Fix CI reliability and stabilize macOS GPG integration tests

Author: qasim-nylas

.golangci.yml

@@ -14,8 +14,6 @@ linters:
     # Bugs
     - durationcheck
     - reassign
-  disable:
-    - staticcheck
 
   settings:
     govet:

Makefile

@@ -125,11 +125,13 @@ test-air-integration:
 # -p 1: Run test packages sequentially to prevent rate limit issues
 test-integration:
 	@go clean -testcache
-	NYLAS_DISABLE_KEYRING=true \
-	NYLAS_TEST_RATE_LIMIT_RPS=$(NYLAS_TEST_RATE_LIMIT_RPS) \
-	NYLAS_TEST_RATE_LIMIT_BURST=$(NYLAS_TEST_RATE_LIMIT_BURST) \
-	NYLAS_TEST_BINARY=$(CURDIR)/bin/nylas \
-	go test ./... -tags=integration -v -timeout 10m -p 1 2>&1 | tee test-integration.txt
+	@bash -o pipefail -c '\
+		NYLAS_DISABLE_KEYRING=true \
+		NYLAS_TEST_RATE_LIMIT_RPS=$(NYLAS_TEST_RATE_LIMIT_RPS) \
+		NYLAS_TEST_RATE_LIMIT_BURST=$(NYLAS_TEST_RATE_LIMIT_BURST) \
+		NYLAS_TEST_BINARY=$(CURDIR)/bin/nylas \
+		go test ./... -tags=integration -v -timeout 10m -p 1 2>&1 | tee test-integration.txt \
+	'
 
 # Integration tests excluding slow LLM-dependent tests (for when Ollama is slow/unavailable)
 # Runs: Admin, Timezone, AIConfig, CalendarAI (Basic, Adapt, Analyze working hours)
@@ -302,25 +304,30 @@ ci-full:
 	@echo "================================="
 	@echo "Running Full CI Pipeline..."
 	@echo "================================="
-	@$(MAKE) --no-print-directory ci 2>&1 | tee ci-full.txt
-	@echo "" | tee ci-full.txt
-	@echo "=================================" | tee ci-full.txt
-	@echo "Running Integration Tests..." | tee ci-full.txt
-	@echo "=================================" | tee ci-full.txt
-	@$(MAKE) --no-print-directory test-integration 2>&1 | tee ci-full.txt
-	@$(MAKE) --no-print-directory test-air-integration 2>&1 | tee ci-full.txt
-	@echo "" | tee ci-full.txt
-	@echo "=================================" | tee ci-full.txt
-	@echo "Cleaning up test resources..." | tee ci-full.txt
-	@echo "=================================" | tee ci-full.txt
-	@$(MAKE) --no-print-directory test-cleanup 2>&1 | tee ci-full.txt
-	@echo "" | tee ci-full.txt
-	@echo "=================================" | tee ci-full.txt
-	@echo "✓ Full CI pipeline completed!" | tee ci-full.txt
-	@echo "  - All quality checks passed" | tee ci-full.txt
-	@echo "  - All tests passed" | tee ci-full.txt
-	@echo "  - Test resources cleaned up" | tee ci-full.txt
-	@echo "=================================" | tee ci-full.txt
+	@: > ci-full.txt
+	@bash -o pipefail -c '\
+		set -eu; \
+		exec > >(tee -a ci-full.txt) 2>&1; \
+		$(MAKE) --no-print-directory ci; \
+		echo ""; \
+		echo "================================="; \
+		echo "Running Integration Tests..."; \
+		echo "================================="; \
+		$(MAKE) --no-print-directory test-integration; \
+		$(MAKE) --no-print-directory test-air-integration; \
+		echo ""; \
+		echo "================================="; \
+		echo "Cleaning up test resources..."; \
+		echo "================================="; \
+		$(MAKE) --no-print-directory test-cleanup; \
+		echo ""; \
+		echo "================================="; \
+		echo "✓ Full CI pipeline completed!"; \
+		echo "  - All quality checks passed"; \
+		echo "  - All tests passed"; \
+		echo "  - Test resources cleaned up"; \
+		echo "================================="; \
+	'
 	@echo ""
 	@echo "Results saved to ci-full.txt"
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/nylas/cli
 
