Enable 'copyloopvar' linter

.golangci.yaml

@@ -45,6 +45,7 @@ linters:
     - sqlclosecheck
     - unconvert
     - whitespace
+    - copyloopvar
 
 issues:
   exclude-rules:

cmd/pinniped-concierge-kube-cert-agent/main_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package main
@@ -90,7 +90,6 @@ func TestEntrypoint(t *testing.T) {
 			}`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var logBuf bytes.Buffer
 			testLog := log.New(&logBuf, "", 0)

cmd/pinniped-server/main_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package main
@@ -38,7 +38,6 @@ func TestEntrypoint(t *testing.T) {
 			wantArgs: []string{"/path/to/valid-test-binary", "foo", "bar"},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var logBuf bytes.Buffer
 			testLog := log.New(&logBuf, "", 0)

cmd/pinniped/cmd/kubeconfig_test.go

@@ -3197,7 +3197,6 @@ func TestGetKubeconfig(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var issuerEndpointPtr *string
 			testServer, testServerCA := tlsserver.TestServerIPv4(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

cmd/pinniped/cmd/login_oidc_test.go

@@ -539,7 +539,6 @@ func TestLoginOIDCCommand(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var buf bytes.Buffer
 			ctx := plog.AddZapOverridesToContext(context.Background(), t, &buf, nil, clocktesting.NewFakeClock(now))

cmd/pinniped/cmd/login_static_test.go

@@ -175,7 +175,6 @@ func TestLoginStaticCommand(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			var buf bytes.Buffer
 			ctx := plog.AddZapOverridesToContext(context.Background(), t, &buf, nil, clocktesting.NewFakeClock(now))

cmd/pinniped/cmd/version_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
@@ -126,7 +126,6 @@ func TestNewVersionCmd(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			if tt.getBuildInfo != nil {
 				getBuildInfo = tt.getBuildInfo

cmd/pinniped/cmd/whoami_test.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package cmd
@@ -107,8 +107,7 @@ func TestWhoami(t *testing.T) {
 				Current user info:
 
 				Username: some-username
-				Groups: 
-			`),
+				Groups:` + " \n"), // Linters and codeformatters don't like the extra space after "Groups:" and before the newline
 		},
 		{
 			name: "json output",
@@ -280,7 +279,6 @@ func TestWhoami(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			getClientset := func(clientConfig clientcmd.ClientConfig, apiGroupSuffix string) (conciergeclientset.Interface, error) {
 				if test.gettingClientsetErr != nil {

internal/admissionpluginconfig/admissionpluginconfig_test.go

@@ -163,7 +163,6 @@ func TestConfigureAdmissionPlugins(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/backoff/infinitebackoff_test.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package backoff
@@ -77,7 +77,6 @@ func TestInfiniteBackoff(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			require.NotEmpty(t, tt.expectedSequence)
 			for i, expected := range tt.expectedSequence {

internal/backoff/stepping_test.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package backoff
@@ -81,7 +81,6 @@ func TestWithContext(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			testContext, cancel := context.WithCancel(context.Background())
 			backoff := &MockStepper{

internal/celtransformer/celformer_test.go

@@ -780,7 +780,6 @@ func TestTransformer(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/certauthority/certauthority_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package certauthority
@@ -74,7 +74,6 @@ func TestLoad(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -162,7 +161,6 @@ func TestNewInternal(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := newInternal("Test CA", tt.ttl, tt.env)
 			if tt.wantErr != "" {
@@ -316,7 +314,6 @@ func TestIssue(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := tt.ca.IssueServerCert([]string{"example.com"}, []net.IP{net.IPv4(1, 2, 3, 4)}, 10*time.Minute)
 			if tt.wantErr != "" {

internal/certauthority/dynamiccertauthority/dynamiccertauthority_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package dynamiccertauthority
@@ -89,7 +89,6 @@ func TestCAIssuePEM(t *testing.T) {
 		},
 	}
 	for _, step := range steps {
-		step := step
 		t.Run(step.name, func(t *testing.T) {
 			// Can't run these steps in parallel, because each one depends on the previous steps being
 			// run.

