Repository: kubernetes-sigs/security-profiles-operator
Pull request #1072 (2022-08-05 07:33:51)

Bump golangci-lint to v1.48.0


#### What type of PR is this?


/kind cleanup


#### What this PR does / why we need it:
This incorporates new linters as well as the configuration update. New lint reports have been fixed as well.

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-unit | b01478eb902cb989cba3a8a101624c38b0b8a0b1 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1072/pull-security-profiles-operator-test-unit/1555457042905305088) | true | `/test pull-security-profiles-operator-test-unit`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1072). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1072?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#1072](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/1072?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (52be4bb) into [main](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/b33aadac4b7e90da550a7aa79d3495137d106a96?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (b33aada) will **increase** coverage by `0.03%`.
> The diff coverage is `66.66%`.

> :exclamation: Current head 52be4bb differs from pull request most recent head 761bbe7. Consider uploading reports for the commit 761bbe7 to get more accurate results

```diff
@@            Coverage Diff             @@
##             main    #1072      +/-   ##
==========================================
+ Coverage   50.43%   50.46%   +0.03%     
==========================================
  Files          42       42              
  Lines        4761     4756       -5     
==========================================
- Hits         2401     2400       -1     
+ Misses       2281     2278       -3     
+ Partials       79       78       -1     
```

k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#pullrequestreview-1062997284" title="LGTM">jhrozek</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [jhrozek,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#pullrequestreview-1062997284" title="LGTM">jhrozek</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#pullrequestreview-1064294798" title="LGTM">pjbgf</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [jhrozek,pjbgf,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 761bbe704f7322f5450ad29c22a72c2f809061b4 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1072/pull-security-profiles-operator-verify/1555867346734682112) | unknown | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1072). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
pjbgf: /retest
k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 761bbe704f7322f5450ad29c22a72c2f809061b4 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1072/pull-security-profiles-operator-verify/1555868114955014144) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1072). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-verify | 761bbe704f7322f5450ad29c22a72c2f809061b4 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1072/pull-security-profiles-operator-verify/1555868114955014144) | true | `/test pull-security-profiles-operator-verify`
pull-security-profiles-operator-test-e2e | 761bbe704f7322f5450ad29c22a72c2f809061b4 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1072/pull-security-profiles-operator-test-e2e/1555867346856316928) | unknown | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1072). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#pullrequestreview-1070975135" title="Approved">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#pullrequestreview-1062997284" title="LGTM">jhrozek</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#pullrequestreview-1064294798" title="LGTM">pjbgf</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/1072#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/OWNERS)~~ [JAORMX,jhrozek,pjbgf,saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
k8s-ci-robot: New changes are detected. LGTM label has been removed.
k8s-ci-robot: @saschagrunert: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 761bbe704f7322f5450ad29c22a72c2f809061b4 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1072/pull-security-profiles-operator-test-e2e/1555867346856316928) | unknown | `/test pull-security-profiles-operator-test-e2e`
pull-security-profiles-operator-verify | e30e0592180dfbe5f5271d09b35ec566f1786683 | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/1072/pull-security-profiles-operator-verify/1561606010601213952) | true | `/test pull-security-profiles-operator-verify`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=1072). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: Rebased and fixed a bunch of other lint reports.

Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5b14ffe7f..c6476f69b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -80,6 +80,8 @@ jobs:
             quay.io/security-profiles-operator/security-profiles-operator
           tags: |
             type=ref,event=branch
+            type=ref,event=pr
+            type=ref,event=tag
             type=sha,format=long
       - name: Build (and push if needed)
         uses: docker/build-push-action@c84f38281176d4c9cdb1626ffafcd6b3911b5d94
@@ -89,11 +91,12 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           push: ${{ github.ref == 'refs/heads/main' }}
-          load: true
+          # Only load on PR builds
+          load: ${{ github.ref != 'refs/heads/main' }}
       - name: Run container image vulnerability scanner
         uses: aquasecurity/trivy-action@d63413b0a4a4482237085319f7f4a1ce99a8f2ac
         with:
-          image-ref: ${{ steps.meta.outputs.tags }}
+          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
           format: 'table'
           # TODO(jaosorior): Fix this once we bump the NixOS dependencies.
           exit-code: '0'
@@ -126,6 +129,8 @@ jobs:
             suffix=-ubi
           tags: |
             type=ref,event=branch
+            type=ref,event=pr
+            type=ref,event=tag
             type=sha,format=long
       # TODO(jaosorior): Push UBI image too
       - name: Build
@@ -139,7 +144,7 @@ jobs:
       - name: Run container image vulnerability scanner
         uses: aquasecurity/trivy-action@d63413b0a4a4482237085319f7f4a1ce99a8f2ac
         with:
-          image-ref: ${{ steps.meta.outputs.tags }}
+          image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
           format: 'table'
           exit-code: '1'
           ignore-unfixed: true
diff --git a/.golangci.yml b/.golangci.yml
index 8167a5649..52fc3e54a 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -15,6 +15,7 @@ issues:
 linters:
   disable-all: true
   enable:
+    - asasalint
     - asciicheck
     - bidichk
     - bodyclose
@@ -37,7 +38,7 @@ linters:
     - gochecknoinits
     - gocognit
     - goconst
-    # - gocritic # TODO: re-enable when it supports go 1.18 and generics
+    # - gocritic # TODO: re-enable when it supports go >1.18 and generics
     - gocyclo
     - godot
     - godox
@@ -85,12 +86,12 @@ linters:
     - unconvert
     - unparam
     - unused
+    - usestdlibvars
     - varcheck
     - wastedassign
     - whitespace
     # - contextcheck
     # - cyclop
-    # - exhaustivestruct
     # - exhaustruct
     # - forbidigo
     # - funlen
@@ -99,6 +100,7 @@ linters:
     # - maintidx
     # - nlreturn
     # - nonamedreturns
+    # - nosnakecase
     # - testpackage
     # - varnamelen
     # - wrapcheck
diff --git a/Makefile b/Makefile
index e751fc813..91ce016de 100644
--- a/Makefile
+++ b/Makefile
@@ -14,7 +14,7 @@
 
 GO ?= go
 
-GOLANGCI_LINT_VERSION = v1.46.2
+GOLANGCI_LINT_VERSION = v1.48.0
 REPO_INFRA_VERSION = v0.2.5
 KUSTOMIZE_VERSION = 4.5.5
 OPERATOR_SDK_VERSION ?= v1.22.2
diff --git a/api/apparmorprofile/v1alpha1/apparmorprofile_types.go b/api/apparmorprofile/v1alpha1/apparmorprofile_types.go
index 247427937..a06fc3be8 100644
--- a/api/apparmorprofile/v1alpha1/apparmorprofile_types.go
+++ b/api/apparmorprofile/v1alpha1/apparmorprofile_types.go
@@ -73,7 +73,7 @@ type AppArmorProfileList struct {
 	Items           []AppArmorProfile `json:"items"`
 }
 
