Merge branch 'qmnguyen0711/enable-gitaly-linters' into 'master'

Enable Gitaly custom linters

See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5500

Merged-by: Quang-Minh Nguyen <qmnguyen@gitlab.com>
Approved-by: karthik nayak <knayak@gitlab.com>

80 files changed, 183 insertions, 156 deletions

diff --git a/.golangci.yml b/.golangci.yml
index bae98a54f..a5f53ec57 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -34,6 +34,7 @@ linters:
     - thelper
     - unconvert
     - unused
+    - gitaly-linters
     # These linters don't currently support Go 1.18+. Please refer to
     # https://github.com/golangci/golangci-lint/issues/2649 for further
     # information.
diff --git a/client/pool.go b/client/pool.go
index 4fcd3835e..a6a96afc9 100644
--- a/client/pool.go
+++ b/client/pool.go
@@ -94,7 +94,7 @@ func (p *Pool) getOrCreateConnection(ctx context.Context, address, token string)
 
 	cc, err := p.dialer(ctx, address, opts)
 	if err != nil {
-		return nil, fmt.Errorf("could not dial source: %v", err)
+		return nil, fmt.Errorf("could not dial source: %w", err)
 	}
 
 	p.conns[key] = cc
diff --git a/cmd/gitaly-git2go/testhelper_test.go b/cmd/gitaly-git2go/testhelper_test.go
index b7614b867..f00b631b5 100644
--- a/cmd/gitaly-git2go/testhelper_test.go
+++ b/cmd/gitaly-git2go/testhelper_test.go
@@ -31,7 +31,7 @@ func TestMain(m *testing.M) {
 			git.ConfigLevelGlobal,
 		} {
 			if err := git.SetSearchPath(configLevel, "/dev/null"); err != nil {
-				return fmt.Errorf("setting Git2go search path: %s", err)
+				return fmt.Errorf("setting Git2go search path: %w", err)
 			}
 		}
 
diff --git a/cmd/gitaly-hooks/hooks.go b/cmd/gitaly-hooks/hooks.go
index f505b3dda..05ddafdf7 100644
--- a/cmd/gitaly-hooks/hooks.go
+++ b/cmd/gitaly-hooks/hooks.go
@@ -117,7 +117,7 @@ func executeHook(cmd hookCommand, args []string) error {
 
 	payload, err := git.HooksPayloadFromEnv(os.Environ())
 	if err != nil {
-		return fmt.Errorf("error when getting hooks payload: %v", err)
+		return fmt.Errorf("error when getting hooks payload: %w", err)
 	}
 
 	// If the hook wasn't requested, then we simply skip executing any
@@ -128,7 +128,7 @@ func executeHook(cmd hookCommand, args []string) error {
 
 	conn, err := dialGitaly(payload)
 	if err != nil {
-		return fmt.Errorf("error when connecting to gitaly: %v", err)
+		return fmt.Errorf("error when connecting to gitaly: %w", err)
 	}
 	defer conn.Close()
 
@@ -227,13 +227,13 @@ func updateHook(ctx context.Context, payload git.HooksPayload, hookClient gitaly
 
 	updateHookStream, err := hookClient.UpdateHook(ctx, req)
 	if err != nil {
-		return fmt.Errorf("error when starting command for update hook: %v", err)
+		return fmt.Errorf("error when starting command for update hook: %w", err)
 	}
 
 	if returnCode, err := stream.Handler(func() (stream.StdoutStderrResponse, error) {
 		return updateHookStream.Recv()
 	}, noopSender, os.Stdout, os.Stderr); err != nil {
-		return fmt.Errorf("error when receiving data for update hook: %v", err)
+		return fmt.Errorf("error when receiving data for update hook: %w", err)
 	} else if returnCode != 0 {
 		return hookError{returnCode: int(returnCode)}
 	}
@@ -244,7 +244,7 @@ func updateHook(ctx context.Context, payload git.HooksPayload, hookClient gitaly
 func preReceiveHook(ctx context.Context, payload git.HooksPayload, hookClient gitalypb.HookServiceClient, args []string) error {
 	preReceiveHookStream, err := hookClient.PreReceiveHook(ctx)
 	if err != nil {
-		return fmt.Errorf("error when getting preReceiveHookStream client for: %v", err)
+		return fmt.Errorf("error when getting preReceiveHookStream client for: %w", err)
 	}
 
 	if err := preReceiveHookStream.Send(&gitalypb.PreReceiveHookRequest{
@@ -252,7 +252,7 @@ func preReceiveHook(ctx context.Context, payload git.HooksPayload, hookClient gi
 		EnvironmentVariables: os.Environ(),
 		GitPushOptions:       gitPushOptions(),
 	}); err != nil {
-		return fmt.Errorf("error when sending request for pre-receive hook: %v", err)
+		return fmt.Errorf("error when sending request for pre-receive hook: %w", err)
 	}
 
 	f := sendFunc(streamio.NewWriter(func(p []byte) error {
@@ -262,7 +262,7 @@ func preReceiveHook(ctx context.Context, payload git.HooksPayload, hookClient gi
 	if returnCode, err := stream.Handler(func() (stream.StdoutStderrResponse, error) {
 		return preReceiveHookStream.Recv()
 	}, f, os.Stdout, os.Stderr); err != nil {
-		return fmt.Errorf("error when receiving data for pre-receive hook: %v", err)
+		return fmt.Errorf("error when receiving data for pre-receive hook: %w", err)
 	} else if returnCode != 0 {
 		return hookError{returnCode: int(returnCode)}
 	}
@@ -273,7 +273,7 @@ func preReceiveHook(ctx context.Context, payload git.HooksPayload, hookClient gi
 func postReceiveHook(ctx context.Context, payload git.HooksPayload, hookClient gitalypb.HookServiceClient, args []string) error {
 	postReceiveHookStream, err := hookClient.PostReceiveHook(ctx)
 	if err != nil {
-		return fmt.Errorf("error when getting stream client for post-receive hook: %v", err)
+		return fmt.Errorf("error when getting stream client for post-receive hook: %w", err)
 	}
 