internal/concierge/impersonator/impersonator_test.go

@@ -667,7 +667,6 @@ func TestImpersonator(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1796,7 +1795,6 @@ func TestImpersonatorHTTPHandler(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -2061,7 +2059,6 @@ func Test_withBearerTokenPreservation(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/concierge/impersonator/roundtripper_test.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package impersonator
@@ -72,7 +72,6 @@ func TestRoundTrip(t *testing.T) {
 			wantError: "no impersonator service account token available",
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			base := &fakeRoundTripper{
 				response: new(http.Response),

internal/concierge/scheme/scheme_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package scheme
@@ -188,7 +188,6 @@ func TestNew(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scheme, loginGV, identityGV := New(tt.apiGroupSuffix)
 			require.Equal(t, tt.want, scheme.AllKnownTypes())

internal/concierge/server/server_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package server
@@ -67,7 +67,6 @@ func TestCommand(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			stdout := bytes.NewBuffer([]byte{})
 			stderr := bytes.NewBuffer([]byte{})

internal/config/concierge/config_test.go

@@ -589,7 +589,6 @@ func TestFromPath(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			// this is a serial test because it sets the global logger
 

internal/config/supervisor/config_test.go

@@ -253,7 +253,6 @@ func TestFromPath(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			// this is a serial test because it sets the global logger
 

internal/controller/apicerts/certs_expirer_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package apicerts
@@ -88,7 +88,6 @@ func TestExpirerControllerFilters(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name+"-"+test.namespace, func(t *testing.T) {
 			t.Parallel()
 
@@ -110,10 +109,10 @@ func TestExpirerControllerFilters(t *testing.T) {
 
 			unrelated := corev1.Secret{}
 			filter := withInformer.GetFilterForInformer(secretsInformer)
-			require.Equal(t, test.want, filter.Add(&test.secret))
-			require.Equal(t, test.want, filter.Update(&unrelated, &test.secret))
-			require.Equal(t, test.want, filter.Update(&test.secret, &unrelated))
-			require.Equal(t, test.want, filter.Delete(&test.secret))
+			require.Equal(t, test.want, filter.Add(test.secret.DeepCopy()))
+			require.Equal(t, test.want, filter.Update(&unrelated, test.secret.DeepCopy()))
+			require.Equal(t, test.want, filter.Update(test.secret.DeepCopy(), &unrelated))
+			require.Equal(t, test.want, filter.Delete(test.secret.DeepCopy()))
 		})
 	}
 }
@@ -219,7 +218,6 @@ func TestExpirerControllerSync(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 

internal/controller/apicerts/update_api_service_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package apicerts
@@ -203,7 +203,6 @@ func TestUpdateAPIService(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := context.Background()
 

internal/controller/authenticator/cachecleaner/cachecleaner_test.go

@@ -133,7 +133,6 @@ func TestController(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			// When we have t.Parallel() here, this test blocks pretty consistently...y tho?
 

internal/controller/authenticator/jwtcachefiller/jwtcachefiller_test.go

@@ -1663,7 +1663,6 @@ func TestController(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1781,7 +1780,6 @@ func TestController(t *testing.T) {
 				tt.wantGroupsClaim,
 				goodIssuer,
 			) {
-				test := test
 				t.Run(test.name, func(t *testing.T) {
 					t.Parallel()
 

internal/controller/authenticator/webhookcachefiller/webhookcachefiller_test.go

@@ -1306,7 +1306,6 @@ func TestController(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1465,7 +1464,6 @@ func TestNewWebhookAuthenticator(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			var conditions []*metav1.Condition

internal/controller/issuerconfig/issuerconfig_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package issuerconfig
@@ -213,11 +213,10 @@ func TestMergeStrategy(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			updated := tt.configToUpdate.DeepCopy()
 			mergeStrategy(updated, tt.strategy)
-			require.Equal(t, &tt.expected, updated)
+			require.Equal(t, tt.expected.DeepCopy(), updated)
 		})
 	}
 }

internal/controller/kubecertagent/kubecertagent.go

@@ -626,7 +626,6 @@ func pluralize(pods []*corev1.Pod) string {
 
 func firstErr(errs ...error) error {
 	for _, err := range errs {
-		err := err
 		if err != nil {
 			return err
 		}

internal/controller/kubecertagent/kubecertagent_test.go

@@ -1018,7 +1018,6 @@ func TestAgentController(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1177,15 +1176,14 @@ func TestMergeLabelsAndAnnotations(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			existingCopy := tt.existing.DeepCopy()
 			desiredCopy := tt.desired.DeepCopy()
 			got := mergeLabelsAndAnnotations(tt.existing, tt.desired)
 			require.Equal(t, tt.expected, got)
-			require.Equal(t, existingCopy, &tt.existing, "input was modified!")
-			require.Equal(t, desiredCopy, &tt.desired, "input was modified!")
+			require.Equal(t, existingCopy, tt.existing.DeepCopy(), "input was modified!")
+			require.Equal(t, desiredCopy, tt.desired.DeepCopy(), "input was modified!")
 		})
 	}
 }

internal/controller/kubecertagent/legacypodcleaner_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package kubecertagent
@@ -139,7 +139,6 @@ func TestLegacyPodCleanerController(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/controller/serviceaccounttokencleanup/legacy_service_account_token_cleanup_controller_test.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package serviceaccounttokencleanup
@@ -130,7 +130,6 @@ func TestSync(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/controller/supervisorconfig/activedirectoryupstreamwatcher/active_directory_upstream_watcher_test.go

