Context
Two sites in internal/testsuite/ use `//nolint:gosec // G306` to silence "0644 file permission" warnings on writes that produce non-sensitive CI output:
- `internal/testsuite/runner.go:458` (writeLayoutLockfileOverride)
- `internal/testsuite/deviations.go:72` (AppendDeviations)
Both justifications cite "prior art." A shared helper `writeCIArtifact(path string, data []byte) error` would own the 0644 permission decision in one place, with one justified `//nolint`. That makes the rule easier to audit and prevents drift if a future site needs a tighter mode.
Acceptance
- Single `//nolint:gosec` in the codebase covering this class of CI-artifact write
- Both call sites delegate to the helper
- No behavior change
Context
Two sites in
internal/testsuite/use `//nolint:gosec // G306` to silence "0644 file permission" warnings on writes that produce non-sensitive CI output:Both justifications cite "prior art." A shared helper `writeCIArtifact(path string, data []byte) error` would own the 0644 permission decision in one place, with one justified `//nolint`. That makes the rule easier to audit and prevents drift if a future site needs a tighter mode.
Acceptance