-go 1.24.2
+go 1.26.0
 
 require (
 	github.com/atotto/clipboard v0.1.4

internal/adapters/ai/email_analyzer_core.go

@@ -80,17 +80,17 @@ func (a *EmailAnalyzer) fetchThreadMessages(ctx context.Context, grantID, thread
 func (a *EmailAnalyzer) buildThreadContext(thread *domain.Thread, messages []domain.Message) string {
 	var builder strings.Builder
 
-	builder.WriteString(fmt.Sprintf("Email Thread: %s\n", thread.Subject))
-	builder.WriteString(fmt.Sprintf("Participants: %d\n", len(thread.Participants)))
-	builder.WriteString(fmt.Sprintf("Messages: %d\n\n", len(messages)))
+	_, _ = fmt.Fprintf(&builder, "Email Thread: %s\n", thread.Subject)
+	_, _ = fmt.Fprintf(&builder, "Participants: %d\n", len(thread.Participants))
+	_, _ = fmt.Fprintf(&builder, "Messages: %d\n\n", len(messages))
 
 	// Add participants
 	builder.WriteString("Participants:\n")
 	for _, p := range thread.Participants {
 		if p.Name != "" {
-			builder.WriteString(fmt.Sprintf("- %s <%s>\n", p.Name, p.Email))
+			_, _ = fmt.Fprintf(&builder, "- %s <%s>\n", p.Name, p.Email)
 		} else {
-			builder.WriteString(fmt.Sprintf("- %s\n", p.Email))
+			_, _ = fmt.Fprintf(&builder, "- %s\n", p.Email)
 		}
 	}
 	builder.WriteString("\n")
@@ -111,7 +111,7 @@ func (a *EmailAnalyzer) buildThreadContext(thread *domain.Thread, messages []dom
 		// Format timestamp
 		timestamp := msg.Date.Format("Jan 2, 2006 3:04 PM")
 
-		builder.WriteString(fmt.Sprintf("\n[%s] %s:\n", timestamp, sender))
+		_, _ = fmt.Fprintf(&builder, "\n[%s] %s:\n", timestamp, sender)
 
 		// Add message body (truncate if too long)
 		body := msg.Body

internal/adapters/ai/email_analyzer_prompts.go

@@ -314,17 +314,17 @@ func (a *EmailAnalyzer) AnalyzeInbox(ctx context.Context, req *InboxSummaryReque
 func (a *EmailAnalyzer) buildInboxPrompt(messages []domain.Message) string {
 	var sb strings.Builder
 
-	sb.WriteString(fmt.Sprintf("Analyze these %d emails and provide insights:\n\n", len(messages)))
+	_, _ = fmt.Fprintf(&sb, "Analyze these %d emails and provide insights:\n\n", len(messages))
 
 	for i, msg := range messages {
-		sb.WriteString(fmt.Sprintf("--- Email %d ---\n", i+1))
-		sb.WriteString(fmt.Sprintf("From: %s\n", formatInboxParticipants(msg.From)))
-		sb.WriteString(fmt.Sprintf("Subject: %s\n", msg.Subject))
-		sb.WriteString(fmt.Sprintf("Date: %s\n", msg.Date.Format(time.RFC3339)))
+		_, _ = fmt.Fprintf(&sb, "--- Email %d ---\n", i+1)
+		_, _ = fmt.Fprintf(&sb, "From: %s\n", formatInboxParticipants(msg.From))
+		_, _ = fmt.Fprintf(&sb, "Subject: %s\n", msg.Subject)
+		_, _ = fmt.Fprintf(&sb, "Date: %s\n", msg.Date.Format(time.RFC3339))
 
 		// Use snippet for preview (cleaner than full body)
 		if msg.Snippet != "" {
-			sb.WriteString(fmt.Sprintf("Preview: %s\n", truncateStr(msg.Snippet, 200)))
+			_, _ = fmt.Fprintf(&sb, "Preview: %s\n", truncateStr(msg.Snippet, 200))
 		}
 
 		if msg.Unread {

internal/adapters/config/validation.go

@@ -52,7 +52,7 @@ func FormatMissingEnvVars(missing []string, vars []RequiredEnvVar) string {
 		if desc == "" {
 			desc = "No description available"
 		}
-		sb.WriteString(fmt.Sprintf("  %s - %s\n", name, desc))
+		_, _ = fmt.Fprintf(&sb, "  %s - %s\n", name, desc)
 	}
 
 	return sb.String()

internal/adapters/gpg/decrypt_test.go

@@ -150,6 +150,9 @@ func TestDecryptData_Integration(t *testing.T) {
 	// Decrypt the data
 	decResult, err := svc.DecryptData(ctx, encResult.Ciphertext)
 	if err != nil {
+		if isNonInteractiveGPGError(err.Error()) {
+			t.Skipf("GPG requires interactive passphrase entry in this environment: %v", err)
+		}
 		t.Fatalf("DecryptData() error = %v", err)
 	}
 