@@ -71,7 +71,6 @@ func TestActiveDirectoryUpstreamWatcherControllerFilterSecrets(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -116,7 +115,6 @@ func TestActiveDirectoryUpstreamWatcherControllerFilterActiveDirectoryIdentityPr
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -2002,7 +2000,6 @@ func TestActiveDirectoryUpstreamWatcherControllerSync(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/controller/supervisorconfig/federation_domain_watcher_test.go

@@ -85,7 +85,6 @@ func TestFederationDomainWatcherControllerInformerFilters(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1999,7 +1998,6 @@ func TestTestFederationDomainWatcherControllerSync(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/controller/supervisorconfig/generator/federation_domain_secrets_test.go

@@ -168,7 +168,6 @@ func TestFederationDomainControllerFilterSecret(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -231,7 +230,6 @@ func TestNewFederationDomainSecretsControllerFilterFederationDomain(t *testing.T
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -264,11 +262,11 @@ func TestNewFederationDomainSecretsControllerFilterFederationDomain(t *testing.T
 
 			unrelated := configv1alpha1.FederationDomain{}
 			filter := withInformer.GetFilterForInformer(federationDomainInformer)
-			require.Equal(t, test.wantAdd, filter.Add(&test.federationDomain))
-			require.Equal(t, test.wantUpdate, filter.Update(&unrelated, &test.federationDomain))
-			require.Equal(t, test.wantUpdate, filter.Update(&test.federationDomain, &unrelated))
-			require.Equal(t, test.wantDelete, filter.Delete(&test.federationDomain))
-			require.Equal(t, test.wantParent, filter.Parent(&test.federationDomain))
+			require.Equal(t, test.wantAdd, filter.Add(test.federationDomain.DeepCopy()))
+			require.Equal(t, test.wantUpdate, filter.Update(&unrelated, test.federationDomain.DeepCopy()))
+			require.Equal(t, test.wantUpdate, filter.Update(test.federationDomain.DeepCopy(), &unrelated))
+			require.Equal(t, test.wantDelete, filter.Delete(test.federationDomain.DeepCopy()))
+			require.Equal(t, test.wantParent, filter.Parent(test.federationDomain.DeepCopy()))
 		})
 	}
 }
@@ -625,7 +623,6 @@ func TestFederationDomainSecretsControllerSync(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 

internal/controller/supervisorconfig/generator/secret_helper_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package generator
@@ -52,7 +52,6 @@ func TestSymmetricSecretHelper(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -182,7 +181,6 @@ func TestSymmetricSecretHelperIsValid(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			h := NewSymmetricSecretHelper("none of these args matter", nil, nil, test.secretUsage, nil)
 

internal/controller/supervisorconfig/generator/supervisor_secrets_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package generator
@@ -100,7 +100,6 @@ func TestSupervisorSecretsControllerFilterSecret(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -407,7 +406,6 @@ func TestSupervisorSecretsControllerSync(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			// We cannot currently run this test in parallel since it uses the global generateKey function.
 

internal/controller/supervisorconfig/jwks_writer_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package supervisorconfig
@@ -167,7 +167,6 @@ func TestJWKSWriterControllerFilterSecret(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -221,7 +220,6 @@ func TestJWKSWriterControllerFilterFederationDomain(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -245,11 +243,11 @@ func TestJWKSWriterControllerFilterFederationDomain(t *testing.T) {
 
 			unrelated := configv1alpha1.FederationDomain{}
 			filter := withInformer.GetFilterForInformer(federationDomainInformer)
-			require.Equal(t, test.wantAdd, filter.Add(&test.federationDomain))
-			require.Equal(t, test.wantUpdate, filter.Update(&unrelated, &test.federationDomain))
-			require.Equal(t, test.wantUpdate, filter.Update(&test.federationDomain, &unrelated))
-			require.Equal(t, test.wantDelete, filter.Delete(&test.federationDomain))
-			require.Equal(t, test.wantParent, filter.Parent(&test.federationDomain))
+			require.Equal(t, test.wantAdd, filter.Add(test.federationDomain.DeepCopy()))
+			require.Equal(t, test.wantUpdate, filter.Update(&unrelated, test.federationDomain.DeepCopy()))
+			require.Equal(t, test.wantUpdate, filter.Update(test.federationDomain.DeepCopy(), &unrelated))
+			require.Equal(t, test.wantDelete, filter.Delete(test.federationDomain.DeepCopy()))
+			require.Equal(t, test.wantParent, filter.Parent(test.federationDomain.DeepCopy()))
 		})
 	}
 }
@@ -664,7 +662,6 @@ func TestJWKSWriterControllerSync(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			// We shouldn't run this test in parallel since it messes with a global function (generateKey).
 			generateKeyCount := 0

internal/controller/supervisorconfig/ldapupstreamwatcher/ldap_upstream_watcher_test.go

