Add forbidigo linter rule for os.Getenv (#4700)

pietern · claude · web-flow · commit bdeba8032ede · 2026-03-11T13:15:50.000Z
## Summary - Add a `forbidigo` lint rule rejecting `os.Getenv` in favor of `env.Get(ctx)` from `libs/env`, which supports context-based environment variable overrides for test isolation. - Convert all callsites where `ctx` is available. - Plumb `ctx` through `libs/completion` (`DetectShell`, `Status`, `Install`, `homebrewCompletionPath`) and `experimental/aitools/lib/installer` (`getSkillsRef`) where it was one hop away from callers that already had it. - Add `//nolint:forbidigo` with reasons where conversion is not possible (import cycles, no ctx available, process env mutation). - Exclude `_test.go` files from the rule via a golangci-lint exclusion. ## Test plan - [x] `make lintfull` passes with 0 issues 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
diff --git a/.golangci.yaml b/.golangci.yaml
@@ -44,6 +44,8 @@ linters:
           msg: Use cmdio.IsPromptSupported(ctx) to check for a TTY.
         - pattern: 'os\.UserHomeDir'
           msg: Use env.UserHomeDir(ctx) from libs/env instead.
+        - pattern: 'os\.Getenv'
+          msg: Use env.Get(ctx) from the libs/env package instead of os.Getenv.
       analyze-types: true
     copyloopvar:
       check-alias: true
@@ -121,6 +123,10 @@ linters:
       - path: bundle/direct/dresources/.*_test.go
         linters:
           - exhaustruct
+      - text: "Use env\\.Get"
+        path: "_test\\.go$"
+        linters:
+          - forbidigo
       # TODO: remove these exceptions by moving the dependency out of experimental/.
       - path: cmd/apps/init.go
         linters:
diff --git a/acceptance/internal/prepare_server.go b/acceptance/internal/prepare_server.go
@@ -64,7 +64,7 @@ func isTruePtr(value *bool) bool {
 }
 
 func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, outputDir string) (*sdkconfig.Config, iam.User) {
-	cloudEnv := os.Getenv("CLOUD_ENV")
+	cloudEnv := env.Get(t.Context(), "CLOUD_ENV")
 	recordRequests := isTruePtr(config.RecordRequests)
 
 	// Use a unique token for each test. This allows us to maintain
@@ -107,7 +107,7 @@ func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, o
 	// use the default shared server.
 	if len(config.Server) == 0 && !recordRequests {
 		cfg := &sdkconfig.Config{
-			Host:  os.Getenv("DATABRICKS_DEFAULT_HOST"),
+			Host:  env.Get(t.Context(), "DATABRICKS_DEFAULT_HOST"),
 			Token: token,
 		}
 
diff --git a/bundle/internal/schema/main.go b/bundle/internal/schema/main.go
@@ -206,7 +206,7 @@ func generateSchema(workdir, outputFile string, docsMode bool) {
 	annotationsOpenApiOverridesPath := filepath.Join(workdir, "annotations_openapi_overrides.yml")
 
 	// Input file, the databricks openapi spec.
-	inputFile := os.Getenv("DATABRICKS_OPENAPI_SPEC")
+	inputFile := os.Getenv("DATABRICKS_OPENAPI_SPEC") //nolint:forbidigo // main() entry point, no ctx
 	if inputFile != "" {
 		p, err := newParser(inputFile)
 		if err != nil {
diff --git a/cmd/apps/init.go b/cmd/apps/init.go
@@ -24,6 +24,7 @@ import (
 	"github.com/databricks/cli/libs/apps/prompt"
 	"github.com/databricks/cli/libs/cmdctx"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/git"
 	"github.com/databricks/cli/libs/log"
 	ignore "github.com/sabhiram/go-gitignore"
@@ -553,7 +554,7 @@ func runCreate(ctx context.Context, opts createOptions) error {
 	// Resolve template path (supports local paths and GitHub URLs)
 	templateSrc := opts.templatePath
 	if templateSrc == "" {
-		templateSrc = os.Getenv(templatePathEnvVar)
+		templateSrc = env.Get(ctx, templatePathEnvVar)
 	}
 
 	// Resolve the git reference (branch/tag) to use for default appkit template
diff --git a/cmd/apps/manifest.go b/cmd/apps/manifest.go
@@ -9,14 +9,15 @@ import (
 	"path/filepath"
 