-func init() { // nolint:gochecknoinits // required to init the scheme
+func init() { //nolint:gochecknoinits // required to init the scheme
 	SchemeBuilder.Register(&AppArmorProfile{}, &AppArmorProfileList{})
 }
 
diff --git a/api/apparmorprofile/v1alpha1/groupversion_info.go b/api/apparmorprofile/v1alpha1/groupversion_info.go
index e3b8cf01c..9b839174a 100644
--- a/api/apparmorprofile/v1alpha1/groupversion_info.go
+++ b/api/apparmorprofile/v1alpha1/groupversion_info.go
@@ -15,8 +15,8 @@ limitations under the License.
 */
 
 // Package v1alpha1 contains API Schema definitions for the security-profiles-operator v1alpha1 API group
-//+kubebuilder:object:generate=true
-//+groupName=security-profiles-operator.x-k8s.io
+// +kubebuilder:object:generate=true
+// +groupName=security-profiles-operator.x-k8s.io
 package v1alpha1
 
 import (
diff --git a/api/profilebinding/v1alpha1/profilebinding_types.go b/api/profilebinding/v1alpha1/profilebinding_types.go
index a4036baed..749401e8d 100644
--- a/api/profilebinding/v1alpha1/profilebinding_types.go
+++ b/api/profilebinding/v1alpha1/profilebinding_types.go
@@ -70,6 +70,6 @@ type ProfileBindingList struct {
 	Items           []ProfileBinding `json:"items"`
 }
 
-func init() { // nolint:gochecknoinits // required to register the scheme
+func init() { //nolint:gochecknoinits // required to register the scheme
 	SchemeBuilder.Register(&ProfileBinding{}, &ProfileBindingList{})
 }
diff --git a/api/profilerecording/v1alpha1/profilerecording_types.go b/api/profilerecording/v1alpha1/profilerecording_types.go
index 73a5f854b..b1a51749c 100644
--- a/api/profilerecording/v1alpha1/profilerecording_types.go
+++ b/api/profilerecording/v1alpha1/profilerecording_types.go
@@ -182,6 +182,6 @@ type ProfileRecordingList struct {
 	Items           []ProfileRecording `json:"items"`
 }
 
-func init() { // nolint:gochecknoinits // required to init the scheme
+func init() { //nolint:gochecknoinits // required to init the scheme
 	SchemeBuilder.Register(&ProfileRecording{}, &ProfileRecordingList{})
 }
diff --git a/api/seccompprofile/v1beta1/seccompprofile_types.go b/api/seccompprofile/v1beta1/seccompprofile_types.go
index 89177688d..470a802f7 100644
--- a/api/seccompprofile/v1beta1/seccompprofile_types.go
+++ b/api/seccompprofile/v1beta1/seccompprofile_types.go
@@ -64,8 +64,9 @@ type SeccompProfileSpec struct {
 	Flags []*Flag `json:"flags,omitempty"`
 }
 
-//nolint:lll // required for kubebuilder
 // +kubebuilder:validation:Enum=SCMP_ARCH_NATIVE;SCMP_ARCH_X86;SCMP_ARCH_X86_64;SCMP_ARCH_X32;SCMP_ARCH_ARM;SCMP_ARCH_AARCH64;SCMP_ARCH_MIPS;SCMP_ARCH_MIPS64;SCMP_ARCH_MIPS64N32;SCMP_ARCH_MIPSEL;SCMP_ARCH_MIPSEL64;SCMP_ARCH_MIPSEL64N32;SCMP_ARCH_PPC;SCMP_ARCH_PPC64;SCMP_ARCH_PPC64LE;SCMP_ARCH_S390;SCMP_ARCH_S390X;SCMP_ARCH_PARISC;SCMP_ARCH_PARISC64;SCMP_ARCH_RISCV64
+//
+//nolint:lll // required for kubebuilder
 type Arch string
 
 // +kubebuilder:validation:Enum=SECCOMP_FILTER_FLAG_TSYNC;SECCOMP_FILTER_FLAG_LOG;SECCOMP_FILTER_FLAG_SPEC_ALLOW
@@ -179,6 +180,6 @@ type SeccompProfileList struct {
 	Items           []SeccompProfile `json:"items"`
 }
 
-func init() { // nolint:gochecknoinits // required to init scheme
+func init() { //nolint:gochecknoinits // required to init scheme
 	SchemeBuilder.Register(&SeccompProfile{}, &SeccompProfileList{})
 }
diff --git a/api/secprofnodestatus/v1alpha1/secprofnodestatus_types.go b/api/secprofnodestatus/v1alpha1/secprofnodestatus_types.go
index dfb47b35f..d57050388 100644
--- a/api/secprofnodestatus/v1alpha1/secprofnodestatus_types.go
+++ b/api/secprofnodestatus/v1alpha1/secprofnodestatus_types.go
@@ -101,6 +101,6 @@ type SecurityProfileNodeStatusList struct {
 	Items           []SecurityProfileNodeStatus `json:"items"`
 }
 
-func init() { // nolint:gochecknoinits // required to init the scheme
+func init() { //nolint:gochecknoinits // required to init the scheme
 	SchemeBuilder.Register(&SecurityProfileNodeStatus{}, &SecurityProfileNodeStatusList{})
 }
diff --git a/api/selinuxprofile/v1alpha2/rawselinuxprofile_types.go b/api/selinuxprofile/v1alpha2/rawselinuxprofile_types.go
index bfe066798..b9fb44ef3 100644
--- a/api/selinuxprofile/v1alpha2/rawselinuxprofile_types.go
+++ b/api/selinuxprofile/v1alpha2/rawselinuxprofile_types.go
@@ -78,6 +78,6 @@ type RawSelinuxProfileList struct {
 	Items           []SelinuxProfile `json:"items"`
 }
 
-func init() { // nolint:gochecknoinits // required to init the scheme
+func init() { //nolint:gochecknoinits // required to init the scheme
 	SchemeBuilder.Register(&RawSelinuxProfile{}, &RawSelinuxProfileList{})
 }
diff --git a/api/selinuxprofile/v1alpha2/selinuxprofile_types.go b/api/selinuxprofile/v1alpha2/selinuxprofile_types.go
index d6254bad3..b58b0385c 100644
--- a/api/selinuxprofile/v1alpha2/selinuxprofile_types.go
+++ b/api/selinuxprofile/v1alpha2/selinuxprofile_types.go
@@ -126,6 +126,6 @@ type SelinuxProfileList struct {
 	Items           []SelinuxProfile `json:"items"`
 }
 