@@ -70,7 +70,6 @@ func TestLDAPUpstreamWatcherControllerFilterSecrets(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -115,7 +114,6 @@ func TestLDAPUpstreamWatcherControllerFilterLDAPIdentityProviders(t *testing.T)
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1131,7 +1129,6 @@ func TestLDAPUpstreamWatcherControllerSync(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher_test.go

@@ -1,4 +1,4 @@
-// Copyright 2022-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package oidcclientwatcher
@@ -954,7 +954,6 @@ func TestOIDCClientWatcherControllerSync(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			fakePinnipedClient := pinnipedfake.NewSimpleClientset(tt.inputObjects...)

internal/controller/supervisorconfig/oidcupstreamwatcher/oidc_upstream_watcher_test.go

@@ -74,7 +74,6 @@ func TestOIDCUpstreamWatcherControllerFilterSecret(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1409,7 +1408,6 @@ oidc: issuer did not match the issuer returned by provider, expected "` + testIs
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			fakePinnipedClient := pinnipedfake.NewSimpleClientset(tt.inputUpstreams...)

internal/controllerinit/controllerinit.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package controllerinit
@@ -34,8 +34,6 @@ type Informer interface {
 func Prepare(controllers Runner, controllersWrapper RunnerWrapper, informers ...Informer) RunnerBuilder {
 	return func(ctx context.Context) (Runner, error) {
 		for _, informer := range informers {
-			informer := informer
-
 			informer.Start(ctx.Done())
 
 			// prevent us from blocking forever due to a broken informer

internal/controllerlib/test/integration/examplecontroller/controller/creating_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package controller
@@ -92,8 +92,6 @@ func TestNewExampleCreatingController(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			kubeClient := fake.NewSimpleClientset()
 			for i := range tt.args.services {

internal/crud/crud_test.go

@@ -1288,7 +1288,6 @@ func TestStorage(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1516,7 +1515,6 @@ func TestFromSecret(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			data := &testJSON{}

internal/crypto/ptls/ptls.go

@@ -38,7 +38,6 @@ func Legacy(rootCAs *x509.CertPool) *tls.Config {
 func suitesToIDs(suites []*tls.CipherSuite) []uint16 {
 	out := make([]uint16, 0, len(suites))
 	for _, suite := range suites {
-		suite := suite
 		out = append(out, suite.ID)
 	}
 	return out

internal/crypto/ptls/ptls_test.go

@@ -208,7 +208,6 @@ func TestMerge(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/deploymentref/deploymentref_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package deploymentref
@@ -106,7 +106,6 @@ func TestNew(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			client := kubefake.NewSimpleClientset(test.apiObjects...)
 			if test.client != nil {

internal/downward/downward_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package downward
@@ -51,7 +51,6 @@ func TestLoad(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := Load(tt.inputDir)
 			if tt.wantErr != "" {
@@ -103,7 +102,6 @@ example.com/bar="baz\x01"
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := parseMap(tt.input)
 			if tt.wantErr != "" {

internal/dynamiccert/provider_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package dynamiccert
@@ -148,7 +148,6 @@ func TestProviderWithDynamicServingCertificateController(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/endpointaddr/endpointaddr_test.go

@@ -174,7 +174,6 @@ func TestParse(t *testing.T) {
 			expectErr:   `host "host.example.com:port1:port2" is not a valid hostname or IP address`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := Parse(tt.input, tt.defaultPort)
 			if tt.expectErr == "" {
@@ -338,7 +337,6 @@ func TestParseFromURL(t *testing.T) {
 			expectErr:      `address [::1]]:443: missing port in address`,
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			urlToProcess, err := url.Parse(tt.input)
 			require.NoError(t, err, "ParseFromURL expects a valid url.URL, parse errors here are not valuable")

internal/execcredcache/cachefile_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package execcredcache
@@ -70,7 +70,6 @@ func TestReadCache(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			got, err := readCache(tt.path)

internal/execcredcache/execcredcache_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package execcredcache
@@ -162,7 +162,6 @@ func TestGet(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			tmp := t.TempDir() + "/sessions.yaml"
@@ -328,7 +327,6 @@ func TestPutToken(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			tmp := t.TempDir() + "/cachedir/credentials.yaml"

internal/federationdomain/clientregistry/clientregistry_test.go

@@ -253,8 +253,6 @@ func TestClientManager(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/downstreamsubject/downstream_subject_test.go

