[yesdevnull]

Summary

A code quality and cleanup pass over the tool, with a secondary pass over the tests and the agent docs. CLI output, flags, exit codes and the JSON contracts are unchanged.

Source (main.go, config.go, audit.go)

• Doc comments condensed to idiomatic Go: the javadoc-style Parameters/Returns/Examples tables are replaced with one-paragraph summaries, and the longest explanatory comments are trimmed while keeping the reasoning they record.
• updateVerb supplies the ✓ Updated / → Would update prefix and verb that three loops each built by hand; moduleUpdateOptions.warnSkip prints the three module skip warnings that each spelt out the same Fprintf.
• The module and provider block updaters no longer return a changed result that always equalled updated; updateProviderBlockSyntaxResult returns only the changed indexes.
• containsVersion is replaced by slices.Contains, shouldIgnoreModule uses slices.ContainsFunc, and the three-helper wildcard matcher becomes one matchPattern that searches the middle parts between the fixed prefix and suffix (same semantics, same pattern_test.go).
• objectItemValueRange is shared by the updater and the audit instead of two copies of the byte-range check; replaceProviderObjectVersion uses slices.Clone and slices.Concat.
• updateReport records block IDs into caller-owned maps rather than returning them; runConfigFileMode fills configOutcome directly and printConfigSummary prints its count lines through one helper.
• Nested errors are wrapped with %w; FromVersions.UnmarshalYAML is a kind switch and loadConfig uses errors.Is for EOF.
• .golangci.yml disables staticcheck ST1005 (the CLI prints its capitalised Error: strings verbatim), which removes the ~25 per-line //nolint:staticcheck directives.

Tests

• runMainCommand, captureRunnerOutput, captureStream, captureLog and captureStdoutAndStderr are rebuilt on two shared primitives, redirectStream and redirectLog, replacing five hand-rolled pipe/drain/restore sequences.
• The test-only updateTerraformVersion adapter moves beside the other adapters in test_helpers_test.go.
• TestUpdateActionsReleasePinRejectsUnwritableTargetWithoutPartialChanges now skips as root like the other permission tests (it failed when run as root).

Docs

• CLAUDE.md: the "Errors and output" and -report-file paragraphs are condensed, and the lint section notes the ST1005 change.

Validation

• go vet, go test -race -coverprofile=... (coverage 94.3%), golangci-lint run on v2.12.2 (0 issues), go build, make actionlint, and a manual dry run and real run of the built binary over examples/*.tf in a scratch directory.
• make shellcheck was not run here (shellcheck is not installed in this environment); no shell scripts changed.

---

Generated by Claude Code