-func init() { // nolint:gochecknoinits // required to init scheme
+func init() { //nolint:gochecknoinits // required to init scheme
 	SchemeBuilder.Register(&SelinuxProfile{}, &SelinuxProfileList{})
 }
diff --git a/api/spod/v1alpha1/spod_types.go b/api/spod/v1alpha1/spod_types.go
index afec1aad2..06fee0d9c 100644
--- a/api/spod/v1alpha1/spod_types.go
+++ b/api/spod/v1alpha1/spod_types.go
@@ -176,6 +176,6 @@ func (s *SPODStatus) StateRunning() {
 	s.ConditionedStatus.SetConditions(rcommonv1.Available())
 }
 
-func init() { // nolint:gochecknoinits // required to init the scheme
+func init() { //nolint:gochecknoinits // required to init the scheme
 	SchemeBuilder.Register(&SecurityProfilesOperatorDaemon{}, &SecurityProfilesOperatorDaemonList{})
 }
diff --git a/cmd/security-profiles-operator/main.go b/cmd/security-profiles-operator/main.go
index 096d94301..1984394bc 100644
--- a/cmd/security-profiles-operator/main.go
+++ b/cmd/security-profiles-operator/main.go
@@ -23,7 +23,7 @@ import (
 	"fmt"
 	"log"
 	"net/http"
-	_ "net/http/pprof" // nolint:gosec // required for profiling
+	_ "net/http/pprof" //nolint:gosec // required for profiling
 	"os"
 	"strings"
 	"time"
@@ -456,7 +456,7 @@ func runBPFRecorder(_ *cli.Context, info *version.Info) error {
 	return bpfrecorder.New(ctrl.Log.WithName(component)).Run()
 }
 
-func runLogEnricher(clictx *cli.Context, info *version.Info) error {
+func runLogEnricher(_ *cli.Context, info *version.Info) error {
 	const component = "log-enricher"
 	printInfo(component, info)
 
diff --git a/dependencies.yaml b/dependencies.yaml
index 07b821016..3c7da41bb 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -14,7 +14,7 @@ dependencies:
       match: GO_VERSION
 
   - name: golangci-lint
-    version: 1.46.2
+    version: 1.48.0
     refPaths:
     - path: Makefile
       match: GOLANGCI_LINT_VERSION
diff --git a/internal/pkg/daemon/apparmorprofile/apparmor_supported.go b/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
index c81f218e6..285ea1b02 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmor_supported.go
@@ -85,7 +85,7 @@ func loadProfile(logger logr.Logger, name, content string) (bool, error) {
 	err := mount.Do(func() error {
 		// TODO: force profile content's to align with profile's name
 		path := filepath.Join(targetProfileDir, name)
-		if err := os.WriteFile(path, []byte(content), 0o644); err != nil { // nolint // file permissions are fine
+		if err := os.WriteFile(path, []byte(content), 0o644); err != nil { //nolint // file permissions are fine
 			return err
 		}
 
diff --git a/internal/pkg/daemon/apparmorprofile/apparmorprofile.go b/internal/pkg/daemon/apparmorprofile/apparmorprofile.go
index 5fc1a9e0f..d64fe7406 100644
--- a/internal/pkg/daemon/apparmorprofile/apparmorprofile.go
+++ b/internal/pkg/daemon/apparmorprofile/apparmorprofile.go
@@ -96,7 +96,7 @@ func (r *Reconciler) Healthz(*http.Request) error {
 }
 
 // Security Profiles Operator RBAC permissions to manage AppArmorProfile
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=apparmorprofiles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=apparmorprofiles/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=apparmorprofiles/finalizers,verbs=delete;get;update;patch
diff --git a/internal/pkg/daemon/bpfrecorder/generate/main.go b/internal/pkg/daemon/bpfrecorder/generate/main.go
index 1c567578e..e1cf505e3 100644
--- a/internal/pkg/daemon/bpfrecorder/generate/main.go
+++ b/internal/pkg/daemon/bpfrecorder/generate/main.go
@@ -85,9 +85,9 @@ func run() error {
 		return fmt.Errorf("generate btf: %w", err)
 	}
 
-	// nolint:gosec // permissions are fine
+	//nolint:gosec // permissions are fine
 	if err := os.WriteFile(
-		// nolint:gomnd // filemode is fine
+		//nolint:gomnd // filemode is fine
 		generatedGo, []byte(builder.String()), 0o644,
 	); err != nil {
 		return fmt.Errorf("writing generated object: %w", err)
@@ -189,16 +189,17 @@ func generateBtf(builder *strings.Builder) error {
 			fmt.Fprintf(docs, "- %s\n", os)
 		}
 		if _, ok := btfs[os][osVersion]; !ok {
+			const indent = 2
 			btfs[os][osVersion] = map[types.Arch]map[types.Kernel][]byte{}
-			fmt.Fprintf(docs, "%s- %s\n", strings.Repeat(" ", 2), osVersion) // nolint:gomnd // indent
+			fmt.Fprintf(docs, "%s- %s\n", strings.Repeat(" ", indent), osVersion)
 		}
 		if _, ok := btfs[os][osVersion][arch]; !ok {
 			btfs[os][osVersion][arch] = map[types.Kernel][]byte{}
-			fmt.Fprintf(docs, "%s- %s\n", strings.Repeat(" ", 4), arch) // nolint:gomnd // indent
+			fmt.Fprintf(docs, "%s- %s\n", strings.Repeat(" ", 4), arch) //nolint:gomnd // indent
 		}
 
 		btfs[os][osVersion][arch][kernel] = btfBytes
-		fmt.Fprintf(docs, "%s- %s\n", strings.Repeat(" ", 6), kernel) // nolint:gomnd // indent
+		fmt.Fprintf(docs, "%s- %s\n", strings.Repeat(" ", 6), kernel) //nolint:gomnd // indent
 		kernels++
 
 		return nil
@@ -214,7 +215,7 @@ func generateBtf(builder *strings.Builder) error {
 
 	fmt.Fprintf(docs, "\nSum: %d\n", kernels)
 	if err := os.WriteFile(
-		docsFile, docs.Bytes(), fs.FileMode(0o644), // nolint:gomnd // filemode is fine
+		docsFile, docs.Bytes(), fs.FileMode(0o644), //nolint:gomnd // filemode is fine
 	); err != nil {
 		return fmt.Errorf("write docs file: %w", err)
 	}
diff --git a/internal/pkg/daemon/enricher/container.go b/internal/pkg/daemon/enricher/container.go
index 992320c47..8d4bb3097 100644
--- a/internal/pkg/daemon/enricher/container.go
+++ b/internal/pkg/daemon/enricher/container.go
@@ -56,7 +56,7 @@ func (e *Enricher) getContainerInfo(
 		return item.Value(), nil
 	}
 
-	if err := e.populateContainerPodCache(nodeName, targetContainerID); err != nil {
+	if err := e.populateContainerPodCache(nodeName); err != nil {
 		return nil, fmt.Errorf("get container info for pods: %w", err)
 	}
 