@@ -42,7 +42,6 @@ func TestLDAP(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -81,7 +80,6 @@ func TestOIDC(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/dynamiccodec/codec_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package dynamiccodec
@@ -78,7 +78,6 @@ func TestCodec(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			var (
 				encoderSigningKey    = []byte("some-signing-key")

internal/federationdomain/endpoints/auth/auth_handler_test.go

@@ -3536,7 +3536,6 @@ func TestAuthorizationEndpoint(t *testing.T) { //nolint:gocyclo
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			kubeClient := fake.NewSimpleClientset()
 			supervisorClient := supervisorfake.NewSimpleClientset()

internal/federationdomain/endpoints/callback/callback_handler_test.go

@@ -1529,8 +1529,6 @@ func TestCallbackEndpoint(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
-
 		t.Run(test.name, func(t *testing.T) {
 			kubeClient := fake.NewSimpleClientset()
 			supervisorClient := supervisorfake.NewSimpleClientset()

internal/federationdomain/endpoints/chooseidp/choose_idp_handler_test.go

@@ -132,7 +132,6 @@ func TestChooseIDPHandler(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/endpoints/discovery/discovery_handler_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package discovery
@@ -65,7 +65,6 @@ func TestDiscovery(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			handler := NewHandler(test.issuer)
 			req := httptest.NewRequest(test.method, test.path, nil)

internal/federationdomain/endpoints/idpdiscovery/idp_discovery_handler_test.go

@@ -68,7 +68,6 @@ func TestIDPDiscovery(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			idpLister := testidplister.NewUpstreamIDPListerBuilder().
 				WithOIDC(oidctestutil.NewTestUpstreamOIDCIdentityProviderBuilder().WithName("z-some-oidc-idp").WithAllowPasswordGrant(true).Build()).

internal/federationdomain/endpoints/jwks/jwks_handler_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package jwks
@@ -77,7 +77,6 @@ func TestJWKSEndpoint(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			handler := NewHandler(test.issuer, test.provider)
 			req := httptest.NewRequest(test.method, test.path, nil)

internal/federationdomain/endpoints/token/token_handler_test.go

@@ -927,7 +927,6 @@ func TestTokenEndpointAuthcodeExchange(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -961,7 +960,6 @@ func TestTokenEndpointWhenAuthcodeIsUsedTwice(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -1641,7 +1639,6 @@ func TestTokenEndpointTokenExchange(t *testing.T) { // tests for grant_type "urn
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -4524,7 +4521,6 @@ func TestRefreshGrant(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -5473,7 +5469,6 @@ func TestDiffSortedGroups(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/federationdomainproviders/federation_domain_identity_providers_lister_finder_test.go

@@ -248,7 +248,6 @@ func TestFederationDomainIdentityProvidersListerFinder(t *testing.T) {
 	}
 
 	for _, tt := range testFindUpstreamIDPByDisplayName {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -324,7 +323,6 @@ func TestFederationDomainIdentityProvidersListerFinder(t *testing.T) {
 	}
 
 	for _, tt := range testFindDefaultIDP {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -399,7 +397,6 @@ func TestFederationDomainIdentityProvidersListerFinder(t *testing.T) {
 	}
 
 	for _, tt := range testGetIdentityProviders {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -450,7 +447,6 @@ func TestFederationDomainIdentityProvidersListerFinder(t *testing.T) {
 	}
 
 	for _, tt := range testIDPCount {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -503,7 +499,6 @@ func TestFederationDomainIdentityProvidersListerFinder(t *testing.T) {
 	}
 
 	for _, tt := range testHasDefaultIDP {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/federationdomainproviders/federation_domain_issuer_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package federationdomainproviders
@@ -83,7 +83,6 @@ func TestFederationDomainIssuerValidations(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			_, err := NewFederationDomainIssuer(tt.issuer, []*FederationDomainIdentityProvider{})
 			if tt.wantError != "" {

internal/federationdomain/idtokenlifespan/idtoken_lifespan_test.go

@@ -54,7 +54,6 @@ func TestOverrideIDTokenLifespanInContext(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/oidc/oidc_test.go

@@ -103,7 +103,6 @@ func TestOverrideIDTokenLifespan(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/resolvedprovider/resolvedoidc/resolved_oidc_provider_test.go