 	if err := postReceiveHookStream.Send(&gitalypb.PostReceiveHookRequest{
@@ -281,7 +281,7 @@ func postReceiveHook(ctx context.Context, payload git.HooksPayload, hookClient g
 		EnvironmentVariables: os.Environ(),
 		GitPushOptions:       gitPushOptions(),
 	}); err != nil {
-		return fmt.Errorf("error when sending request for post-receive hook: %v", err)
+		return fmt.Errorf("error when sending request for post-receive hook: %w", err)
 	}
 
 	f := sendFunc(streamio.NewWriter(func(p []byte) error {
@@ -291,7 +291,7 @@ func postReceiveHook(ctx context.Context, payload git.HooksPayload, hookClient g
 	if returnCode, err := stream.Handler(func() (stream.StdoutStderrResponse, error) {
 		return postReceiveHookStream.Recv()
 	}, f, os.Stdout, os.Stderr); err != nil {
-		return fmt.Errorf("error when receiving data for post-receive hook: %v", err)
+		return fmt.Errorf("error when receiving data for post-receive hook: %w", err)
 	} else if returnCode != 0 {
 		return hookError{returnCode: int(returnCode)}
 	}
@@ -318,7 +318,7 @@ func referenceTransactionHook(ctx context.Context, payload git.HooksPayload, hoo
 
 	referenceTransactionHookStream, err := hookClient.ReferenceTransactionHook(ctx)
 	if err != nil {
-		return fmt.Errorf("error when getting referenceTransactionHookStream client: %v", err)
+		return fmt.Errorf("error when getting referenceTransactionHookStream client: %w", err)
 	}
 
 	if err := referenceTransactionHookStream.Send(&gitalypb.ReferenceTransactionHookRequest{
@@ -326,7 +326,7 @@ func referenceTransactionHook(ctx context.Context, payload git.HooksPayload, hoo
 		EnvironmentVariables: os.Environ(),
 		State:                state,
 	}); err != nil {
-		return fmt.Errorf("error when sending request for reference-transaction hook: %v", err)
+		return fmt.Errorf("error when sending request for reference-transaction hook: %w", err)
 	}
 
 	f := sendFunc(streamio.NewWriter(func(p []byte) error {
@@ -336,7 +336,7 @@ func referenceTransactionHook(ctx context.Context, payload git.HooksPayload, hoo
 	if returnCode, err := stream.Handler(func() (stream.StdoutStderrResponse, error) {
 		return referenceTransactionHookStream.Recv()
 	}, f, os.Stdout, os.Stderr); err != nil {
-		return fmt.Errorf("error when receiving data for reference-transaction hook: %v", err)
+		return fmt.Errorf("error when receiving data for reference-transaction hook: %w", err)
 	} else if returnCode != 0 {
 		return hookError{returnCode: int(returnCode)}
 	}
diff --git a/cmd/gitaly-lfs-smudge/smudge.go b/cmd/gitaly-lfs-smudge/smudge.go
index 875a084c2..8a05189d3 100644
--- a/cmd/gitaly-lfs-smudge/smudge.go
+++ b/cmd/gitaly-lfs-smudge/smudge.go
@@ -305,7 +305,7 @@ func smudgeOneObject(ctx context.Context, cfg smudge.Config, gitlabClient *gitla
 
 	response, err := gitlabClient.Get(ctx, u.String())
 	if err != nil {
-		return nil, fmt.Errorf("error loading LFS object: %v", err)
+		return nil, fmt.Errorf("error loading LFS object: %w", err)
 	}
 
 	if response.StatusCode == 200 {
diff --git a/cmd/praefect/main.go b/cmd/praefect/main.go
index 540d7e982..c4329312a 100644
--- a/cmd/praefect/main.go
+++ b/cmd/praefect/main.go
@@ -177,7 +177,7 @@ func initConfig(logger *logrus.Entry) (config.Config, error) {
 
 	conf, err := config.FromFile(*flagConfig)
 	if err != nil {
-		return conf, fmt.Errorf("error reading config file: %v", err)
+		return conf, fmt.Errorf("error reading config file: %w", err)
 	}
 
 	if err := conf.Validate(); err != nil {
@@ -530,7 +530,7 @@ func run(
 	}
 
 	if err := b.Start(); err != nil {
-		return fmt.Errorf("unable to start the bootstrap: %v", err)
+		return fmt.Errorf("unable to start the bootstrap: %w", err)
 	}
 	for _, cfg := range cfgs {
 		logger.WithFields(logrus.Fields{"schema": cfg.Name, "address": cfg.Addr}).Info("listening")
diff --git a/cmd/praefect/subcmd.go b/cmd/praefect/subcmd.go
index 0ac247f8f..0e3da6832 100644
--- a/cmd/praefect/subcmd.go
+++ b/cmd/praefect/subcmd.go
@@ -104,7 +104,7 @@ func openDB(conf config.DB) (*sql.DB, func(), error) {
 	defer cancel()
 	db, err := glsql.OpenDB(openDBCtx, conf)
 	if err != nil {
-		return nil, nil, fmt.Errorf("sql open: %v", err)
+		return nil, nil, fmt.Errorf("sql open: %w", err)
 	}
 
 	clean := func() {
diff --git a/cmd/praefect/subcmd_dataloss.go b/cmd/praefect/subcmd_dataloss.go
index 45d16328f..da9c23f81 100644
--- a/cmd/praefect/subcmd_dataloss.go
+++ b/cmd/praefect/subcmd_dataloss.go
@@ -64,7 +64,7 @@ func (cmd *datalossSubcommand) Exec(flags *flag.FlagSet, cfg config.Config) erro
 	ctx := context.Background()
 	conn, err := subCmdDial(ctx, nodeAddr, cfg.Auth.Token, defaultDialTimeout)
 	if err != nil {
-		return fmt.Errorf("error dialing: %v", err)
+		return fmt.Errorf("error dialing: %w", err)
 	}
 	defer func() {
 		if err := conn.Close(); err != nil {
@@ -80,7 +80,7 @@ func (cmd *datalossSubcommand) Exec(flags *flag.FlagSet, cfg config.Config) erro
 			IncludePartiallyReplicated: cmd.includePartiallyAvailable,
 		})
 		if err != nil {
-			return fmt.Errorf("error checking: %v", err)
+			return fmt.Errorf("error checking: %w", err)
 		}
 