@@ -69,7 +69,7 @@ func (e *Enricher) getContainerInfo(
 }
 
 func (e *Enricher) populateContainerPodCache(
-	nodeName, targetContainerID string,
+	nodeName string,
 ) error {
 	containerRetryBackoff := wait.Backoff{
 		Duration: backoffDuration,
@@ -92,7 +92,7 @@ func (e *Enricher) populateContainerPodCache(
 
 			for p := range pods.Items {
 				pod := &pods.Items[p]
-				e.populateCacheEntryForContainer(ctx, targetContainerID, pod, eg)
+				e.populateCacheEntryForContainer(ctx, pod, eg)
 			}
 
 			if werr := eg.Wait(); werr != nil {
@@ -108,10 +108,10 @@ func (e *Enricher) populateContainerPodCache(
 }
 
 func (e *Enricher) populateCacheEntryForContainer(
-	_ context.Context, targetContainerID string, pod *v1.Pod, eg *errgroup.Group,
+	_ context.Context, pod *v1.Pod, eg *errgroup.Group,
 ) {
 	eg.Go(func() (errorToRetry error) {
-		// nolint:gocritic // This is what we expect and want
+		//nolint:gocritic // This is what we expect and want
 		statuses := append(pod.Status.InitContainerStatuses, pod.Status.ContainerStatuses...)
 
 		for c := range statuses {
diff --git a/internal/pkg/daemon/enricher/enricher.go b/internal/pkg/daemon/enricher/enricher.go
index 66c05c14d..84956d0ae 100644
--- a/internal/pkg/daemon/enricher/enricher.go
+++ b/internal/pkg/daemon/enricher/enricher.go
@@ -239,12 +239,7 @@ func (e *Enricher) Run() error {
 		}
 
 		// check if there's anything in the cache for this processID
-		err = e.dispatchBacklog(metricsClient, nodeName, info, auditLine.ProcessID)
-		if err != nil {
-			e.logger.Error(
-				err, "process backlog")
-			continue
-		}
+		e.dispatchBacklog(metricsClient, nodeName, info, auditLine.ProcessID)
 	}
 
 	return fmt.Errorf("enricher failed: %w", e.impl.Reason(tailFile))
@@ -336,13 +331,13 @@ func (e *Enricher) dispatchBacklog(
 	nodeName string,
 	info *types.ContainerInfo,
 	processID int,
-) error {
+) {
 	strPid := strconv.Itoa(processID)
 
 	auditBacklog := e.impl.GetFromBacklog(e.auditLineCache, strPid)
 	if auditBacklog == nil {
 		// nothing in the cache
-		return nil
+		return
 	}
 
 	for i := range auditBacklog {
@@ -355,7 +350,6 @@ func (e *Enricher) dispatchBacklog(
 	}
 
 	e.impl.FlushBacklog(e.auditLineCache, strPid)
-	return nil
 }
 
 func (e *Enricher) dispatchAuditLine(
diff --git a/internal/pkg/daemon/profilerecorder/profilerecorder.go b/internal/pkg/daemon/profilerecorder/profilerecorder.go
index 07ce65186..50480f36b 100644
--- a/internal/pkg/daemon/profilerecorder/profilerecorder.go
+++ b/internal/pkg/daemon/profilerecorder/profilerecorder.go
@@ -250,7 +250,7 @@ func (r *RecorderReconciler) Reconcile(_ context.Context, req reconcile.Request)
 
 		var profiles []profileToCollect
 		var recorder profilerecording1alpha1.ProfileRecorder
-		if len(hookProfiles) > 0 { // nolint:gocritic
+		if len(hookProfiles) > 0 { //nolint:gocritic
 			profiles = hookProfiles
 			recorder = profilerecording1alpha1.ProfileRecorderHook
 		} else if len(logProfiles) > 0 {
@@ -762,7 +762,7 @@ func parseLogAnnotations(annotations map[string]string) (res []profileToCollect,
 	for key, profile := range annotations {
 		var collectProfile profileToCollect
 
-		// nolint:gocritic
+		//nolint:gocritic
 		if strings.HasPrefix(key, config.SeccompProfileRecordLogsAnnotationKey) {
 			collectProfile.kind = profilerecording1alpha1.ProfileRecordingKindSeccompProfile
 		} else if strings.HasPrefix(key, config.SelinuxProfileRecordLogsAnnotationKey) {
diff --git a/internal/pkg/daemon/seccompprofile/seccompprofile.go b/internal/pkg/daemon/seccompprofile/seccompprofile.go
index d0a14b0b8..f439b9677 100644
--- a/internal/pkg/daemon/seccompprofile/seccompprofile.go
+++ b/internal/pkg/daemon/seccompprofile/seccompprofile.go
@@ -241,19 +241,19 @@ func (r *Reconciler) checkSeccomp() error {
 }
 
 // Security Profiles Operator RBAC permissions to manage SeccompProfile
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=seccompprofiles,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=seccompprofiles/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=seccompprofiles/finalizers,verbs=delete;get;update;patch
 
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=securityprofilenodestatuses,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=securityprofilesoperatordaemons,verbs=get;list;watch
 // +kubebuilder:rbac:groups=core,resources=nodes,verbs=get;list;watch
 // +kubebuilder:rbac:groups=core,resources=events,verbs=create;get;patch;update
 
 // OpenShift ... This is ignored in other distros
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security.openshift.io,namespace="security-profiles-operator",resources=securitycontextconstraints,verbs=use
 
 // Reconcile reconciles a SeccompProfile.
diff --git a/internal/pkg/daemon/selinuxprofile/common_controller.go b/internal/pkg/daemon/selinuxprofile/common_controller.go
index 133b5eaa7..13e94d157 100644
--- a/internal/pkg/daemon/selinuxprofile/common_controller.go
+++ b/internal/pkg/daemon/selinuxprofile/common_controller.go
@@ -136,12 +136,12 @@ func (r *ReconcileSelinux) Healthz(*http.Request) error {
 	return nil
 }
 
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles/finalizers,verbs=delete;get;update;patch
 
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=rawselinuxprofiles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=rawselinuxprofiles/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=rawselinuxprofiles/finalizers,verbs=delete;get;update;patch
@@ -453,7 +453,7 @@ func selinuxdGetRequest(url string) (*http.Response, error) {
 		},
 	}
 