@@ -57,7 +57,6 @@ func TestMapAdditionalClaimsFromUpstreamIDToken(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/strategy/dynamic_oauth2_hmac_strategy_test.go

@@ -1,4 +1,4 @@
-// Copyright 2022-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package strategy
@@ -47,7 +47,6 @@ func TestDynamicOauth2HMACStrategy_Signatures(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -94,7 +93,6 @@ func TestDynamicOauth2HMACStrategy_Generate(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -166,7 +164,6 @@ func TestDynamicOauth2HMACStrategy_Validate(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/federationdomain/strategy/dynamic_open_id_connect_ecdsa_strategy_test.go

@@ -88,7 +88,6 @@ func TestDynamicOpenIDConnectECDSAStrategy(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			jwksProvider := jwks.NewDynamicJWKSProvider()
 			if test.jwksProvider != nil {

internal/fositestorage/accesstoken/accesstoken_test.go

@@ -408,7 +408,6 @@ func TestReadFromSecret(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			session, err := ReadFromSecret(tt.secret)

internal/fositestorage/authorizationcode/authorizationcode_test.go

@@ -544,7 +544,6 @@ func TestReadFromSecret(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			session, err := ReadFromSecret(tt.secret)

internal/fositestorage/refreshtoken/refreshtoken_test.go

@@ -465,7 +465,6 @@ func TestReadFromSecret(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			session, err := ReadFromSecret(tt.secret)

internal/groupsuffix/groupsuffix.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package groupsuffix
@@ -186,7 +186,6 @@ func Validate(apiGroupSuffix string) error {
 
 	errorStrings := validation.IsDNS1123Subdomain(apiGroupSuffix)
 	for _, errorString := range errorStrings {
-		errorString := errorString
 		errs = append(errs, constable.Error(errorString))
 	}
 

internal/groupsuffix/groupsuffix_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package groupsuffix
@@ -525,7 +525,6 @@ func TestMiddlware(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			m := New(test.apiGroupSuffix)
 			if test.wantNilMiddleware {
@@ -542,7 +541,6 @@ func TestMiddlware(t *testing.T) {
 				objMutated := test.requestObj.DeepCopyObject().(kubeclient.Object)
 				var mutateRequestErrors []string
 				for _, mutateRequest := range test.rt.MutateRequests {
-					mutateRequest := mutateRequest
 					if err := mutateRequest(objMutated); err != nil {
 						mutateRequestErrors = append(mutateRequestErrors, err.Error())
 					}
@@ -559,7 +557,6 @@ func TestMiddlware(t *testing.T) {
 				objMutated := test.responseObj.DeepCopyObject().(kubeclient.Object)
 				var mutateResponseErrors []string
 				for _, mutateResponse := range test.rt.MutateResponses {
-					mutateResponse := mutateResponse
 					if err := mutateResponse(objMutated); err != nil {
 						mutateResponseErrors = append(mutateResponseErrors, err.Error())
 					}
@@ -637,7 +634,6 @@ func TestValidate(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.apiGroupSuffix, func(t *testing.T) {
 			err := Validate(test.apiGroupSuffix)
 			if test.wantErrorPrefix != "" {

internal/httputil/securityheader/securityheader_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package securityheader
@@ -56,7 +56,6 @@ func TestWrap(t *testing.T) {
 			},
 		},
 	} {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			testServer := httptest.NewServer(tt.wrapFunc(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				w.Header().Set("X-Test-Header", "test value")

internal/idtransform/identity_transformations_test.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package idtransform
@@ -297,7 +297,6 @@ func TestTransformationPipelineEvaluation(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/kubeclient/gvk_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package kubeclient
@@ -172,7 +172,6 @@ func Test_maybeRestoreGVK(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			serializer := &testSerializer{unknown: tt.args.unknown}
 			respData := []byte(`original`)

internal/kubeclient/kubeclient_test.go

@@ -602,7 +602,6 @@ func TestKubeclient(t *testing.T) {
 		},
 	}
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			_, restConfig := fakekubeapi.Start(t, nil)
 
