); err != nil {
+		if err = os.WriteFile(path.Join(tlsDir, "server.key"), keyPem, 0o400); err != nil {
 			return ctx, err
 		}
 
@@ -142,7 +142,7 @@ func startStubGitServer(ctx context.Context) (context.Context, error) {
 				Bytes: cert,
 			})
 
-			if err = os.WriteFile(certificate, certPEM, 0400); err != nil {
+			if err = os.WriteFile(certificate, certPEM, 0o400); err != nil {
 				return ctx, err
 			}
 
@@ -152,7 +152,7 @@ func startStubGitServer(ctx context.Context) (context.Context, error) {
 
 	// Create a minimal health check repository before starting the container
 	healthCheckDir := path.Join(repositories, "health-check.git")
-	if err := os.MkdirAll(healthCheckDir, 0755); err != nil {
+	if err := os.MkdirAll(healthCheckDir, 0o755); err != nil {
 		return ctx, err
 	}
 
@@ -284,7 +284,7 @@ func createGitRepository(ctx context.Context, repositoryName string, files *godo
 			}))
 		}
 
-		err = os.WriteFile(dest, b, 0600)
+		err = os.WriteFile(dest, b, 0o600)
 		if err != nil {
 			return err
 		}

acceptance/image/image.go

@@ -878,7 +878,7 @@ func createAndPushImageWithLayer(ctx context.Context, imageName string, files *g
 			name := r.Cells[0].Value
 			if err := t.WriteHeader(&tar.Header{
 				Name: name,
-				Mode: 0644,
+				Mode: 0o644,
 				Size: int64(len(content)),
 			}); err != nil {
 				return nil, err

acceptance/kubernetes/kind/image.go

@@ -68,7 +68,7 @@ func (k *kindCluster) buildCliImage(ctx context.Context) error {
 	// Build into a directory not excluded by .dockerignore (which excludes
 	// dist/) and not conflicting with the versioned binary from make build.
 	buildDir := ".acceptance-build"
-	if err := os.MkdirAll(buildDir, 0755); err != nil {
+	if err := os.MkdirAll(buildDir, 0o755); err != nil {
 		return fmt.Errorf("creating build directory: %w", err)
 	}
 	defer os.RemoveAll(buildDir)
@@ -140,7 +140,7 @@ func (k *kindCluster) buildCliImage(ctx context.Context) error {
 
 	// Write cache hash only after a successful build
 	if cacheFile != "" {
-		_ = os.WriteFile(cacheFile, []byte(currentHash), 0644) // #nosec G306
+		_ = os.WriteFile(cacheFile, []byte(currentHash), 0o644) // #nosec G306
 	}
 
 	return nil
@@ -323,7 +323,7 @@ func (k *kindCluster) BuildSnapshotArtifact(ctx context.Context, content string)
 	filePath := "snapshotartifact"
 
 	// #nosec G306 -- reduce-snapshot.sh needs these permissions
-	if err := os.WriteFile(filePath, []byte(content), 0644); err != nil {
+	if err := os.WriteFile(filePath, []byte(content), 0o644); err != nil {
 		return ctx, fmt.Errorf("failed to write JSON to file: %w", err)
 	}
 
@@ -408,7 +408,7 @@ func copyFile(src, dst string) error {
 	}
 	defer in.Close()
 
-	out, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0755) // #nosec G302
+	out, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o755) // #nosec G302
 	if err != nil {
 		return err
 	}

acceptance/pipeline/pipeline_definition.go

@@ -24,7 +24,7 @@ import (
 )
 
 func writePipelineDefinition(ctx context.Context, name string, data string) (context.Context, error) {
-	err := os.WriteFile(name, []byte(data), 0600)
+	err := os.WriteFile(name, []byte(data), 0o600)
 	if err != nil {
 		return ctx, err
 	}

acceptance/registry/registry.go

@@ -101,7 +101,7 @@ func startStubRegistry(ctx context.Context) (context.Context, error) {
 			{
 				HostFilePath:      "",
 				ContainerFilePath: "/config/config.json",
-				FileMode:          0644,
+				FileMode:          0o644,
 				Reader:            strings.NewReader(zotConfig),
 			},
 		},

acceptance/tekton/bundles.go

@@ -49,7 +49,7 @@ func createTektonBundle(ctx context.Context, name string, data *godog.Table) (co
 		writer := tar.NewWriter(&data)
 		if err := writer.WriteHeader(&tar.Header{
 			Name:     name,
-			Mode:     0600,
+			Mode:     0o600,
 			Size:     int64(len(content)),
 			Typeflag: tar.TypeReg,
 		}); err != nil {

acceptance/testenv/testenv.go

@@ -77,7 +77,7 @@ func Persist(ctx context.Context) (bool, error) {
 		return true, fmt.Errorf("unable to store JSON data in .persisted file: %v", err.Error())
 	}
 
-	err = persister(persistedFile, b, 0644)
+	err = persister(persistedFile, b, 0o644)
 	if err != nil {
 		return true, fmt.Errorf("unable to write to %s file: %v", persistedFile, err.Error())
 	}

benchmark/internal/registry/registry.go

@@ -100,20 +100,20 @@ func Launch(data string) (suite.Closer, error) {
 		return nil, err
 	}
 
-	if err := os.Chmod(dir, 0755); err != nil {
+	if err := os.Chmod(dir, 0o755); err != nil {
 		return closer.Close, err
 	}
 
 	certPath := path.Join(dir, "fake_quay.cer")
-	if err := os.WriteFile(certPath, certificate, 0600); err != nil {
+	if err := os.WriteFile(certPath, certificate, 0o600); err != nil {
 		return closer.Close, err
 	}
 
 	if err := os.Setenv("SSL_CERT_FILE", certPath); err != nil {
 		return closer.Close, err
 	}
 
-	if err := os.WriteFile(path.Join(dir, "fake_quay.key"), key, 0600); err != nil {
+	if err := os.WriteFile(path.Join(dir, "fake_quay.key"), key, 0o600); err != nil {
 		return closer.Close, err
 	}
 

benchmark/offliner/offliner.go

@@ -63,7 +63,7 @@ func main() {
 	}
 
 	if _, err := os.Stat(dir); os.IsNotExist(err) {
-		if err := os.MkdirAll(dir, 0755); err != nil {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
 			fmt.Fprintln(os.Stderr, err)
 			os.Exit(3)
 		}

cmd/initialize/init_policies.go

@@ -79,7 +79,7 @@ func initPoliciesCmd() *cobra.Command {
 			}
 			fs := utils.FS(ctx)
 			workDir := destDir
-			err := fs.MkdirAll(workDir, 0755)
+			err := fs.MkdirAll(workDir, 0o755)
 			if err != nil {
 				log.Debug("Failed to create policy directory!")
 				return err