 	"github.com/databricks/cli/libs/apps/manifest"
+	"github.com/databricks/cli/libs/env"
 	"github.com/spf13/cobra"
 )
 
 // runManifestOnly resolves the template, loads appkit.plugins.json if present, and prints it to stdout (or a message if not found).
 func runManifestOnly(ctx context.Context, templatePath, branch, version string) error {
 	templateSrc := templatePath
 	if templateSrc == "" {
-		templateSrc = os.Getenv(templatePathEnvVar)
+		templateSrc = env.Get(ctx, templatePathEnvVar)
 	}
 	gitRef := branch
 	usingDefaultTemplate := templateSrc == ""
diff --git a/cmd/auth/login.go b/cmd/auth/login.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os"
 	"runtime"
 	"strings"
 	"time"
@@ -249,7 +248,7 @@ depends on the existing profiles you have set in your configuration file
 				WorkspaceID:                authArguments.WorkspaceID,
 				Experimental_IsUnifiedHost: authArguments.IsUnifiedHost,
 				ClusterID:                  clusterID,
-				ConfigFile:                 os.Getenv("DATABRICKS_CONFIG_FILE"),
+				ConfigFile:                 env.Get(ctx, "DATABRICKS_CONFIG_FILE"),
 				ServerlessComputeID:        serverlessComputeID,
 				Scopes:                     scopesList,
 			}, clearKeys...)
diff --git a/cmd/auth/profiles.go b/cmd/auth/profiles.go
@@ -5,12 +5,12 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
-	"os"
 	"sync"
 	"time"
 
 	"github.com/databricks/cli/libs/cmdio"
 	"github.com/databricks/cli/libs/databrickscfg/profile"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/config"
@@ -37,7 +37,7 @@ func (c *profileMetadata) Load(ctx context.Context, configFilePath string, skipV
 		Loaders:           []config.Loader{config.ConfigFile},
 		ConfigFile:        configFilePath,
 		Profile:           c.Name,
-		DatabricksCliPath: os.Getenv("DATABRICKS_CLI_PATH"),
+		DatabricksCliPath: env.Get(ctx, "DATABRICKS_CLI_PATH"),
 	}
 	_ = cfg.EnsureResolved()
 	if cfg.IsAws() {
diff --git a/cmd/auth/token.go b/cmd/auth/token.go
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"os"
 	"strings"
 	"time"
 
@@ -474,7 +473,7 @@ func runInlineLogin(ctx context.Context, profiler profile.Profiler) (string, *pr
 		AccountID:                  loginArgs.AccountID,
 		WorkspaceID:                loginArgs.WorkspaceID,
 		Experimental_IsUnifiedHost: loginArgs.IsUnifiedHost,
-		ConfigFile:                 os.Getenv("DATABRICKS_CONFIG_FILE"),
+		ConfigFile:                 env.Get(ctx, "DATABRICKS_CONFIG_FILE"),
 		Scopes:                     scopesList,
 	}, clearKeys...)
 	if err != nil {
diff --git a/cmd/completion/install.go b/cmd/completion/install.go
@@ -23,7 +23,7 @@ func newInstallCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			ctx := cmd.Context()
 
-			shell, err := libcompletion.DetectShell(shellFlag)
+			shell, err := libcompletion.DetectShell(ctx, shellFlag)
 			if err != nil {
 				return err
 			}
@@ -37,7 +37,7 @@ func newInstallCmd() *cobra.Command {
 			displayPath := filepath.ToSlash(filePath)
 
 			// Check if already installed — no confirmation needed.
-			result, err := libcompletion.Status(shell, home)
+			result, err := libcompletion.Status(ctx, shell, home)
 			if err != nil {
 				return err
 			}
@@ -78,7 +78,7 @@ func newInstallCmd() *cobra.Command {
 				}
 			}
 
-			_, alreadyInstalled, err := libcompletion.Install(shell, home)
+			_, alreadyInstalled, err := libcompletion.Install(ctx, shell, home)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/completion/status.go b/cmd/completion/status.go
@@ -21,7 +21,7 @@ func newStatusCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			ctx := cmd.Context()
 
-			shell, err := libcompletion.DetectShell(shellFlag)
+			shell, err := libcompletion.DetectShell(ctx, shellFlag)
 			if err != nil {
 				return err
 			}
@@ -31,7 +31,7 @@ func newStatusCmd() *cobra.Command {
 				return err
 			}
 