@@ -1134,7 +1133,6 @@ func testUnwrap(t *testing.T, client *Client, serverSubjects [][]byte, tlsConfig
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel() // make sure to run in parallel to confirm that our client-go TLS cache busting works (i.e. assert no data races)
 

internal/kubeclient/middleware.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package kubeclient
@@ -33,7 +33,6 @@ type Middlewares []Middleware
 
 func (m Middlewares) Handle(ctx context.Context, rt RoundTrip) {
 	for _, middleware := range m {
-		middleware := middleware
 		middleware.Handle(ctx, rt)
 	}
 }
@@ -116,7 +115,6 @@ func (r *request) mutateRequest(obj Object) (*mutationResult, error) {
 
 	var errs []error
 	for _, reqFunc := range r.reqFuncs {
-		reqFunc := reqFunc
 		if err := reqFunc(obj); err != nil {
 			errs = append(errs, err)
 		}
@@ -146,7 +144,6 @@ func (r *request) mutateResponse(obj Object) (bool, error) {
 
 	var errs []error
 	for _, respFunc := range r.respFuncs {
-		respFunc := respFunc
 		if err := respFunc(obj); err != nil {
 			errs = append(errs, err)
 		}

internal/kubeclient/middleware_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package kubeclient
@@ -50,7 +50,6 @@ func Test_request_mutate(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			r := &request{reqFuncs: tt.reqFuncs}
 			orig := tt.obj.DeepCopyObject()

internal/kubeclient/path_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package kubeclient
@@ -127,7 +127,6 @@ func Test_updatePathNewGVK(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			got, err := updatePathNewGVK(tt.args.reqURL, tt.args.result, tt.args.apiPathPrefix, tt.args.reqInfo)
 			if (err != nil) != tt.wantErr {
@@ -213,7 +212,6 @@ func Test_reqWithoutPrefix(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			req := *tt.args.req
 			if got := reqWithoutPrefix(&req, tt.args.hostURL, tt.args.apiPathPrefix); !reflect.DeepEqual(got, tt.want) {

internal/kubeclient/roundtrip.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package kubeclient
@@ -98,7 +98,6 @@ func newWrapper(
 			}
 
 			for _, middleware := range middlewares {
-				middleware := middleware
 				middleware.Handle(req.Context(), middlewareReq)
 			}
 

internal/kubeclient/scheme_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package kubeclient
@@ -139,7 +139,6 @@ func Test_schemeRestMapper(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			schemeRestMapperFunc := schemeRestMapper(tt.args.scheme)
 			gvk, ok := schemeRestMapperFunc(tt.args.gvr, tt.args.v)

internal/kubeclient/verb_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package kubeclient
@@ -46,7 +46,6 @@ func Test_verb(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			require.Equal(t, tt.want, tt.f())
 		})

internal/leaderelection/leaderelection_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package leaderelection
@@ -58,7 +58,6 @@ func Test_releaseLock_Update(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/localuserauthenticator/localuserauthenticator_test.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package localuserauthenticator
@@ -390,7 +390,6 @@ func TestWebhook(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		test := test
 		t.Run(test.name, func(t *testing.T) {
 			parsedURL, err := url.Parse(test.url)
 			require.NoError(t, err)

internal/net/phttp/debug_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package phttp
@@ -237,7 +237,6 @@ func Test_safeDebugWrappers_clean(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/net/phttp/phttp_test.go

@@ -38,7 +38,6 @@ func TestUnwrap(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -78,7 +77,6 @@ func TestClient(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/net/phttp/warning_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package phttp
@@ -67,7 +67,6 @@ func Test_warningWrapper(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/oidcclientsecretstorage/oidcclientsecretstorage_test.go

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package oidcclientsecretstorage
@@ -115,7 +115,6 @@ func TestGet(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			kubeClient := fake.NewSimpleClientset()
@@ -325,7 +324,6 @@ func TestSet(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			kubeClient := fake.NewSimpleClientset()
@@ -389,7 +387,6 @@ func TestGetStorageSecret(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -523,7 +520,6 @@ func TestReadFromSecret(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			hashes, err := ReadFromSecret(tt.secret)

internal/ownerref/ownerref_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package ownerref
@@ -194,7 +194,6 @@ func TestOwnerReferenceMiddleware(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			middleware := New(tt.args.ref)
 
@@ -212,7 +211,6 @@ func TestOwnerReferenceMiddleware(t *testing.T) {
 
 			orig := tt.args.obj.DeepCopyObject().(kubeclient.Object)
 			for _, mutateRequest := range rt.MutateRequests {
-				mutateRequest := mutateRequest
 				require.NoError(t, mutateRequest(tt.args.obj))
 			}
 			if !tt.wantMutates {

internal/plog/config_test.go

@@ -217,7 +217,6 @@ func TestValidateAndSetLogLevelGlobally(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt // capture range variable
 		t.Run(tt.name, func(t *testing.T) {
 			defer func() {
 				undoGlobalLogLevelChanges(t, originalLogLevel)

internal/plog/plog.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // Package plog implements a thin layer over logr to help enforce pinniped's logging convention.
@@ -190,7 +190,6 @@ func (p pLogger) withLogrMod(mod func(logr.Logger) logr.Logger) Logger {
 func (p pLogger) logr() logr.Logger {
 	l := Logr() // grab the current global logger and its current config
 	for _, mod := range p.mods {
-		mod := mod
 		l = mod(l) // and then update it with all modifications
 	}
 	return l // this logger is guaranteed to have the latest config and all modifications

internal/plog/plog_test.go

@@ -357,7 +357,6 @@ func TestPlog(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/registry/clientsecretrequest/rest_test.go