 		cmd.println(0, "Virtual storage: %s", vs)
diff --git a/cmd/praefect/subcmd_sql_migrate.go b/cmd/praefect/subcmd_sql_migrate.go
index 670dd5ca8..c9e5941e8 100644
--- a/cmd/praefect/subcmd_sql_migrate.go
+++ b/cmd/praefect/subcmd_sql_migrate.go
@@ -72,7 +72,7 @@ func (cmd *sqlMigrateSubcommand) Exec(flags *flag.FlagSet, conf config.Config) e
 
 		n, err := glsql.MigrateSome(mig.Migration, db, cmd.ignoreUnknown)
 		if err != nil {
-			return fmt.Errorf("%s: fail: %v", time.Now().Format(timeFmt), err)
+			return fmt.Errorf("%s: fail: %w", time.Now().Format(timeFmt), err)
 		}
 
 		if n > 0 {
diff --git a/cmd/praefect/subcmd_sql_ping.go b/cmd/praefect/subcmd_sql_ping.go
index b11f6da2f..7d63ddc4f 100644
--- a/cmd/praefect/subcmd_sql_ping.go
+++ b/cmd/praefect/subcmd_sql_ping.go
@@ -28,7 +28,7 @@ func (s *sqlPingSubcommand) Exec(flags *flag.FlagSet, conf config.Config) error
 	defer clean()
 
 	if err := datastore.CheckPostgresVersion(db); err != nil {
-		return fmt.Errorf("%s: fail: %v", subCmd, err)
+		return fmt.Errorf("%s: fail: %w", subCmd, err)
 	}
 
 	fmt.Printf("%s: OK\n", subCmd)
diff --git a/internal/bootstrap/bootstrap.go b/internal/bootstrap/bootstrap.go
index a0251fee0..6a2473390 100644
--- a/internal/bootstrap/bootstrap.go
+++ b/internal/bootstrap/bootstrap.go
@@ -183,7 +183,7 @@ func (b *Bootstrap) Wait(gracePeriodTicker helper.Ticker, stopAction func()) err
 		// we set a grace period and then we force a termination.
 		waitError := b.waitGracePeriod(gracePeriodTicker, immediateShutdown, stopAction)
 
-		err = fmt.Errorf("graceful upgrade: %v", waitError)
+		err = fmt.Errorf("graceful upgrade: %w", waitError)
 	case s := <-immediateShutdown:
 		err = fmt.Errorf("received signal %q", s)
 		b.upgrader.Stop()
diff --git a/internal/bootstrap/bootstrap_test.go b/internal/bootstrap/bootstrap_test.go
index d69ca5156..7dfa7f053 100644
--- a/internal/bootstrap/bootstrap_test.go
+++ b/internal/bootstrap/bootstrap_test.go
@@ -148,7 +148,7 @@ func TestBootstrap_gracefulTerminationStuck(t *testing.T) {
 		// terminate and thus the graceful termination will be stuck.
 		<-ctx.Done()
 	})
-	require.Equal(t, fmt.Errorf("graceful upgrade: grace period expired"), err)
+	require.Equal(t, fmt.Errorf("graceful upgrade: %w", fmt.Errorf("grace period expired")), err)
 
 	cancel()
 	<-doneCh
@@ -172,7 +172,7 @@ func TestBootstrap_gracefulTerminationWithSignals(t *testing.T) {
 				// signal was processed.
 				<-ctx.Done()
 			})
-			require.Equal(t, fmt.Errorf("graceful upgrade: force shutdown"), err)
+			require.Equal(t, fmt.Errorf("graceful upgrade: %w", fmt.Errorf("force shutdown")), err)
 
 			cancel()
 			<-doneCh
@@ -201,7 +201,7 @@ func TestBootstrap_gracefulTerminationTimeoutWithListenerError(t *testing.T) {
 		// terminate.
 		<-ctx.Done()
 	})
-	require.Equal(t, fmt.Errorf("graceful upgrade: grace period expired"), err)
+	require.Equal(t, fmt.Errorf("graceful upgrade: %w", fmt.Errorf("grace period expired")), err)
 
 	cancel()
 	<-doneCh
@@ -213,7 +213,7 @@ func TestBootstrap_gracefulTermination(t *testing.T) {
 	b, upgrader, _ := setup(t, ctx)
 
 	require.Equal(t,
-		fmt.Errorf("graceful upgrade: completed"),
+		fmt.Errorf("graceful upgrade: %w", fmt.Errorf("completed")),
 		performUpgrade(t, b, upgrader, helper.NewManualTicker(), nil, nil),
 	)
 }
diff --git a/internal/cli/gitaly/serve.go b/internal/cli/gitaly/serve.go
index 5839148b2..7bdf7560f 100644
--- a/internal/cli/gitaly/serve.go
+++ b/internal/cli/gitaly/serve.go
@@ -306,7 +306,7 @@ func run(cfg config.Cfg) error {
 
 	rubySrv := rubyserver.New(cfg, gitCmdFactory)
 	if err := rubySrv.Start(); err != nil {
-		return fmt.Errorf("initialize gitaly-ruby: %v", err)
+		return fmt.Errorf("initialize gitaly-ruby: %w", err)
 	}
 	defer rubySrv.Stop()
 
@@ -395,7 +395,7 @@ func run(cfg config.Cfg) error {
 	}
 
 	if err := b.Start(); err != nil {
-		return fmt.Errorf("unable to start the bootstrap: %v", err)
+		return fmt.Errorf("unable to start the bootstrap: %w", err)
 	}
 	bootstrapSpan.Finish()
 