@@ -196,6 +199,9 @@ func TestDecryptSignedAndEncryptedData_Integration(t *testing.T) {
 	// Decrypt the data
 	decResult, err := svc.DecryptData(ctx, encResult.Ciphertext)
 	if err != nil {
+		if isNonInteractiveGPGError(err.Error()) {
+			t.Skipf("GPG requires interactive passphrase entry in this environment: %v", err)
+		}
 		t.Fatalf("DecryptData() error = %v", err)
 	}
 
@@ -214,3 +220,23 @@ func TestDecryptSignedAndEncryptedData_Integration(t *testing.T) {
 		t.Error("Expected SignatureOK=true for valid signature")
 	}
 }
+
+func isNonInteractiveGPGError(errMsg string) bool {
+	nonInteractiveErrors := []string{
+		"cannot open '/dev/tty'",
+		"no pinentry",
+		"inappropriate ioctl for device",
+		"need_passphrase",
+		"inquire_maxlen",
+		"operation cancelled",
+	}
+
+	lowerErr := strings.ToLower(errMsg)
+	for _, marker := range nonInteractiveErrors {
+		if strings.Contains(lowerErr, marker) {
+			return true
+		}
+	}
+
+	return false
+}

internal/adapters/mime/builder.go

@@ -111,7 +111,7 @@ func (b *builder) BuildSignedMessage(req *SignedMessageRequest) ([]byte, error)
 
 	// Write Content-Type for multipart/signed
 	buf.WriteString("Content-Type: multipart/signed; protocol=\"application/pgp-signature\";\r\n")
-	buf.WriteString(fmt.Sprintf("\tmicalg=%s; boundary=\"%s\"\r\n", micalg, signedBoundary))
+	_, _ = fmt.Fprintf(&buf, "\tmicalg=%s; boundary=\"%s\"\r\n", micalg, signedBoundary)
 	buf.WriteString("\r\n")
 
 	// Write first part: the content to be signed

internal/adapters/mime/encrypted.go

@@ -75,7 +75,7 @@ func (b *builder) BuildEncryptedMessage(req *EncryptedMessageRequest) ([]byte, e
 	// Write Content-Type for multipart/encrypted (RFC 3156 Section 4)
 	buf.WriteString("Content-Type: multipart/encrypted;\r\n")
 	buf.WriteString("\tprotocol=\"application/pgp-encrypted\";\r\n")
-	buf.WriteString(fmt.Sprintf("\tboundary=\"%s\"\r\n", encryptedBoundary))
+	_, _ = fmt.Fprintf(&buf, "\tboundary=\"%s\"\r\n", encryptedBoundary)
 	buf.WriteString("\r\n")
 
 	// Part 1: Version identification (required by RFC 3156)

internal/air/handlers_ai_thread.go

@@ -51,10 +51,10 @@ func (s *Server) handleAIThreadSummary(w http.ResponseWriter, r *http.Request) {
 			body = body[:1000] + "..."
 		}
 
-		conversationBuilder.WriteString(fmt.Sprintf("--- Message %d ---\n", i+1))
-		conversationBuilder.WriteString(fmt.Sprintf("From: %s\n", msg.From))
+		_, _ = fmt.Fprintf(&conversationBuilder, "--- Message %d ---\n", i+1)
+		_, _ = fmt.Fprintf(&conversationBuilder, "From: %s\n", msg.From)
 		if msg.Subject != "" {
-			conversationBuilder.WriteString(fmt.Sprintf("Subject: %s\n", msg.Subject))
+			_, _ = fmt.Fprintf(&conversationBuilder, "Subject: %s\n", msg.Subject)
 		}
 		conversationBuilder.WriteString(body)
 		conversationBuilder.WriteString("\n\n")