Implements linter for pkg/hold

.golangci.yml

···
         linters:
           - errcheck
 
+      # TODO: fix issues and remove these paths one by one
+      - path: pkg/auth
+        linters:
+          - errcheck
+      - path: pkg/appview
+        linters:
+          - errcheck
+      - path: cmd/credential-helper
+        linters:
+          - errcheck
+
 formatters:
   enable:
     - gofmt

.tangled/workflows/lint.yaml

···
+when:
+  - event: ["push"]
+    branch: ["*"]
+  - event: ["pull_request"]
+    branch: ["main"]
+
+engine: kubernetes
+image: golang:1.25-trixie
+architecture: amd64
+
+steps:
+  - name: Download and Generate
+    environment:
+      CGO_ENABLED: 1
+    command: |
+      go mod download
+      go generate ./...
+
+  - name: Run Linter
+    environment:
+      CGO_ENABLED: 1
+    command: |
+      curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.7.2
+      golangci-lint run ./...

cmd/appview/serve.go

···
 		logoURI := cfg.Server.BaseURL + "/web-app-manifest-192x192.png"
 		policyURI := cfg.Server.BaseURL + "/privacy"
 		tosURI := cfg.Server.BaseURL + "/terms"
-		
+
 		metadata := config.ClientMetadata()
 		metadata.ClientName = &cfg.Server.ClientName
 		metadata.ClientURI = &cfg.Server.BaseURL

pkg/hold/pds/xrpc.go

···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleDescribeServer returns server metadata
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleResolveHandle resolves a handle to a DID
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleGetProfile returns aggregated profile information
···
 	response := h.buildProfileResponse(r.Context())
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleGetProfiles returns aggregated profile information for multiple actors
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // buildProfileResponse builds a profile response map (shared by GetProfile and GetProfiles)
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleGetRecord retrieves a record from the repository
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleListRecords lists records in a collection
···
 		// Empty repo, return empty list
 		response := map[string]any{"records": []any{}}
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(response)
+		if err := json.NewEncoder(w).Encode(response); err != nil {
+			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+			w.WriteHeader(http.StatusInternalServerError)
+		}
 		return
 	}
 
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // handleListRecordsMST uses the legacy MST-based listing (fallback for tests)
···
 		// Empty repo, return empty list
 		response := map[string]any{"records": []any{}}
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(response)
+		if err := json.NewEncoder(w).Encode(response); err != nil {
+			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+			w.WriteHeader(http.StatusInternalServerError)
+		}
 		return
 	}
 
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleDeleteRecord deletes a record from the repository
···
 			if !currentCID.Equals(swapRecordCID) {
 				// Swap failed - record CID doesn't match
 				w.WriteHeader(http.StatusBadRequest)
-				json.NewEncoder(w).Encode(map[string]any{
+				response := map[string]any{
 					"error":   "InvalidSwap",
 					"message": "record CID does not match swapRecord",
-				})
+				}
+				if err := json.NewEncoder(w).Encode(response); err != nil {
+					slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+					w.WriteHeader(http.StatusInternalServerError)
+				}
 				return
 			}
 		}
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleSyncGetRecord returns a single record as a CAR file for sync
···
 	}
 
 	// Write the CAR data to the response
-	w.Write(buf.Bytes())
+	if _, err := w.Write(buf.Bytes()); err != nil {
+		slog.Error("failed to write car to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleGetRepo returns the full repository as a CAR file
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleGetBlob routes blob requests to appropriate handlers based on blob type
···
 		"url": presignedURL,
 	}
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // handleGetATProtoBlob handles standard ATProto blob requests
···
 			"repos": []any{},
 		}
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(response)
+		if err := json.NewEncoder(w).Encode(response); err != nil {
+			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+			w.WriteHeader(http.StatusInternalServerError)
+		}
 		return
 	}
 
···
 			"repos": []any{},
 		}
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(response)
+		if err := json.NewEncoder(w).Encode(response); err != nil {
+			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+			w.WriteHeader(http.StatusInternalServerError)
+		}
 		return
 	}
 
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleGetRepoStatus returns the hosting status for a repository
···
 			"active": true,
 		}
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(response)
+		if err := json.NewEncoder(w).Encode(response); err != nil {
+			slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+			w.WriteHeader(http.StatusInternalServerError)
+		}
 		return
 	}
 
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleDIDDocument returns the DID document
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(doc)
+	if err := json.NewEncoder(w).Encode(doc); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // HandleAtprotoDID returns the DID for handle resolution
···
 			}
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
-			json.NewEncoder(w).Encode(response)
+			if err := json.NewEncoder(w).Encode(response); err != nil {
+				slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+				w.WriteHeader(http.StatusInternalServerError)
+			}
 			return
 		}
 	}
···
 
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusCreated)
-	json.NewEncoder(w).Encode(response)
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }
 
 // GetPresignedURL generates a presigned URL for GET, HEAD, or PUT operations
···
 	}
 
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(stats)
+	if err := json.NewEncoder(w).Encode(stats); err != nil {
+		slog.Error("failed to encode json to http response", "error", err, "path", r.URL.Path)
+		w.WriteHeader(http.StatusInternalServerError)
+	}
 }