@@ -407,7 +407,7 @@ func run(cfg config.Cfg) error {
 		})),
 	)
 	if err != nil {
-		return fmt.Errorf("initialize auxiliary workers: %v", err)
+		return fmt.Errorf("initialize auxiliary workers: %w", err)
 	}
 	defer shutdownWorkers()
 
diff --git a/internal/command/command.go b/internal/command/command.go
index 0d5d30b43..1562afeb7 100644
--- a/internal/command/command.go
+++ b/internal/command/command.go
@@ -376,6 +376,7 @@ func (c *Command) wait() {
 		// The standard library sets exit status -1 if the process was terminated by a signal,
 		// such as the SIGTERM sent when context is done.
 		if exitCode, ok := ExitStatus(c.waitError); ok && exitCode == -1 {
+			//nolint:gitaly-linters // We can only wrap one
 			c.waitError = fmt.Errorf("%s: %w", c.waitError, c.context.Err())
 		}
 	}
diff --git a/internal/git/catfile/request_queue.go b/internal/git/catfile/request_queue.go
index b0ae8c1ba..6b45da726 100644
--- a/internal/git/catfile/request_queue.go
+++ b/internal/git/catfile/request_queue.go
@@ -194,7 +194,7 @@ func (q *requestQueue) ReadObject(ctx context.Context) (*Object, error) {
 		},
 		readerFunc(func([]byte) (int, error) {
 			if _, err := io.CopyN(io.Discard, q.stdout, 1); err != nil {
-				return 0, fmt.Errorf("discard newline: %q", err)
+				return 0, fmt.Errorf("discard newline: %w", err)
 			}
 
 			atomic.StoreInt32(&q.counters.isReadingObject, 0)
diff --git a/internal/git/catfile/request_queue_test.go b/internal/git/catfile/request_queue_test.go
index 8e2249493..f5205baf6 100644
--- a/internal/git/catfile/request_queue_test.go
+++ b/internal/git/catfile/request_queue_test.go
@@ -215,7 +215,7 @@ func TestRequestQueue_ReadObject(t *testing.T) {
 		// truncated. Note that we explicitly expect to not see an io.EOF here,
 		// which might indicate success to the caller.
 		_, err = object.Read(buf[:])
-		require.Equal(t, fmt.Errorf("discard newline: \"EOF\""), err)
+		require.Equal(t, fmt.Errorf("discard newline: %w", io.EOF), err)
 
 		require.True(t, queue.isDirty())
 	})
diff --git a/internal/git/catfile/tag.go b/internal/git/catfile/tag.go
index 2db9d870f..b011bd20e 100644
--- a/internal/git/catfile/tag.go
+++ b/internal/git/catfile/tag.go
@@ -65,13 +65,13 @@ func buildAnnotatedTag(ctx context.Context, objectReader ObjectContentReader, ob
 	case "commit":
 		tag.TargetCommit, err = GetCommit(ctx, objectReader, git.Revision(tagged.objectID))
 		if err != nil {
-			return nil, fmt.Errorf("buildAnnotatedTag error when getting target commit: %v", err)
+			return nil, fmt.Errorf("buildAnnotatedTag error when getting target commit: %w", err)
 		}
 
 	case "tag":
 		tag.TargetCommit, err = dereferenceTag(ctx, objectReader, git.Revision(tagged.objectID))
 		if err != nil {
-			return nil, fmt.Errorf("buildAnnotatedTag error when dereferencing tag: %v", err)
+			return nil, fmt.Errorf("buildAnnotatedTag error when dereferencing tag: %w", err)
 		}
 	}
 
diff --git a/internal/git/catfile/tree_entries.go b/internal/git/catfile/tree_entries.go
index 87b66a236..343086b18 100644
--- a/internal/git/catfile/tree_entries.go
+++ b/internal/git/catfile/tree_entries.go
@@ -86,24 +86,24 @@ func extractEntryInfoFromTreeData(treeData io.Reader, commitOid, rootOid, rootPa
 			break
 		}
 		if err != nil || len(modeBytes) <= 1 {
-			return nil, fmt.Errorf("read entry mode: %v", err)
+			return nil, fmt.Errorf("read entry mode: %w", err)
 		}
 		modeBytes = modeBytes[:len(modeBytes)-1]
 
 		filename, err := bufReader.ReadBytes('\x00')
 		if err != nil || len(filename) <= 1 {
-			return nil, fmt.Errorf("read entry path: %v", err)
+			return nil, fmt.Errorf("read entry path: %w", err)
 		}
 		filename = filename[:len(filename)-1]
 
 		oidBuf.Reset()
 		if _, err := io.CopyN(oidBuf, bufReader, oidSize); err != nil {
-			return nil, fmt.Errorf("read entry oid: %v", err)
+			return nil, fmt.Errorf("read entry oid: %w", err)
 		}
 
 		treeEntry, err := git.NewTreeEntry(commitOid, rootOid, rootPath, filename, oidBuf.Bytes(), modeBytes)
 		if err != nil {
-			return nil, fmt.Errorf("new entry info: %v", err)
+			return nil, fmt.Errorf("new entry info: %w", err)
 		}
 
 		entries = append(entries, treeEntry)
diff --git a/internal/git/command_factory_test.go b/internal/git/command_factory_test.go
index 6ae6c1409..0635f4e2e 100644
--- a/internal/git/command_factory_test.go
+++ b/internal/git/command_factory_test.go
@@ -518,6 +518,7 @@ func TestExecCommandFactory_GitVersion(t *testing.T) {
 
 	generateVersionScript := func(version string) func(git.ExecutionEnvironment) string {
 		return func(git.ExecutionEnvironment) string {
+			//nolint:gitaly-linters
 			return fmt.Sprintf(
 				`#!/usr/bin/env bash
 				echo '%s'
diff --git a/internal/git/command_options.go b/internal/git/command_options.go
index 1dee4d82f..8e2649a51 100644
--- a/internal/git/command_options.go
+++ b/internal/git/command_options.go
@@ -231,12 +231,12 @@ func withInternalFetch(req repoScopedRequest, withSidechannel bool) func(ctx con
 	return func(ctx context.Context, cfg config.Cfg, _ CommandFactory, c *cmdCfg) error {
 		payload, err := protojson.Marshal(req)
 		if err != nil {
-			return structerr.NewInternal("marshalling payload failed: %v", err)
+			return structerr.NewInternal("marshalling payload failed: %w", err)
 		}
 
 		serversInfo, err := storage.ExtractGitalyServers(ctx)
 		if err != nil {
-			return structerr.NewInternal("extracting Gitaly servers: %v", err)
+			return structerr.NewInternal("extracting Gitaly servers: %w", err)
 		}
 
