directive `//nolint:gosec // G705 false positive: w is a CLI stdout writer, not an HTTP ResponseWriter` is unused for linter "gosec" (nolintlint)

directive `//nolint:gosec // G704 false positive: URL is the Kubernetes API server from admin-configured kubeconfig` is unused for linter "gosec" (nolintlint)

directive `//nolint:gosec // G703 false positive: path comes from os.CreateTemp, not user-controlled data` is unused for linter "gosec" (nolintlint)

directive `//nolint:gosec // G704 false positive: URL is the user-configured Helm chart repository` is unused for linter "gosec" (nolintlint)

directive `//nolint:gosec // G117 false positive: Password is an intentional field in the Helm chart auth config` is unused for linter "gosec" (nolintlint)

directive `//nolint:gosec // G705 false positive: output goes to stdout, not an HTTP response writer` is unused for linter "gosec" (nolintlint)

net/http/httptest.NewRequest must not be called. use net/http/httptest.NewRequestWithContext (noctx)

G705: XSS via taint analysis (gosec)

G122: Filesystem operation in filepath.Walk/WalkDir callback uses race-prone path; consider root-scoped APIs (e.g. os.Root) to prevent symlink TOCTOU traversal (gosec)