-	req, err := http.NewRequestWithContext(ctx, "GET", url, http.NoBody)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, http.NoBody)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create a request to selinuxd: %w", err)
 	}
diff --git a/internal/pkg/daemon/selinuxprofile/rawselinuxprofile.go b/internal/pkg/daemon/selinuxprofile/rawselinuxprofile.go
index ce09f8a66..3c4ce0ef9 100644
--- a/internal/pkg/daemon/selinuxprofile/rawselinuxprofile.go
+++ b/internal/pkg/daemon/selinuxprofile/rawselinuxprofile.go
@@ -109,7 +109,7 @@ func newRawSelinuxProfileHandler(
 	key types.NamespacedName,
 ) (SelinuxObjectHandler, error) {
 	// Create template to wrap policies
-	// nolint:error // We ignore the error as the wrapper is static
+	//nolint:error // We ignore the error as the wrapper is static
 	tmpl, tmplerr := template.New("profileWrapper").Parse(profileWrapper)
 	if tmplerr != nil {
 		return nil, tmplerr
diff --git a/internal/pkg/manager/nodestatus/nodestatus.go b/internal/pkg/manager/nodestatus/nodestatus.go
index ff991badf..3c0e6d72e 100644
--- a/internal/pkg/manager/nodestatus/nodestatus.go
+++ b/internal/pkg/manager/nodestatus/nodestatus.go
@@ -82,7 +82,7 @@ func (r *StatusReconciler) Healthz(*http.Request) error {
 }
 
 // Security Profiles Operator RBAC permissions to manage SelinuxProfile
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles/finalizers,verbs=delete;get;update;patch
@@ -91,13 +91,13 @@ func (r *StatusReconciler) Healthz(*http.Request) error {
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=rawselinuxprofiles/finalizers,verbs=delete;get;update;patch
 
 // Security Profiles Operator RBAC permissions to manage SeccompProfile
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=seccompprofiles,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=seccompprofiles/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=seccompprofiles/finalizers,verbs=delete;get;update;patch
 
 // Security Profiles Operator RBAC permissions to manage Node Statuses
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=securityprofilenodestatuses,verbs=get;list;watch
 
 // Reconcile reconciles a NodeStatus.
diff --git a/internal/pkg/manager/spod/bindata/spod.go b/internal/pkg/manager/spod/bindata/spod.go
index 614894197..50b267f4f 100644
--- a/internal/pkg/manager/spod/bindata/spod.go
+++ b/internal/pkg/manager/spod/bindata/spod.go
@@ -345,8 +345,8 @@ semodule -i /opt/spo-profiles/selinuxrecording.cil
 								Port:   intstr.FromString("liveness-port"),
 								Scheme: corev1.URISchemeHTTP,
 							}},
-							FailureThreshold: 10, // nolint:gomnd // test number
-							PeriodSeconds:    3,  // nolint:gomnd // test number
+							FailureThreshold: 10, //nolint:gomnd // test number
+							PeriodSeconds:    3,  //nolint:gomnd // test number
 							TimeoutSeconds:   1,
 							SuccessThreshold: 1,
 						},
@@ -357,7 +357,7 @@ semodule -i /opt/spo-profiles/selinuxrecording.cil
 								Scheme: corev1.URISchemeHTTP,
 							}},
 							FailureThreshold: 1,
-							PeriodSeconds:    10, // nolint:gomnd // test number
+							PeriodSeconds:    10, //nolint:gomnd // test number
 							TimeoutSeconds:   1,
 							SuccessThreshold: 1,
 						},
diff --git a/internal/pkg/manager/spod/spod_controller.go b/internal/pkg/manager/spod/spod_controller.go
index 629b4337f..796cf3a07 100644
--- a/internal/pkg/manager/spod/spod_controller.go
+++ b/internal/pkg/manager/spod/spod_controller.go
@@ -84,7 +84,7 @@ func (r *ReconcileSPOd) Healthz(*http.Request) error {
 }
 
 // Security Profiles Operator RBAC permissions to manage its own configuration
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 //
 // Used for event generation:
 // +kubebuilder:rbac:groups=core,resources=events,verbs=create
@@ -336,7 +336,7 @@ func (r *ReconcileSPOd) handleCreate(
 	if err := r.client.Create(
 		ctx, bindata.ServiceMonitor(),
 	); err != nil {
-		// nolint:gocritic
+		//nolint:gocritic
 		if runtime.IsNotRegisteredError(err) || meta.IsNoMatchError(err) {
 			r.log.Info("Service monitor resource does not seem to exist, ignoring")
 		} else if errors.IsAlreadyExists(err) {
diff --git a/internal/pkg/util/names.go b/internal/pkg/util/names.go
index 966edffbf..739011d4c 100644
--- a/internal/pkg/util/names.go
+++ b/internal/pkg/util/names.go
@@ -72,7 +72,7 @@ func lengthName(maxLen int, hashPrefix, format string, a ...interface{}) (string
 func dnsLengthName(hashPrefix, format string, a ...interface{}) string {
 	const maxDNSLen = 63
 
-	// nolint:errcheck // (jhrozek): I think it makes sense to make the utility
+	//nolint:errcheck // (jhrozek): I think it makes sense to make the utility
 	// 					  function return error, but here I think it's OK to
 	// 					  just ignore
 	name, _ := lengthName(maxDNSLen, hashPrefix, format, a...)
diff --git a/internal/pkg/version/version.go b/internal/pkg/version/version.go
index ead862780..847f6e999 100644
--- a/internal/pkg/version/version.go
+++ b/internal/pkg/version/version.go
@@ -126,7 +126,7 @@ func (i *Info) String() string {
 		value := v.FieldByName(field.Name)
 
 		valueString := ""
-		// nolint:exhaustive // we ignore missing switch cases on purpose
+		//nolint:exhaustive // we ignore missing switch cases on purpose
 		switch field.Type.Kind() {
 		case reflect.Bool:
 			valueString = fmt.Sprint(value.Bool())
diff --git a/internal/pkg/webhooks/binding/binding.go b/internal/pkg/webhooks/binding/binding.go
index ffda090a2..761a0e7ed 100644
--- a/internal/pkg/webhooks/binding/binding.go
+++ b/internal/pkg/webhooks/binding/binding.go
@@ -88,23 +88,23 @@ func initContainerMap(m *sync.Map, spec *corev1.PodSpec) {
 }
 
 // Security Profiles Operator Webhook RBAC permissions
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=profilebindings,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=profilebindings/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=profilebindings/finalizers,verbs=delete;get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=seccompprofiles,verbs=get;list;watch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=selinuxprofiles,verbs=get;list;watch
 
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=core,resources=events,verbs=create
 // +kubebuilder:rbac:groups=coordination.k8s.io,namespace=security-profiles-operator,resources=leases,verbs=create
 // +kubebuilder:rbac:groups=coordination.k8s.io,namespace=security-profiles-operator,resourceNames=security-profiles-operator-webhook-lock,resources=leases,verbs=get;patch;update
 
 // OpenShift (This is ignored in other distros):
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // +kubebuilder:rbac:groups=security.openshift.io,namespace=security-profiles-operator,resources=securitycontextconstraints,verbs=use
 
-// nolint:gocritic
+//nolint:gocritic
 func (p *podBinder) Handle(ctx context.Context, req admission.Request) admission.Response {
 	profileBindings, err := p.ListProfileBindings(ctx, client.InNamespace(req.Namespace))
 	if err != nil {
@@ -206,7 +206,7 @@ func (p *podBinder) getSeccompProfile(
 		}, func(inErr error) bool {
 			return errors.Is(inErr, ErrProfWithoutStatus) || kerrors.IsNotFound(inErr)
 		})
-	// nolint:wrapcheck // already wrapped
+	//nolint:wrapcheck // already wrapped
 	return seccompProfile, err
 }
 
