Cursor bug bot fixes

[khisakuni]

What was changed

Updates to address the cursor bot issues flagged in #9

Included the changes for most of the cursor bot comments in this PR since each change is pretty small, but please let me know if it'd be preferable to split this up into individual PRs.

List of comments and how they were addressed:

Comment 1: Wrong parameter passed to promptApplyResource
Resolution: Added diff option set with a verbose-diff flag and used this flag for the commands.

Comment 2: Temp file never deleted in editor function
Resolution: Lines 84-87 in common.go now include a defer statement that calls os.Remove to clean up the temp file.

Comment 3: Edit command may create wrong namespace on name change
Resolution: Changed apply command to call updateNamespace/createNamespace directly instead of applyNamespace, and updated all other commands (edit, retention set, lifecycle set) to use updateNamespace
directly.

Comment 4: CommonOptions not propagated to CloudOptions in Build
Resolution: CloudOptionsBuilder.Build assigns CommonOptions to cloudOpts on line 55 of cloud.go.

Comment 5: Test validates wrong variable for server config
Resolution: Line 185 in commands_test.go now correctly validates s.server instead of s.apiKey.

Comment 6: Multiple unexported functions are unused dead code
Resolution: All unused functions (aliasNormalizer, timestampToTime, fromApplicationError, encodeMapToPayloads, overrideFlagDisplayType) have been removed from commands.go.

Comment 7: Login dereferences potentially nil ClientConfig pointer
Resolution: Line 22 in commands.login.go now checks loadClientOauthRes.OAuth.Token != nil before dereferencing ClientConfig on line 24.

Comment 8: Build workflow missing Go setup step
Resolution: Both jobs in build.yml now include actions/setup-go@v6 steps (lines 19-24 and 46-51).

Why?

Checklist

1. Closes

2. How was this tested:

3. Any docs updates needed?

---

Note

Medium Risk
Touches namespace create/update flows and prompting behavior, which can affect how changes are applied to real cloud resources, but changes are small and largely correctness/hardening focused.

Overview
CI/workflows: Add explicit actions/setup-go@v6 (via go.mod) to build and test workflows and set minimal contents: read permissions.

CLI correctness fixes: Introduce a shared DiffOptions/--verbose-diff option set and wire it into namespace mutation commands so promptApplyResource uses the correct verbose-diff toggle (instead of --auto-confirm). Namespace mutation commands now call createNamespace vs updateNamespace directly (and remove the old applyNamespace helper) to avoid accidental namespace creation on edit when the spec name changes; retention/lifecycle/edit paths are aligned to updateNamespace.

Hardening/cleanup: Ensure editor temp files are deleted, propagate CommonOptions into CloudOptions, guard against nil OAuth token/config during login, fix an integration test env-var assertion, and remove unused dead-code helpers from commands.go.

^{Written by Cursor Bugbot for commit 7178a70. This will update automatically on new commits. Configure here.}

[semgrep-managed-scans]

Semgrep found 2 missing-explicit-permissions findings:

• .github/workflows/build.yml
  • L12-36 - Triage
  • L38-50 - Triage

No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.