Enable nilnil linter for new code (#36591)

Fixes: https://github.com/go-gitea/gitea/issues/36152

Enable the `nilnil` linter while adding `//nolint` comments to existing
violations. This will ensure no new issues enter the code base while we
can fix existing issues gradually.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

services/auth/auth_token.go

@@ -32,7 +32,7 @@ var (
 
 func CheckAuthToken(ctx context.Context, value string) (*auth_model.AuthToken, error) {
 	if len(value) == 0 {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	parts := strings.SplitN(value, ":", 2)

services/auth/basic.go

@@ -121,7 +121,7 @@ func (b *Basic) VerifyAuthToken(req *http.Request, w http.ResponseWriter, store
 		store.GetData()["LoginMethod"] = ActionTokenMethodName
 		return user_model.NewActionsUserWithTaskID(task.ID), nil
 	}
-	return nil, nil
+	return nil, nil //nolint:nilnil // the auth method is not applicable
 }
 
 // Verify extracts and validates Basic data (username and password/token) from the
@@ -132,7 +132,7 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
 	parseBasicRet := b.parseAuthBasic(req)
 	authToken, uname, passwd := parseBasicRet.authToken, parseBasicRet.uname, parseBasicRet.passwd
 	if authToken == "" && uname == "" {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 	u, err := b.VerifyAuthToken(req, w, store, sess, authToken)
 	if u != nil || err != nil {
@@ -140,7 +140,7 @@ func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore
 	}
 
 	if !setting.Service.EnableBasicAuth {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	log.Trace("Basic Authorization: Attempting SignIn for %s", uname)

services/auth/httpsign.go

@@ -42,7 +42,7 @@ func (h *HTTPSign) Name() string {
 func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
 	sigHead := req.Header.Get("Signature")
 	if len(sigHead) == 0 {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	var (
@@ -53,14 +53,14 @@ func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataSt
 	if len(req.Header.Get("X-Ssh-Certificate")) != 0 {
 		// Handle Signature signed by SSH certificates
 		if len(setting.SSH.TrustedUserCAKeys) == 0 {
-			return nil, nil
+			return nil, nil //nolint:nilnil // the auth method is not applicable
 		}
 
 		publicKey, err = VerifyCert(req)
 		if err != nil {
 			log.Debug("VerifyCert on request from %s: failed: %v", req.RemoteAddr, err)
 			log.Warn("Failed authentication attempt from %s", req.RemoteAddr)
-			return nil, nil
+			return nil, nil //nolint:nilnil // the auth method is not applicable
 		}
 	} else {
 		// Handle Signature signed by Public Key
@@ -68,7 +68,7 @@ func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataSt
 		if err != nil {
 			log.Debug("VerifyPubKey on request from %s: failed: %v", req.RemoteAddr, err)
 			log.Warn("Failed authentication attempt from %s", req.RemoteAddr)
-			return nil, nil
+			return nil, nil //nolint:nilnil // the auth method is not applicable
 		}
 	}
 

services/auth/oauth2.go

@@ -156,12 +156,12 @@ func (o *OAuth2) Verify(req *http.Request, w http.ResponseWriter, store DataStor
 	detector := newAuthPathDetector(req)
 	if !detector.isAPIPath() && !detector.isAttachmentDownload() && !detector.isAuthenticatedTokenRequest() &&
 		!detector.isGitRawOrAttachPath() && !detector.isArchivePath() {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	token, ok := parseToken(req)
 	if !ok {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	user, err := o.userFromToken(req.Context(), token, store)

services/auth/reverseproxy.go

@@ -51,7 +51,7 @@ func (r *ReverseProxy) Name() string {
 func (r *ReverseProxy) getUserFromAuthUser(req *http.Request) (*user_model.User, error) {
 	username := r.getUserName(req)
 	if len(username) == 0 {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 	log.Trace("ReverseProxy Authorization: Found username: %s", username)
 
@@ -111,7 +111,7 @@ func (r *ReverseProxy) Verify(req *http.Request, w http.ResponseWriter, store Da
 	if user == nil {
 		user = r.getUserFromAuthEmail(req)
 		if user == nil {
-			return nil, nil
+			return nil, nil //nolint:nilnil // the auth method is not applicable
 		}
 	}
 

services/auth/session.go

@@ -29,19 +29,19 @@ func (s *Session) Name() string {
 // Returns nil if there is no user uid stored in the session.
 func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error) {
 	if sess == nil {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	// Get user ID
 	uid := sess.Get("uid")
 	if uid == nil {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 	log.Trace("Session Authorization: Found user[%d]", uid)
 
 	id, ok := uid.(int64)
 	if !ok {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	// Get user object
@@ -52,7 +52,7 @@ func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataSto
 			// Return the err as-is to keep current signed-in session, in case the err is something like context.Canceled. Otherwise non-existing user (nil, nil) will make the caller clear the signed-in session.
 			return nil, err
 		}
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	log.Trace("Session Authorization: Logged in user %-v", user)

services/auth/source/oauth2/providers_test.go

@@ -19,11 +19,11 @@ func (p *fakeProvider) Name() string {
 func (p *fakeProvider) SetName(name string) {}
 
 func (p *fakeProvider) BeginAuth(state string) (goth.Session, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil // the auth method is not applicable
 }
 
 func (p *fakeProvider) UnmarshalSession(string) (goth.Session, error) {
-	return nil, nil
+	return nil, nil //nolint:nilnil // the auth method is not applicable
 }
 
 func (p *fakeProvider) FetchUser(goth.Session) (goth.User, error) {

services/auth/sspi.go

@@ -63,7 +63,7 @@ func (s *SSPI) Verify(req *http.Request, w http.ResponseWriter, store DataStore,
 		return nil, sspiAuthErrInit
 	}
 	if !s.shouldAuthenticate(req) {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 
 	cfg, err := s.getConfig(req.Context())
@@ -97,7 +97,7 @@ func (s *SSPI) Verify(req *http.Request, w http.ResponseWriter, store DataStore,
 
 	username := sanitizeUsername(userInfo.Username, cfg)
 	if len(username) == 0 {
-		return nil, nil
+		return nil, nil //nolint:nilnil // the auth method is not applicable
 	}
 	log.Info("Authenticated as %s\n", username)
 
@@ -109,7 +109,7 @@ func (s *SSPI) Verify(req *http.Request, w http.ResponseWriter, store DataStore,
 		}
 		if !cfg.AutoCreateUsers {
 			log.Error("User '%s' not found", username)
-			return nil, nil
+			return nil, nil //nolint:nilnil // the auth method is not applicable
 		}
 		user, err = s.newUser(req.Context(), username, cfg)
 		if err != nil {