Some bug fixes:

- logging: LogToFile shadowed the package-level fileLogger, so
  IsFileLogger was always false and Shutdown never closed the file
- logging: replace IsJSONHandler's unsafe reflection into slog
  internals with a *slog.JSONHandler type check
- cli: fail if the log file can't be opened instead of silently
  logging to the terminal; return the log shutdown error from Finish
- build.sh: -X flags used the wrong module path, so the version, build
  time and commit were never stamped

internal/config/modify_test.go

@@ -16,7 +16,7 @@ func useConfigFile(t *testing.T, contents string) string {
 	t.Helper()
 	resetViper(t)
 	path := filepath.Join(t.TempDir(), "config.yaml")
-	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
+	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	viper.SetConfigFile(path)
@@ -92,6 +92,7 @@ func TestStoreValueErrors(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			path := useConfigFile(t, "logging:\n  level: warn\n")
+			//nolint:gosec // G304: reading a file the test created in t.TempDir
 			before, _ := os.ReadFile(path)
 			conf := defaultConfig(t)
 
@@ -102,6 +103,7 @@ func TestStoreValueErrors(t *testing.T) {
 			if !strings.Contains(err.Error(), tt.wantErr) {
 				t.Errorf("err = %v; want it to mention %q", err, tt.wantErr)
 			}
+			//nolint:gosec // G304: reading a file the test created in t.TempDir
 			if after, _ := os.ReadFile(path); string(after) != string(before) {
 				t.Errorf("config file changed:\n%s", after)
 			}
@@ -135,12 +137,14 @@ func TestPurgeValue(t *testing.T) {
 
 func TestPurgeValueErrors(t *testing.T) {
 	path := useConfigFile(t, "logging:\n  level: debug\n")
+	//nolint:gosec // G304: reading a file the test created in t.TempDir
 	before, _ := os.ReadFile(path)
 	conf := defaultConfig(t)
 
 	if err := PurgeValue(&conf, "nope"); err == nil {
 		t.Error("expected an error for an unknown key")
 	}
+	//nolint:gosec // G304: reading a file the test created in t.TempDir
 	if after, _ := os.ReadFile(path); string(after) != string(before) {
 		t.Errorf("config file changed:\n%s", after)
 	}