-			result, err := libcompletion.Status(shell, home)
+			result, err := libcompletion.Status(ctx, shell, home)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/completion/uninstall.go b/cmd/completion/uninstall.go
@@ -23,7 +23,7 @@ func newUninstallCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			ctx := cmd.Context()
 
-			shell, err := libcompletion.DetectShell(shellFlag)
+			shell, err := libcompletion.DetectShell(ctx, shellFlag)
 			if err != nil {
 				return err
 			}
@@ -37,7 +37,7 @@ func newUninstallCmd() *cobra.Command {
 			displayPath := filepath.ToSlash(filePath)
 
 			// Check current status to avoid a useless prompt.
-			result, err := libcompletion.Status(shell, home)
+			result, err := libcompletion.Status(ctx, shell, home)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/labs/project/interpreters.go b/cmd/labs/project/interpreters.go
@@ -11,6 +11,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
 	"github.com/databricks/cli/libs/process"
 	"golang.org/x/mod/semver"
@@ -112,7 +113,7 @@ func DetectInterpreters(ctx context.Context) (allInterpreters, error) {
 }
 
 func pythonicExecutablesFromPathEnvironment(ctx context.Context) (out []string, err error) {
-	paths := strings.Split(os.Getenv("PATH"), string(os.PathListSeparator))
+	paths := strings.Split(env.Get(ctx, "PATH"), string(os.PathListSeparator))
 	for _, prefix := range paths {
 		info, err := os.Stat(prefix)
 		if errors.Is(err, fs.ErrNotExist) {
diff --git a/experimental/aitools/cmd/init_template/app.go b/experimental/aitools/cmd/init_template/app.go
@@ -11,6 +11,7 @@ import (
 	"github.com/databricks/cli/cmd/root"
 	"github.com/databricks/cli/experimental/aitools/lib/state"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/template"
 	"github.com/spf13/cobra"
 )
@@ -96,7 +97,7 @@ After initialization:
 		ctx := cmd.Context()
 
 		// Resolve template source: env var override or default remote
-		templatePathOrUrl := os.Getenv(templatePathEnvVar)
+		templatePathOrUrl := env.Get(ctx, templatePathEnvVar)
 		templateDir := ""
 		branch := ""
 
diff --git a/experimental/aitools/lib/installer/installer.go b/experimental/aitools/lib/installer/installer.go
@@ -24,8 +24,8 @@ const (
 	defaultSkillsRepoRef = "v0.1.2"
 )
 
-func getSkillsRef() string {
-	if ref := os.Getenv("DATABRICKS_SKILLS_REF"); ref != "" {
+func getSkillsRef(ctx context.Context) string {
+	if ref := env.Get(ctx, "DATABRICKS_SKILLS_REF"); ref != "" {
 		return ref
 	}
 	return defaultSkillsRepoRef
@@ -47,7 +47,7 @@ type SkillMeta struct {
 
 // FetchManifest fetches the skills manifest from the skills repo.
 func FetchManifest(ctx context.Context) (*Manifest, error) {
-	ref := getSkillsRef()
+	ref := getSkillsRef(ctx)
 	log.Infof(ctx, "Fetching skills manifest from %s/%s@%s", skillsRepoOwner, skillsRepoName, ref)
 	url := fmt.Sprintf("https://raw.githubusercontent.com/%s/%s/%s/manifest.json",
 		skillsRepoOwner, skillsRepoName, ref)
@@ -77,7 +77,7 @@ func FetchManifest(ctx context.Context) (*Manifest, error) {
 
 func fetchSkillFile(ctx context.Context, skillName, filePath string) ([]byte, error) {
 	url := fmt.Sprintf("https://raw.githubusercontent.com/%s/%s/%s/%s/%s/%s",
-		skillsRepoOwner, skillsRepoName, getSkillsRef(), skillsRepoPath, skillName, filePath)
+		skillsRepoOwner, skillsRepoName, getSkillsRef(ctx), skillsRepoPath, skillName, filePath)
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
diff --git a/experimental/aitools/lib/providers/clitools/configure_auth.go b/experimental/aitools/lib/providers/clitools/configure_auth.go
@@ -3,19 +3,19 @@ package clitools
 import (
 	"context"
 	"errors"
-	"os"
 
 	"github.com/databricks/cli/experimental/aitools/lib/middlewares"
 	"github.com/databricks/cli/experimental/aitools/lib/prompts"
 	"github.com/databricks/cli/experimental/aitools/lib/session"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/databricks-sdk-go"
 )
 