@@ -1557,8 +1557,6 @@ func TestCreate(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
-
 		t.Run(tt.name, func(t *testing.T) {
 			// t.Parallel() should not be used because we are mutating the global logger.
 			var log bytes.Buffer

internal/registry/whoamirequest/rest_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package whoamirequest
@@ -193,7 +193,6 @@ func TestCreate(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			r := &REST{}
 			got, err := r.Create(tt.args.ctx, tt.args.obj, tt.args.createValidation, tt.args.options)

internal/supervisor/scheme/scheme_test.go

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package scheme
@@ -133,7 +133,6 @@ func TestNew(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			scheme, clientSecretGV := New(tt.apiGroupSuffix)
 			require.Equal(t, tt.want, scheme.AllKnownTypes())

internal/tokenclient/tokenclient_test.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package tokenclient
@@ -90,7 +90,6 @@ func TestNew(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -166,7 +165,6 @@ func TestFetchToken(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -323,7 +321,6 @@ func TestStart(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

internal/upstreamldap/upstreamldap_test.go

@@ -2172,7 +2172,6 @@ func TestUpstreamRefresh(t *testing.T) {
 	}
 
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			ctrl := gomock.NewController(t)
 			t.Cleanup(ctrl.Finish)

internal/upstreamoidc/upstreamoidc_test.go

@@ -22,6 +22,7 @@ import (
 	"go.uber.org/mock/gomock"
 	"golang.org/x/oauth2"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
 
 	"go.pinniped.dev/internal/federationdomain/dynamicupstreamprovider"
 	"go.pinniped.dev/internal/federationdomain/upstreamprovider"
@@ -241,7 +242,6 @@ func TestProviderConfig(t *testing.T) {
 			},
 		}
 		for _, tt := range tests {
-			tt := tt
 			t.Run(tt.name, func(t *testing.T) {
 				tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					require.Equal(t, http.MethodPost, r.Method)
@@ -310,7 +310,7 @@ func TestProviderConfig(t *testing.T) {
 					return
 				}
 				require.NoError(t, err)
-				require.Equal(t, &tt.wantToken, tok)
+				require.Equal(t, ptr.To(tt.wantToken), tok)
 				require.Equal(t, tt.wantUserInfoCalled, p.Provider.(*mockProvider).called)
 			})
 		}
@@ -413,7 +413,6 @@ func TestProviderConfig(t *testing.T) {
 			},
 		}
 		for _, tt := range tests {
-			tt := tt
 			t.Run(tt.name, func(t *testing.T) {
 				tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					require.Equal(t, http.MethodPost, r.Method)
@@ -649,7 +648,6 @@ func TestProviderConfig(t *testing.T) {
 			},
 		}
 		for _, tt := range tests {
-			tt := tt
 			numRequests := 0
 			t.Run(tt.name, func(t *testing.T) {
 				tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1086,7 +1084,6 @@ func TestProviderConfig(t *testing.T) {
 		}
 
 		for _, tt := range tests {
-			tt := tt
 			t.Run(tt.name, func(t *testing.T) {
 				p := ProviderConfig{
 					Name:          "test-name",
@@ -1334,7 +1331,6 @@ func TestProviderConfig(t *testing.T) {
 			},
 		}
 		for _, tt := range tests {
-			tt := tt
 			t.Run(tt.name, func(t *testing.T) {
 				tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					require.Equal(t, http.MethodPost, r.Method)
@@ -1404,7 +1400,7 @@ func TestProviderConfig(t *testing.T) {
 					return
 				}
 				require.NoError(t, err)
-				require.Equal(t, &tt.wantToken, tok)
+				require.Equal(t, ptr.To(tt.wantToken), tok)
 				require.Equal(t, tt.wantUserInfoCalled, p.Provider.(*mockProvider).called)
 			})
 		}

internal/valuelesscontext/valuelesscontext_test.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package valuelesscontext
@@ -208,7 +208,6 @@ func TestNew(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

pkg/conciergeclient/conciergeclient_test.go

@@ -135,7 +135,6 @@ func TestNew(t *testing.T) {
 		},
 	}
 	for _, tt := range tests {
-		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			got, err := New(tt.opts...)