 		storageInfo, ok := serversInfo[req.GetRepository().GetStorageName()]
diff --git a/internal/git/gitpipe/diff_tree.go b/internal/git/gitpipe/diff_tree.go
index c8a7ad654..c450cd806 100644
--- a/internal/git/gitpipe/diff_tree.go
+++ b/internal/git/gitpipe/diff_tree.go
@@ -120,7 +120,7 @@ func DiffTree(
 				skip, err := cfg.skipResult(&result)
 				if err != nil {
 					sendRevisionResult(ctx, resultChan, RevisionResult{
-						err: fmt.Errorf("diff-tree skip: %q", err),
+						err: fmt.Errorf("diff-tree skip: %w", err),
 					})
 					return
 				}
diff --git a/internal/git/gitpipe/diff_tree_test.go b/internal/git/gitpipe/diff_tree_test.go
index fb90b01ac..cdc2dd6c8 100644
--- a/internal/git/gitpipe/diff_tree_test.go
+++ b/internal/git/gitpipe/diff_tree_test.go
@@ -214,7 +214,7 @@ func TestDiffTree(t *testing.T) {
 					return true, errors.New("broken")
 				}),
 			},
-			expectedErr: errors.New(`diff-tree skip: "broken"`),
+			expectedErr: errors.New(`diff-tree skip: broken`),
 		},
 		{
 			desc: "invalid revision",
diff --git a/internal/git/gitpipe/ls_tree.go b/internal/git/gitpipe/ls_tree.go
index eb1535c95..77c971e18 100644
--- a/internal/git/gitpipe/ls_tree.go
+++ b/internal/git/gitpipe/ls_tree.go
@@ -123,7 +123,7 @@ func LsTree(
 				skip, err := cfg.skipResult(&result)
 				if err != nil {
 					sendRevisionResult(ctx, resultChan, RevisionResult{
-						err: fmt.Errorf("ls-tree skip: %q", err),
+						err: fmt.Errorf("ls-tree skip: %w", err),
 					})
 					return
 				}
diff --git a/internal/git/gitpipe/ls_tree_test.go b/internal/git/gitpipe/ls_tree_test.go
index 7ebc10316..297f28aca 100644
--- a/internal/git/gitpipe/ls_tree_test.go
+++ b/internal/git/gitpipe/ls_tree_test.go
@@ -189,7 +189,7 @@ func TestLsTree(t *testing.T) {
 					return true, errors.New("broken")
 				}),
 			},
-			expectedErr: errors.New(`ls-tree skip: "broken"`),
+			expectedErr: errors.New(`ls-tree skip: broken`),
 		},
 		{
 			desc: "invalid revision",
diff --git a/internal/git/localrepo/paths.go b/internal/git/localrepo/paths.go
index daaf48387..a493934cd 100644
--- a/internal/git/localrepo/paths.go
+++ b/internal/git/localrepo/paths.go
@@ -37,14 +37,14 @@ func (repo *Repo) ObjectDirectoryPath() (string, error) {
 	if _, origError := storage.ValidateRelativePath(repoPath, objectDirectoryPath); origError != nil {
 		tempDir, err := repo.locator.TempDir(repo.GetStorageName())
 		if err != nil {
-			return "", structerr.NewInvalidArgument("getting storage's temporary directory: %s", err)
+			return "", structerr.NewInvalidArgument("getting storage's temporary directory: %w", err)
 		}
 
 		expectedQuarantinePrefix := filepath.Join(tempDir, storage.QuarantineDirectoryPrefix(repo))
 		absoluteObjectDirectoryPath := filepath.Join(repoPath, objectDirectoryPath)
 
 		if !strings.HasPrefix(absoluteObjectDirectoryPath, expectedQuarantinePrefix) {
-			return "", structerr.NewInvalidArgument("not a valid relative path: %s", origError)
+			return "", structerr.NewInvalidArgument("not a valid relative path: %w", origError)
 		}
 	}
 
diff --git a/internal/git/localrepo/refs.go b/internal/git/localrepo/refs.go
index 61bc2237a..9d1b76ae8 100644
--- a/internal/git/localrepo/refs.go
+++ b/internal/git/localrepo/refs.go
@@ -133,7 +133,7 @@ func (repo *Repo) getReferences(ctx context.Context, limit uint, patterns ...str
 	}
 
 	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("reading standard input: %v", err)
+		return nil, fmt.Errorf("reading standard input: %w", err)
 	}
 	if err := cmd.Wait(); err != nil {
 		return nil, err
diff --git a/internal/git/objectpool/pool.go b/internal/git/objectpool/pool.go
index 2243a76f7..a4a728729 100644
--- a/internal/git/objectpool/pool.go
+++ b/internal/git/objectpool/pool.go
@@ -196,7 +196,7 @@ func getAlternateObjectDir(repo *localrepo.Repo) (string, error) {
 	r := bufio.NewReader(altFile)
 	b, err := r.ReadBytes('\n')
 	if err != nil && err != io.EOF {
-		return "", fmt.Errorf("reading alternates file: %v", err)
+		return "", fmt.Errorf("reading alternates file: %w", err)
 	}
 
 	if err == nil {
diff --git a/internal/git/packfile/bitmap.go b/internal/git/packfile/bitmap.go
index cadfa3f87..c0b2516fa 100644
--- a/internal/git/packfile/bitmap.go
+++ b/internal/git/packfile/bitmap.go
@@ -94,7 +94,7 @@ func (idx *Index) LoadBitmap() error {
 	}
 
 	if _, err := r.Peek(1); err != io.EOF {
-		return fmt.Errorf("expected EOF, got %v", err)
+		return fmt.Errorf("expected EOF, got %w", err)
 	}
 
 	idx.IndexBitmap = ib
diff --git a/internal/git/pktline/pktline.go b/internal/git/pktline/pktline.go
index 35a2e642b..a82cbf4e4 100644
--- a/internal/git/pktline/pktline.go
+++ b/internal/git/pktline/pktline.go
@@ -117,7 +117,7 @@ func pktLineSplitter(data []byte, atEOF bool) (advance int, token []byte, err er
 	// length prefix of the packet line.
 	pktLength64, err := strconv.ParseInt(string(data[:4]), 16, 0)
 	if err != nil {
-		return 0, nil, fmt.Errorf("pktLineSplitter: decode length: %v", err)
+		return 0, nil, fmt.Errorf("pktLineSplitter: decode length: %w", err)
 	}
 
