Add nolint comments for false positives

Author: tjmoore4

internal/controller/standalone_pgadmin/users.go

@@ -36,6 +36,7 @@ type pgAdminUserForJson struct {
 	IsAdmin bool `json:"isAdmin"`
 
 	// The user's password
+	//nolint:gosec // G117: This is a JSON serialization struct, not a hardcoded credential.
 	Password string `json:"password"`
 
 	// The username for User in pgAdmin.

internal/patroni/config.go

@@ -474,6 +474,7 @@ func instanceYAML(
 		},
 	}
 
+	//nolint:gosec // G101: "pgpass" is a Patroni configuration key for a file path, not a credential.
 	postgresql := map[string]any{
 		// Missing here is "connect_address" which cannot be known until the
 		// instance Pod is created. That value should be injected using the downward

internal/postgres/parameters_test.go

@@ -25,6 +25,7 @@ func TestNewParameters(t *testing.T) {
 
 		"wal_level": "logical",
 	})
+	//nolint:gosec // G101: "password_encryption" is a PostgreSQL parameter name, not a credential.
 	assert.DeepEqual(t, parameters.Default.AsMap(), map[string]string{
 		"jit": "off",
 

internal/postgres/password/scram_test.go

@@ -190,6 +190,7 @@ func TestSCRAMSASLPrep(t *testing.T) {
 	tests := []stringStruct{
 		{password: "hippo", expected: "hippo"},
 		{password: "híppo", expected: "híppo"},
+		//nolint:gosec // G101: Test data for password normalization, not a credential.
 		{password: "こんにちは", expected: "こんにちは"},
 		{password: "hippo\u1680lake", expected: "hippo lake"},
 		{password: "hipp\ufe01o", expected: "hippo"},

internal/util/secrets_test.go

@@ -20,6 +20,7 @@ func TestAccumulate(t *testing.T) {
 	called := 0
 	result, err := accumulate(10, func() (byte, error) {
 		called++
+		//nolint:gosec // G115: called is bounded by test iteration count, no overflow possible.
 		return byte('A' + called), nil
 	})
 
@@ -33,6 +34,7 @@ func TestAccumulate(t *testing.T) {
 		result, err := accumulate(10, func() (byte, error) {
 			called++
 			if called < 5 {
+				//nolint:gosec // G115: called is bounded by test iteration count, no overflow possible.
 				return byte('A' + called), nil
 			} else {
 				return 'Z', expected