 // ConfigureAuth creates and validates a Databricks workspace client with optional host and profile.
 // The authenticated client is stored in the session data for reuse across tool calls.
 func ConfigureAuth(ctx context.Context, sess *session.Session, host, profile *string) (*databricks.WorkspaceClient, error) {
 	// Skip auth check if testing
-	if os.Getenv("DATABRICKS_MCP_SKIP_AUTH_CHECK") == "1" {
+	if env.Get(ctx, "DATABRICKS_MCP_SKIP_AUTH_CHECK") == "1" {
 		return nil, nil
 	}
 
diff --git a/integration/internal/acc/workspace.go b/integration/internal/acc/workspace.go
@@ -2,9 +2,9 @@ package acc
 
 import (
 	"context"
-	"os"
 
 	"github.com/databricks/cli/internal/testutil"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/databricks-sdk-go"
 	"github.com/databricks/databricks-sdk-go/service/compute"
 	"github.com/stretchr/testify/require"
@@ -47,10 +47,10 @@ func UcWorkspaceTest(t testutil.TestingT) (context.Context, *WorkspaceT) {
 
 	t.Logf("CLOUD_ENV=%s", testutil.GetEnvOrSkipTest(t, "CLOUD_ENV"))
 
-	if os.Getenv("TEST_METASTORE_ID") == "" {
+	if env.Get(t.Context(), "TEST_METASTORE_ID") == "" {
 		t.Skipf("Skipping on non-UC workspaces")
 	}
-	if os.Getenv("DATABRICKS_ACCOUNT_ID") != "" {
+	if env.Get(t.Context(), "DATABRICKS_ACCOUNT_ID") != "" {
 		t.Skipf("Skipping on accounts")
 	}
 
diff --git a/internal/testutil/env.go b/internal/testutil/env.go
@@ -10,8 +10,8 @@ import (
 // The original environment is restored upon test completion.
 // Note: use of this function is incompatible with parallel execution.
 func CleanupEnvironment(t TestingT) {
-	path := os.Getenv("PATH")
-	pwd := os.Getenv("PWD")
+	path := os.Getenv("PATH") //nolint:forbidigo // import cycle: libs/env tests import internal/testutil
+	pwd := os.Getenv("PWD")   //nolint:forbidigo // import cycle: libs/env tests import internal/testutil
 
 	// Clear all environment variables.
 	NullEnvironment(t)
diff --git a/internal/testutil/helpers.go b/internal/testutil/helpers.go
@@ -9,7 +9,7 @@ import (
 
 // GetEnvOrSkipTest proceeds with test only with that env variable.
 func GetEnvOrSkipTest(t TestingT, name string) string {
-	value := os.Getenv(name)
+	value := os.Getenv(name) //nolint:forbidigo // import cycle: libs/env tests import internal/testutil
 	if value == "" {
 		t.Skipf("Environment variable %s is missing", name)
 	}
diff --git a/libs/apps/initializer/python_pip.go b/libs/apps/initializer/python_pip.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/databricks/cli/libs/apps/prompt"
 	"github.com/databricks/cli/libs/cmdio"
+	"github.com/databricks/cli/libs/env"
 	"github.com/databricks/cli/libs/log"
 )
 
@@ -70,7 +71,7 @@ func (i *InitializerPythonPip) RunDev(ctx context.Context, workDir string) error
 	execCmd.Stderr = os.Stderr
 	execCmd.Stdin = os.Stdin
 	// Also set PATH for any child processes the command might spawn
-	execCmd.Env = append(os.Environ(), "PATH="+venvBin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	execCmd.Env = append(os.Environ(), "PATH="+venvBin+string(os.PathListSeparator)+env.Get(ctx, "PATH"))
 
 	return execCmd.Run()
 }
diff --git a/libs/completion/install.go b/libs/completion/install.go
@@ -1,15 +1,16 @@
 package completion
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 )
 