 	// Cast is safe because we requested an int-size number from strconv.ParseInt
diff --git a/internal/git/rawdiff/rawdiff.go b/internal/git/rawdiff/rawdiff.go
index b2f630287..0c01fb773 100644
--- a/internal/git/rawdiff/rawdiff.go
+++ b/internal/git/rawdiff/rawdiff.go
@@ -72,7 +72,7 @@ func (p *Parser) NextDiff() (*Diff, error) {
 func (p *Parser) readStringChop(delim byte) (string, error) {
 	s, err := p.r.ReadString(delim)
 	if err != nil {
-		return "", fmt.Errorf("read raw diff: %v", err)
+		return "", fmt.Errorf("read raw diff: %w", err)
 	}
 
 	return s[:len(s)-1], nil
diff --git a/internal/git/tree_entry.go b/internal/git/tree_entry.go
index f051ae76e..e9dd5a7b6 100644
--- a/internal/git/tree_entry.go
+++ b/internal/git/tree_entry.go
@@ -14,7 +14,7 @@ func NewTreeEntry(commitOid, rootOid, rootPath string, filename, oidBytes, modeB
 
 	mode, err := strconv.ParseInt(string(modeBytes), 8, 32)
 	if err != nil {
-		return nil, fmt.Errorf("parse mode: %v", err)
+		return nil, fmt.Errorf("parse mode: %w", err)
 	}
 
 	oid := fmt.Sprintf("%02x", oidBytes)
diff --git a/internal/git2go/commit.go b/internal/git2go/commit.go
index 115c354e2..fd14b6d45 100644
--- a/internal/git2go/commit.go
+++ b/internal/git2go/commit.go
@@ -55,7 +55,7 @@ func (err IndexError) Error() string {
 	case ErrFileNotFound:
 		return "A file with this name doesn't exist"
 	case ErrInvalidPath:
-		return fmt.Sprintf("invalid path: '%s'", err.Path)
+		return fmt.Sprintf("invalid path: %q", err.Path)
 	default:
 		panic(fmt.Sprintf("unhandled IndexErrorType: %v", err.Type))
 	}
diff --git a/internal/gitaly/config/config.go b/internal/gitaly/config/config.go
index f99c82999..222081d01 100644
--- a/internal/gitaly/config/config.go
+++ b/internal/gitaly/config/config.go
@@ -275,7 +275,7 @@ func Load(file io.Reader) (Cfg, error) {
 	}
 
 	if err := toml.NewDecoder(file).Decode(&cfg); err != nil {
-		return Cfg{}, fmt.Errorf("load toml: %v", err)
+		return Cfg{}, fmt.Errorf("load toml: %w", err)
 	}
 
 	if err := cfg.setDefaults(); err != nil {
diff --git a/internal/gitaly/config/config_test.go b/internal/gitaly/config/config_test.go
index 154bf5ca5..61575fb59 100644
--- a/internal/gitaly/config/config_test.go
+++ b/internal/gitaly/config/config_test.go
@@ -600,6 +600,7 @@ func TestLoadGracefulRestartTimeout(t *testing.T) {
 func TestGitlabShellDefaults(t *testing.T) {
 	gitlabShellDir := "/dir"
 
+	//nolint:gitaly-linters
 	tmpFile := strings.NewReader(fmt.Sprintf(`[gitlab-shell]
 dir = '%s'`, gitlabShellDir))
 	cfg, err := Load(tmpFile)
diff --git a/internal/gitaly/config/locator.go b/internal/gitaly/config/locator.go
index 89de12990..dca15ef57 100644
--- a/internal/gitaly/config/locator.go
+++ b/internal/gitaly/config/locator.go
@@ -62,9 +62,9 @@ func (l *configLocator) GetPath(repo repository.GitRepo) (string, error) {
 
 	if _, err := os.Stat(storagePath); err != nil {
 		if os.IsNotExist(err) {
-			return "", structerr.NewNotFound("GetPath: does not exist: %v", err)
+			return "", structerr.NewNotFound("GetPath: does not exist: %w", err)
 		}
-		return "", structerr.NewInternal("GetPath: storage path: %v", err)
+		return "", structerr.NewInternal("GetPath: storage path: %w", err)
 	}
 
 	relativePath := repo.GetRelativePath()
@@ -74,7 +74,7 @@ func (l *configLocator) GetPath(repo repository.GitRepo) (string, error) {
 	}
 
 	if _, err := storage.ValidateRelativePath(storagePath, relativePath); err != nil {
-		return "", structerr.NewInvalidArgument("GetRepoPath: %s", err)
+		return "", structerr.NewInvalidArgument("GetRepoPath: %w", err)
 	}
 
 	return filepath.Join(storagePath, relativePath), nil
diff --git a/internal/gitaly/config/locator_test.go b/internal/gitaly/config/locator_test.go
index cee7454d9..5f25de2f3 100644
--- a/internal/gitaly/config/locator_test.go
+++ b/internal/gitaly/config/locator_test.go
@@ -1,9 +1,12 @@
 package config_test
 