@@ -227,7 +227,7 @@ func (p *podBinder) getSelinuxProfile(
 		}, func(inErr error) bool {
 			return errors.Is(inErr, ErrProfWithoutStatus) || kerrors.IsNotFound(inErr)
 		})
-	// nolint:wrapcheck // error is already wrapped
+	//nolint:wrapcheck // error is already wrapped
 	return selinuxProfile, err
 }
 
diff --git a/internal/pkg/webhooks/binding/impl.go b/internal/pkg/webhooks/binding/impl.go
index 83e637fdf..fabd48c9a 100644
--- a/internal/pkg/webhooks/binding/impl.go
+++ b/internal/pkg/webhooks/binding/impl.go
@@ -81,7 +81,7 @@ func (d *defaultImpl) SetDecoder(decoder *admission.Decoder) {
 	d.decoder = decoder
 }
 
-// nolint:gocritic
+//nolint:gocritic
 func (d *defaultImpl) DecodePod(req admission.Request) (*corev1.Pod, error) {
 	pod := &corev1.Pod{}
 	if err := d.decoder.Decode(req, pod); err != nil {
diff --git a/internal/pkg/webhooks/recording/impl.go b/internal/pkg/webhooks/recording/impl.go
index b6e5ce57d..bec30de22 100644
--- a/internal/pkg/webhooks/recording/impl.go
+++ b/internal/pkg/webhooks/recording/impl.go
@@ -75,7 +75,7 @@ func (d *defaultImpl) GetOperatorNamespace() string {
 	return config.GetOperatorNamespace()
 }
 
-// nolint:gocritic
+//nolint:gocritic
 func (d *defaultImpl) DecodePod(req admission.Request) (*corev1.Pod, error) {
 	pod := &corev1.Pod{}
 	if err := d.decoder.Decode(req, pod); err != nil {
diff --git a/internal/pkg/webhooks/recording/recording.go b/internal/pkg/webhooks/recording/recording.go
index 53733c9f9..2755678b5 100644
--- a/internal/pkg/webhooks/recording/recording.go
+++ b/internal/pkg/webhooks/recording/recording.go
@@ -61,13 +61,13 @@ func RegisterWebhook(server *webhook.Server, c client.Client) {
 	)
 }
 
-// nolint:lll // required for kubebuilder
+//nolint:lll // required for kubebuilder
 // Security Profiles Operator Webhook RBAC permissions
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=profilerecordings,verbs=get;list;watch;create;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=profilerecordings/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=security-profiles-operator.x-k8s.io,resources=profilerecordings/finalizers,verbs=delete;get;update;patch
 
-// nolint:gocritic
+//nolint:gocritic
 func (p *podSeccompRecorder) Handle(
 	ctx context.Context,
 	req admission.Request,