 // Install configures shell completion for the given shell. homeDir is used
 // as the base for RC file resolution (typically env.UserHomeDir()).
 // Returns the file path modified and whether it was already installed.
-func Install(shell Shell, homeDir string) (filePath string, alreadyInstalled bool, err error) {
-	status, err := Status(shell, homeDir)
+func Install(ctx context.Context, shell Shell, homeDir string) (filePath string, alreadyInstalled bool, err error) {
+	status, err := Status(ctx, shell, homeDir)
 	if err != nil {
 		return TargetFilePath(shell, homeDir), false, err
 	}
diff --git a/libs/completion/install_test.go b/libs/completion/install_test.go
diff --git a/libs/completion/shell.go b/libs/completion/shell.go
diff --git a/libs/completion/shell_test.go b/libs/completion/shell_test.go
diff --git a/libs/completion/status.go b/libs/completion/status.go
diff --git a/libs/completion/status_test.go b/libs/completion/status_test.go
diff --git a/libs/completion/uninstall_test.go b/libs/completion/uninstall_test.go
diff --git a/libs/git/config.go b/libs/git/config.go
diff --git a/libs/python/pythontest/pythontest.go b/libs/python/pythontest/pythontest.go

Original file line number	Diff line number	Diff line change
`@@ -64,7 +64,7 @@ func isTruePtr(value *bool) bool {`
`64`	`64`	`}`
`65`	`65`
`66`	`66`	`func PrepareServerAndClient(t testing.T, config TestConfig, logRequests bool, outputDir string) (sdkconfig.Config, iam.User) {`
`67`		`- cloudEnv := os.Getenv("CLOUD_ENV")`
	`67`	`+ cloudEnv := env.Get(t.Context(), "CLOUD_ENV")`
`68`	`68`	`recordRequests := isTruePtr(config.RecordRequests)`
`69`	`69`
`70`	`70`	`// Use a unique token for each test. This allows us to maintain`
`@@ -107,7 +107,7 @@ func PrepareServerAndClient(t *testing.T, config TestConfig, logRequests bool, o`
`107`	`107`	`// use the default shared server.`
`108`	`108`	`if len(config.Server) == 0 && !recordRequests {`
`109`	`109`	`cfg := &sdkconfig.Config{`
`110`		`- Host: os.Getenv("DATABRICKS_DEFAULT_HOST"),`
	`110`	`+ Host: env.Get(t.Context(), "DATABRICKS_DEFAULT_HOST"),`
`111`	`111`	`Token: token,`
`112`	`112`	`}`
`113`	`113`
Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ func newInstallCmd() *cobra.Command {`
`23`	`23`	`RunE: func(cmd *cobra.Command, args []string) error {`
`24`	`24`	`ctx := cmd.Context()`
`25`	`25`
`26`		`- shell, err := libcompletion.DetectShell(shellFlag)`
	`26`	`+ shell, err := libcompletion.DetectShell(ctx, shellFlag)`
`27`	`27`	`if err != nil {`
`28`	`28`	`return err`
`29`	`29`	`}`
`@@ -37,7 +37,7 @@ func newInstallCmd() *cobra.Command {`
`37`	`37`	`displayPath := filepath.ToSlash(filePath)`
`38`	`38`
`39`	`39`	`// Check if already installed — no confirmation needed.`
`40`		`- result, err := libcompletion.Status(shell, home)`
	`40`	`+ result, err := libcompletion.Status(ctx, shell, home)`
`41`	`41`	`if err != nil {`
`42`	`42`	`return err`
`43`	`43`	`}`
`@@ -78,7 +78,7 @@ func newInstallCmd() *cobra.Command {`
`78`	`78`	`}`
`79`	`79`	`}`
`80`	`80`
`81`		`- _, alreadyInstalled, err := libcompletion.Install(shell, home)`
	`81`	`+ _, alreadyInstalled, err := libcompletion.Install(ctx, shell, home)`
`82`	`82`	`if err != nil {`
`83`	`83`	`return err`
`84`	`84`	`}`
Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@ func newStatusCmd() *cobra.Command {`
`21`	`21`	`RunE: func(cmd *cobra.Command, args []string) error {`
`22`	`22`	`ctx := cmd.Context()`
`23`	`23`
`24`		`- shell, err := libcompletion.DetectShell(shellFlag)`
	`24`	`+ shell, err := libcompletion.DetectShell(ctx, shellFlag)`
`25`	`25`	`if err != nil {`
`26`	`26`	`return err`
`27`	`27`	`}`
`@@ -31,7 +31,7 @@ func newStatusCmd() *cobra.Command {`
`31`	`31`	`return err`
`32`	`32`	`}`
`33`	`33`
`34`		`- result, err := libcompletion.Status(shell, home)`
	`34`	`+ result, err := libcompletion.Status(ctx, shell, home)`
`35`	`35`	`if err != nil {`
`36`	`36`	`return err`
`37`	`37`	`}`