 import (
+	"fmt"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
+	"syscall"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -59,9 +62,13 @@ func TestConfigLocator_GetRepoPath(t *testing.T) {
 			expErr: structerr.NewInvalidArgument(`GetStorageByName: no such storage: "invalid"`),
 		},
 		{
-			desc:   "storage doesn't exist on disk",
-			repo:   &gitalypb.Repository{StorageName: cfg.Storages[1].Name, RelativePath: repo.RelativePath},
-			expErr: structerr.NewNotFound(`GetPath: does not exist: stat %s: no such file or directory`, cfg.Storages[1].Path),
+			desc: "storage doesn't exist on disk",
+			repo: &gitalypb.Repository{StorageName: cfg.Storages[1].Name, RelativePath: repo.RelativePath},
+			expErr: structerr.NewNotFound(`GetPath: does not exist: %w`, &fs.PathError{
+				Op:   "stat",
+				Path: cfg.Storages[1].Path,
+				Err:  syscall.ENOENT,
+			}),
 		},
 		{
 			desc:   "relative path is empty",
@@ -81,7 +88,7 @@ func TestConfigLocator_GetRepoPath(t *testing.T) {
 		{
 			desc:   "relative path escapes parent folder",
 			repo:   &gitalypb.Repository{StorageName: storageName, RelativePath: "../.."},
-			expErr: structerr.NewInvalidArgument(`GetRepoPath: relative path escapes root directory`),
+			expErr: structerr.NewInvalidArgument(`GetRepoPath: %w`, fmt.Errorf("relative path escapes root directory")),
 		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
@@ -157,9 +164,13 @@ func TestConfigLocator_GetPath(t *testing.T) {
 			expErr: structerr.NewInvalidArgument(`GetStorageByName: no such storage: "invalid"`),
 		},
 		{
-			desc:   "storage doesn't exist on disk",
-			repo:   &gitalypb.Repository{StorageName: cfg.Storages[1].Name, RelativePath: repo.RelativePath},
-			expErr: structerr.NewNotFound(`GetPath: does not exist: stat %s: no such file or directory`, cfg.Storages[1].Path),
+			desc: "storage doesn't exist on disk",
+			repo: &gitalypb.Repository{StorageName: cfg.Storages[1].Name, RelativePath: repo.RelativePath},
+			expErr: structerr.NewNotFound(`GetPath: does not exist: %w`, &fs.PathError{
+				Op:   "stat",
+				Path: cfg.Storages[1].Path,
+				Err:  syscall.ENOENT,
+			}),
 		},
 		{
 			desc:   "relative path is empty",
@@ -169,7 +180,7 @@ func TestConfigLocator_GetPath(t *testing.T) {
 		{
 			desc:   "relative path escapes parent folder",
 			repo:   &gitalypb.Repository{StorageName: storageName, RelativePath: "../.."},
-			expErr: structerr.NewInvalidArgument(`GetRepoPath: relative path escapes root directory`),
+			expErr: structerr.NewInvalidArgument(`GetRepoPath: %w`, fmt.Errorf("relative path escapes root directory")),
 		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
diff --git a/internal/gitaly/diff/diff.go b/internal/gitaly/diff/diff.go
index 5f9bec941..496e15a0c 100644
--- a/internal/gitaly/diff/diff.go
+++ b/internal/gitaly/diff/diff.go
@@ -150,7 +150,7 @@ func (parser *Parser) Parse() bool {
 			// patchReader will read EOF, but Parser not finished.
 			currentPatchDone = true
 		} else if err != nil {
-			parser.err = fmt.Errorf("peek diff line: %v", err)
+			parser.err = fmt.Errorf("peek diff line: %w", err)
 			return false
 		}
 
@@ -328,7 +328,7 @@ func (parser *Parser) findNextPatchFromPath() error {
 
 	line, err := parser.patchReader.ReadBytes('\n')
 	if err != nil && err != io.EOF {
-		parser.err = fmt.Errorf("read diff header line: %v", err)
+		parser.err = fmt.Errorf("read diff header line: %w", err)
 		return parser.err
 	} else if err == io.EOF {
 		return nil
@@ -370,13 +370,13 @@ func parseRawLine(line []byte, diff *Diff) error {
 
 	mode, err := strconv.ParseInt(string(matches[1]), 8, 0)
 	if err != nil {
-		return fmt.Errorf("raw old mode: %v", err)
+		return fmt.Errorf("raw old mode: %w", err)
 	}
 	diff.OldMode = int32(mode)
 
 	mode, err = strconv.ParseInt(string(matches[2]), 8, 0)
 	if err != nil {
-		return fmt.Errorf("raw new mode: %v", err)
+		return fmt.Errorf("raw new mode: %w", err)
 	}
 	diff.NewMode = int32(mode)
 
@@ -414,7 +414,7 @@ func (parser *Parser) consumeChunkLine(updateLineStats bool) {
 		case bufio.ErrBufferFull:
 			// long line: keep reading
 		default:
-			parser.err = fmt.Errorf("read chunk line: %v", err)
+			parser.err = fmt.Errorf("read chunk line: %w", err)
 			return
 		}
 
@@ -431,7 +431,7 @@ func (parser *Parser) consumeChunkLine(updateLineStats bool) {
 func (parser *Parser) consumeLine(updateStats bool) {
 	line, err := parser.patchReader.ReadBytes('\n')
 	if err != nil && err != io.EOF {
-		parser.err = fmt.Errorf("read line: %v", err)
+		parser.err = fmt.Errorf("read line: %w", err)
 		return
 	}
 
diff --git a/internal/gitaly/diff/numstat.go b/internal/gitaly/diff/numstat.go
index ddb9f9ed8..b261ea201 100644
--- a/internal/gitaly/diff/numstat.go
+++ b/internal/gitaly/diff/numstat.go
@@ -100,7 +100,7 @@ func convertNumStat(num []byte) (int32, error) {
 
 	parsedNum, err := strconv.ParseInt(string(num), 10, 32)
 	if err != nil {
-		return 0, fmt.Errorf("error converting diff num stat: %v", err)
+		return 0, fmt.Errorf("error converting diff num stat: %w", err)
 	}
 
 	return int32(parsedNum), nil
diff --git a/internal/gitaly/hook/postreceive.go b/internal/gitaly/hook/postreceive.go
index 30697700c..be9ab7dc2 100644
--- a/internal/gitaly/hook/postreceive.go
+++ b/internal/gitaly/hook/postreceive.go
@@ -156,11 +156,11 @@ func (m *GitLabHookManager) postReceiveHook(ctx context.Context, payload git.Hoo
 		pushOptions...,
 	)
 	if err != nil {
-		return fmt.Errorf("GitLab: %v", err)
+		return fmt.Errorf("GitLab: %w", err)
 	}
 
 	if err := printMessages(messages, stdout); err != nil {
-		return fmt.Errorf("error writing messages to stream: %v", err)
+		return fmt.Errorf("error writing messages to stream: %w", err)
 	}
 
 	if !ok {
@@ -169,12 +169,12 @@ func (m *GitLabHookManager) postReceiveHook(ctx context.Context, payload git.Hoo
 
 	executor, err := m.newCustomHooksExecutor(repo, "post-receive")
 	if err != nil {
-		return structerr.NewInternal("creating custom hooks executor: %v", err)
+		return structerr.NewInternal("creating custom hooks executor: %w", err)
 	}
 
 	customEnv, err := m.customHooksEnv(ctx, payload, pushOptions, env)
 	if err != nil {
-		return structerr.NewInternal("constructing custom hook environment: %v", err)
+		return structerr.NewInternal("constructing custom hook environment: %w", err)
 	}
 
 	if err = executor(
diff --git a/internal/gitaly/hook/postreceive_test.go b/internal/gitaly/hook/postreceive_test.go
index d498ec0cc..6e62405a4 100644
--- a/internal/gitaly/hook/postreceive_test.go
+++ b/internal/gitaly/hook/postreceive_test.go
@@ -330,7 +330,7 @@ func TestPostReceive_gitlab(t *testing.T) {
 			postreceive: func(t *testing.T, ctx context.Context, glRepo, glID, changes string, pushOptions ...string) (bool, []gitlab.PostReceiveMessage, error) {
 				return false, nil, errors.New("failure")
 			},
-			expectedErr: errors.New("GitLab: failure"),
+			expectedErr: fmt.Errorf("GitLab: %w", fmt.Errorf("failure")),
 		},
 	}
 