Test patch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0b2e996b0..e84092c14 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -74,7 +74,7 @@ jobs:
       RUN: ./hack/ci/run-fedora.sh
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - uses: actions/cache@a7c34adf76222e77931dedbf4a45b2e4648ced19
+      - uses: actions/cache@fd5de65bc895cf536527842281bea11763fefd77
         with:
           path: |
             ~/.vagrant.d/boxes
@@ -112,7 +112,7 @@ jobs:
       RUN: ./hack/ci/run-ubuntu.sh
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
-      - uses: actions/cache@a7c34adf76222e77931dedbf4a45b2e4648ced19
+      - uses: actions/cache@fd5de65bc895cf536527842281bea11763fefd77
         with:
           path: |
             ~/.vagrant.d/boxes
@@ -153,7 +153,7 @@ jobs:
         run: |
           echo "::set-output name=version::$(curl -s  https://stable.release.flatcar-linux.net/amd64-usr/current/flatcar_production_vagrant.json | jq '.versions[0].version' | tr -d '".')"
         shell: bash
-      - uses: actions/cache@a7c34adf76222e77931dedbf4a45b2e4648ced19
+      - uses: actions/cache@fd5de65bc895cf536527842281bea11763fefd77
         with:
           path: |
             ~/.vagrant.d/boxes
diff --git a/internal/pkg/daemon/enricher/audit_test.go b/internal/pkg/daemon/enricher/audit_test.go
index c466f145d..7097dde92 100644
--- a/internal/pkg/daemon/enricher/audit_test.go
+++ b/internal/pkg/daemon/enricher/audit_test.go
@@ -33,25 +33,25 @@ func Test_isAuditLine(t *testing.T) {
 	}{
 		{
 			"Should identify type=1326 log lines",
-			// nolint:lll // no need to wrap
+			//nolint:lll // no need to wrap
 			`audit: type=1326 audit(1611996299.149:466250): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=615549 comm="sh" exe="/bin/busybox" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f61a81c5923 code=0x7ffc0000`,
 			true,
 		},
 		{
 			"Should identify type=1326 lines with timestamp",
-			// nolint:lll // no need to wrap
+			//nolint:lll // no need to wrap
 			`Jul  8 10:31:23 ubuntu2004 kernel: [  270.853767] audit: type=1326 audit(1625740283.502:574): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=4709 comm="sh" exe="/bin/busybox" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f3c012e467b code=0x7ffc0000`,
 			true,
 		},
 		{
 			"Should identify type=SECCOMP log lines",
-			// nolint:lll // no need to wrap
+			//nolint:lll // no need to wrap
 			`type=SECCOMP msg=audit(1613596317.899:6461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:spc_t:s0:c284,c594 pid=2039886 comm="ls" exe="/bin/ls" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f62dce3d4c7 code=0x7ffc0000AUID="unset" UID="root" GID="root" ARCH=x86_64 SYSCALL=close`,
 			true,
 		},
 		{
 			"Should ignore unsupported log types",
-			// nolint:lll // no need to wrap
+			//nolint:lll // no need to wrap
 			`audit: type=1016 audit(1611996299.149:466250): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=615549 comm="sh" exe="/bin/busybox" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f61a81c5923 code=0x7ffc0000`,
 			false,
 		},
@@ -62,7 +62,7 @@ func Test_isAuditLine(t *testing.T) {
 		},
 		{
 			"Should identify SELinux log lines",
-			// nolint:lll // no need to wrap
+			//nolint:lll // no need to wrap
 			`type=AVC msg=audit(1613173578.156:2945): avc:  denied  { read } for  pid=75593 comm="security-profil" name="token" dev="tmpfs" ino=612459 scontext=system_u:system_r:container_t:s0:c4,c808 tcontext=system_u:object_r:var_lib_t:s0 tclass=lnk_file permissive=0`,
 			true,
 		},
@@ -87,7 +87,7 @@ func Test_extractAuditLine(t *testing.T) {
 	}{
 		{
 			"Should extract seccomp log lines",
-			// nolint:lll // no need to wrap
+			//nolint:lll // no need to wrap
 			`audit: type=1326 audit(1612299677.115:549067): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=3109464 comm="sh" exe="/bin/busybox" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7fce771ae923 code=0x7ffc0000`,
 			&types.AuditLine{
 				AuditType:    "seccomp",
@@ -100,7 +100,7 @@ func Test_extractAuditLine(t *testing.T) {
 		},
 		{
 			"Should extract seccomp log lines",
-			// nolint:lll // no need to wrap
+			//nolint:lll // no need to wrap
 			`type=SECCOMP msg=audit(1613596317.899:6461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:spc_t:s0:c284,c594 pid=2039886 comm="ls" exe="/bin/ls" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f62dce3d4c7 code=0x7ffc0000AUID="unset" UID="root" GID="root" ARCH=x86_64 SYSCALL=close`,
 			&types.AuditLine{
 				AuditType:    "seccomp",
@@ -113,7 +113,7 @@ func Test_extractAuditLine(t *testing.T) {
 		},
 		{
 			"Should extract selinux log lines",
-			// nolint:lll // no need to wrap
+			//nolint:lll // no need to wrap
 			`type=AVC msg=audit(1613173578.156:2945): avc:  denied  { read } for  pid=75593 comm="security-profil" name="token" dev="tmpfs" ino=612459 scontext=system_u:system_r:container_t:s0:c4,c808 tcontext=system_u:object_r:var_lib_t:s0 tclass=lnk_file permissive=0`,
 			&types.AuditLine{
 				AuditType:    "selinux",
diff --git a/internal/pkg/daemon/profilerecorder/profilerecorder_test.go b/internal/pkg/daemon/profilerecorder/profilerecorder_test.go
index 297c34613..44a49982f 100644
--- a/internal/pkg/daemon/profilerecorder/profilerecorder_test.go
+++ b/internal/pkg/daemon/profilerecorder/profilerecorder_test.go
@@ -249,7 +249,7 @@ func TestReconcile(t *testing.T) {
 				assert.Nil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// BPF GoArchToSeccompArch fails
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
@@ -288,7 +288,7 @@ func TestReconcile(t *testing.T) {
 				assert.NotNil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// BPF CreateOrUpdate fails
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
@@ -327,7 +327,7 @@ func TestReconcile(t *testing.T) {
 				assert.NotNil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// BPF DialBpfRecorder fails
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
@@ -468,7 +468,7 @@ func TestReconcile(t *testing.T) {
 				assert.Nil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// BPF SyscallsForProfile fails
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
@@ -702,7 +702,7 @@ func TestReconcile(t *testing.T) {
 				emptySyncMap(&sut.podsToWatch)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// log seccomp success record
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				mock.GetPodReturns(&corev1.Pod{
@@ -729,7 +729,7 @@ func TestReconcile(t *testing.T) {
 				assert.Nil(t, retryErr)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// log seccomp success record
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				mock.GetPodReturns(&corev1.Pod{
@@ -983,7 +983,7 @@ func TestReconcile(t *testing.T) {
 				assert.NotNil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// logs seccomp failed CreateOrUpdate
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
@@ -1019,7 +1019,7 @@ func TestReconcile(t *testing.T) {
 				assert.NotNil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// logs seccomp failed GoArchToSeccompArch
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
@@ -1055,7 +1055,7 @@ func TestReconcile(t *testing.T) {
 				assert.NotNil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// logs seccomp failed Syscalls
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
@@ -1151,7 +1151,7 @@ func TestReconcile(t *testing.T) {
 				assert.NotNil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// logs seccomp DialEnricher fails
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
@@ -1390,7 +1390,7 @@ func TestReconcile(t *testing.T) {
 				assert.NotNil(t, err)
 			},
 		},
-		{ // nolint:dupl // test duplicates are fine
+		{ //nolint:dupl // test duplicates are fine
 			// logs selinux failed Avcs
 			prepare: func(sut *RecorderReconciler, mock *profilerecorderfakes.FakeImpl) {
 				profileName := fmt.Sprintf("profile-%d", time.Now().Unix())
diff --git a/internal/pkg/daemon/selinuxprofile/selinuxprofile_test.go b/internal/pkg/daemon/selinuxprofile/selinuxprofile_test.go
index a495a2965..7e94a83f0 100644
--- a/internal/pkg/daemon/selinuxprofile/selinuxprofile_test.go
+++ b/internal/pkg/daemon/selinuxprofile/selinuxprofile_test.go
@@ -33,11 +33,11 @@ import (
 	"sigs.k8s.io/security-profiles-operator/internal/pkg/manager/spod/bindata"
 )
 
-// nolint:gocognit // complexity is fine for a test
+//nolint:gocognit // complexity is fine for a test
 func Test_selinuxProfileHandler(t *testing.T) {
 	t.Parallel()
 	ns := "security-profiles-operator"
-	// nolint:tenv // we want to set the env here
+	//nolint:tenv // we want to set the env here
 	os.Setenv("OPERATOR_NAMESPACE", ns)
 	schemeInstance := scheme.Scheme
 	if err := spodv1alpha1.AddToScheme(schemeInstance); err != nil {
diff --git a/internal/pkg/manager/spod/setup_test.go b/internal/pkg/manager/spod/setup_test.go
index 06b76e66b..07ef903a2 100644
--- a/internal/pkg/manager/spod/setup_test.go
+++ b/internal/pkg/manager/spod/setup_test.go
@@ -57,6 +57,7 @@ func Test_getEffectiveSPOd(t *testing.T) {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
+			//nolint:tenv // cannot use tenv after t.Parallel()
 			os.Setenv("OPERATOR_NAMESPACE", "default")
 			got := getEffectiveSPOd(&tt.dt)
 			require.Equal(t, tt.dt.selinuxdImage, got.Spec.Template.Spec.Containers[1].Image)
diff --git a/internal/pkg/webhooks/binding/binding_test.go b/internal/pkg/webhooks/binding/binding_test.go
index b28d37c68..e50cb29bf 100644
--- a/internal/pkg/webhooks/binding/binding_test.go
+++ b/internal/pkg/webhooks/binding/binding_test.go
@@ -270,7 +270,7 @@ func TestHandle(t *testing.T) {
 				require.Equal(t, http.StatusInternalServerError, int(resp.Result.Code))
 			},
 		},
-		// nolint:dupl // test duplicates are fine
+		//nolint:dupl // test duplicates are fine
 		{ // failure on UpdateResource
 			prepare: func(mock *bindingfakes.FakeImpl) {
 				mock.ListProfileBindingsReturns(&v1alpha1.ProfileBindingList{
@@ -309,7 +309,7 @@ func TestHandle(t *testing.T) {
 				require.Equal(t, http.StatusInternalServerError, int(resp.Result.Code))
 			},
 		},
-		// nolint:dupl // test duplicates are fine
+		//nolint:dupl // test duplicates are fine
 		{ // failure on UpdateResourceStatus
 			prepare: func(mock *bindingfakes.FakeImpl) {
 				mock.ListProfileBindingsReturns(&v1alpha1.ProfileBindingList{
diff --git a/test/suite_test.go b/test/suite_test.go
index 20f65ab1e..f051cf48d 100644
--- a/test/suite_test.go
+++ b/test/suite_test.go
@@ -41,8 +41,8 @@ import (
 const (
 	kindVersion      = "v0.14.0"
 	kindImage        = "kindest/node:v1.23.4@sha256:0e34f0d0fd448aa2f2819cfd74e99fe5793a6e4938b328f657c8e3f81ee0dfb9"
-	kindDarwinSHA512 = "d85adec9a4ebdee086a5971b540970e0be01ebf5304092d006fdc226d7cc1b0f4d26abc8384ffcd4277f1580d0b98ef7e2e1c2e4ccae351cfae3722578412a44" // nolint:lll // full length SHA
-	kindLinuxSHA512  = "068ad6bc6506f8b90e38e0e8288a5d8cd83eac6b5bcb7ba972256241a64f9d335dcd2a70e8a08eab129816b0cf3bc722988601da603638d4a4933ded5ee6d763" // nolint:lll // full length SHA
+	kindDarwinSHA512 = "d85adec9a4ebdee086a5971b540970e0be01ebf5304092d006fdc226d7cc1b0f4d26abc8384ffcd4277f1580d0b98ef7e2e1c2e4ccae351cfae3722578412a44" //nolint:lll // full length SHA
+	kindLinuxSHA512  = "068ad6bc6506f8b90e38e0e8288a5d8cd83eac6b5bcb7ba972256241a64f9d335dcd2a70e8a08eab129816b0cf3bc722988601da603638d4a4933ded5ee6d763" //nolint:lll // full length SHA
 )
 
 var (
@@ -127,7 +127,7 @@ type vanilla struct {
 // We're unable to use parallel tests because of our usage of testify/suite.
 // See https://github.com/stretchr/testify/issues/187
 //
-// nolint:paralleltest // should not run in parallel
+//nolint:paralleltest // should not run in parallel
 func TestSuite(t *testing.T) {
 	fmt.Printf("cluster-type: %s\n", clusterType)
 	fmt.Printf("container-runtime: %s\n", containerRuntime)
@@ -305,7 +305,7 @@ func (e *kinde2e) SetupTest() {
 	e.logf("Deploying the cluster")
 	e.clusterName = fmt.Sprintf("spo-e2e-%d", time.Now().Unix())
 
-	cmd := exec.Command( // nolint:gosec // fine in tests
+	cmd := exec.Command( //nolint:gosec // fine in tests
 		e.kindPath, "create", "cluster",
 		"--name="+e.clusterName,
 		"--image="+kindImage,
@@ -525,7 +525,7 @@ func (e *e2e) setWorkDir() string {
 // wait for the file to be removed by the test user.
 //
 // (jhrozek): Maybe we should set a global timeout to continue?
-func (e *e2e) breakPoint() { // nolint:unused // used on demand
+func (e *e2e) breakPoint() { //nolint:unused // used on demand
 	tmpfile, err := os.CreateTemp("", "testBreakpoint*.lock")
 	if err != nil {
 		e.logger.Error(err, "Can't create breakpoint file")
@@ -629,7 +629,7 @@ func (e *e2e) getSpodMetrics() string {
 	letters := []rune("abcdefghijklmnopqrstuvwxyz")
 	b := make([]rune, 10)
 	for i := range b {
-		b[i] = letters[rand.Intn(len(letters))] // nolint:gosec // fine in tests
+		b[i] = letters[rand.Intn(len(letters))] //nolint:gosec // fine in tests
 	}
 	// Sometimes the metrics command does not output anything in CI. We fix
 	// that by retrying the metrics retrieval several times.
diff --git a/test/tc_delete_profiles_test.go b/test/tc_delete_profiles_test.go
index 027eb4195..06408b56e 100644
--- a/test/tc_delete_profiles_test.go
+++ b/test/tc_delete_profiles_test.go
@@ -144,10 +144,10 @@ spec:
 	} {
 		e.logf("> > Running test case for deleted profiles and pods: %s", testCase.description)
 		profileCleanup := e.writeAndCreate(deleteProfile, "delete-profile*.yaml")
-		defer profileCleanup() // nolint:gocritic // TODO: is this intentional?
+		defer profileCleanup() //nolint:gocritic // TODO: is this intentional?
 		e.waitFor("condition=ready", "seccompprofile", deleteProfileName)
 		podCleanup := e.writeAndCreate(fmt.Sprintf(testCase.podManifest, namespace), "delete-pod*.yaml")
-		defer podCleanup() // nolint:gocritic // TODO: is this intention?
+		defer podCleanup() //nolint:gocritic // TODO: is this intention?
 		e.waitFor("condition=ready", "pod", deletePodName)
 		e.logf("Ensuring profile cannot be deleted while pod is active")
 		e.kubectl("delete", "seccompprofile", deleteProfileName, "--wait=0")
diff --git a/test/tc_selinux_base_usage_test.go b/test/tc_selinux_base_usage_test.go
index 5a17560a2..22c08197e 100644
--- a/test/tc_selinux_base_usage_test.go
+++ b/test/tc_selinux_base_usage_test.go
@@ -61,7 +61,7 @@ spec:
         - open
 `
 
-	// nolint:lll // full yaml
+	//nolint:lll // full yaml
 	podWithPolicyFmt = `
 apiVersion: v1
 kind: Pod
diff --git a/test/tc_webhook_config_test.go b/test/tc_webhook_config_test.go
index 35a34770b..5aeba2123 100644
--- a/test/tc_webhook_config_test.go
+++ b/test/tc_webhook_config_test.go
@@ -35,7 +35,7 @@ func (e *e2e) testCaseWebhookOptionsChange([]string) {
 		"spo-mutating-webhook-configuration",
 		"--output", "jsonpath={.webhooks[1].namespaceSelector}")
 
-	whPatch := fmt.Sprintf(`{"spec":{"webhookOptions":[{"name":"binding.spo.io","failurePolicy":"Ignore","namespaceSelector":%s}]}}`, whNamespaceSelector) // nolint:lll // very long patch line
+	whPatch := fmt.Sprintf(`{"spec":{"webhookOptions":[{"name":"binding.spo.io","failurePolicy":"Ignore","namespaceSelector":%s}]}}`, whNamespaceSelector) //nolint:lll // very long patch line
 	e.logf(whPatch)
 	e.kubectlOperatorNS("patch", "spod", "spod", "-p", whPatch, "--type=merge")
 	time.Sleep(defaultWaitTime)