@@ -382,7 +382,7 @@ func TestPostReceive_quarantine(t *testing.T) {
 
 	gittest.WriteCustomHook(t, repoPath, "post-receive", []byte(fmt.Sprintf(
 		`#!/bin/sh
-		git cat-file -p '%s' || true
+		git cat-file -p %q || true
 	`, blobID.String())))
 
 	for repo, isQuarantined := range map[*gitalypb.Repository]bool{
diff --git a/internal/gitaly/hook/prereceive.go b/internal/gitaly/hook/prereceive.go
index 34da27b20..df38bda8a 100644
--- a/internal/gitaly/hook/prereceive.go
+++ b/internal/gitaly/hook/prereceive.go
@@ -94,13 +94,13 @@ func (m *GitLabHookManager) PreReceiveHook(ctx context.Context, repo *gitalypb.R
 func (m *GitLabHookManager) preReceiveHook(ctx context.Context, payload git.HooksPayload, repo *gitalypb.Repository, pushOptions, envs []string, changes []byte, stdout, stderr io.Writer) error {
 	repoPath, err := m.locator.GetRepoPath(repo)
 	if err != nil {
-		return structerr.NewInternal("getting repo path: %v", err)
+		return structerr.NewInternal("getting repo path: %w", err)
 	}
 
 	if gitObjDir, gitAltObjDirs := env.ExtractValue(envs, "GIT_OBJECT_DIRECTORY"), env.ExtractValue(envs, "GIT_ALTERNATE_OBJECT_DIRECTORIES"); gitObjDir != "" && gitAltObjDirs != "" {
 		gitObjectDirRel, gitAltObjectDirRel, err := getRelativeObjectDirs(repoPath, gitObjDir, gitAltObjDirs)
 		if err != nil {
-			return structerr.NewInternal("getting relative git object directories: %v", err)
+			return structerr.NewInternal("getting relative git object directories: %w", err)
 		}
 
 		repo.GitObjectDirectory = gitObjectDirRel
@@ -168,7 +168,7 @@ func (m *GitLabHookManager) preReceiveHook(ctx context.Context, payload git.Hook
 
 	customEnv, err := m.customHooksEnv(ctx, payload, pushOptions, envs)
 	if err != nil {
-		return structerr.NewInternal("constructing custom hook environment: %v", err)
+		return structerr.NewInternal("constructing custom hook environment: %w", err)
 	}
 
 	if err = executor(
@@ -185,7 +185,7 @@ func (m *GitLabHookManager) preReceiveHook(ctx context.Context, payload git.Hook
 	// reference counter
 	ok, err := m.gitlabClient.PreReceive(ctx, repo.GetGlRepository())
 	if err != nil {
-		return structerr.NewInternal("calling pre_receive endpoint: %v", err)
+		return structerr.NewInternal("calling pre_receive endpoint: %w", err)
 	}
 
 	if !ok {
diff --git a/internal/gitaly/hook/prereceive_test.go b/internal/gitaly/hook/prereceive_test.go
index 294c15941..4092cbe50 100644
--- a/internal/gitaly/hook/prereceive_test.go
+++ b/internal/gitaly/hook/prereceive_test.go
@@ -196,6 +196,7 @@ func TestPrereceive_quarantine(t *testing.T) {
 		t, gitlab.MockAllowed, gitlab.MockPreReceive, gitlab.MockPostReceive,
 	))
 
+	//nolint:gitaly-linters
 	gittest.WriteCustomHook(t, repoPath, "pre-receive", []byte(fmt.Sprintf(
 		`#!/bin/sh
 		git cat-file -p '%s' || true
@@ -356,7 +357,7 @@ func TestPrereceive_gitlab(t *testing.T) {
 				return false, errors.New("prereceive oops")
 			},
 			expectHookCall: true,
-			expectedErr:    structerr.NewInternal("calling pre_receive endpoint: %v", errors.New("prereceive oops")),
+			expectedErr:    structerr.NewInternal("calling pre_receive endpoint: %w", errors.New("prereceive oops")),
 		},
 	}
 
diff --git a/internal/gitaly/hook/transactions_test.go b/internal/gitaly/hook/transactions_test.go
index e13a89200..76dedac2e 100644
--- a/internal/gitaly/hook/transactions_test.go
+++ b/internal/gitaly/hook/transactions_test.go
@@ -133,7 +133,7 @@ func TestHookManager_contextCancellationCancelsVote(t *testing.T) {
 	mockTxMgr := transaction.MockManager{
 		VoteFn: func(ctx context.Context, _ txinfo.Transaction, _ voting.Vote, _ voting.Phase) error {
 			<-ctx.Done()
-			return fmt.Errorf("mock error: %s", ctx.Err())
+			return fmt.Errorf("mock error: %w", ctx.Err())
 		},
 	}
 
diff --git a/internal/gitaly/hook/update.go b/internal/gitaly/hook/update.go
index 9e49a4bac..5abcb7760 100644
--- a/internal/gitaly/hook/update.go
+++ b/internal/gitaly/hook/update.go
@@ -56,7 +56,7 @@ func (m *GitLabHookManager) updateHook(ctx context.Context, payload git.HooksPay
 
 	customEnv, err := m.customHooksEnv(ctx, payload, nil, env)
 	if err != nil {
-		return structerr.NewInternal("constructing custom hook environment: %v", err)
+		return structerr.NewInternal("constructing custom hook environment: %w", err)
 	}
 
 	if err = executor(
diff --git a/internal/gitaly/hook/update_test.go b/internal/gitaly/hook/update_test.go
index 6c968ea47..d34cb632c 100644
--- a/internal/gitaly/hook/update_test.go
+++ b/internal/gitaly/hook/update_test.go
@@ -227,6 +227,7 @@ func TestUpdate_quarantine(t *testing.T) {
 		t, gitlab.MockAllowed, gitlab.MockPreReceive, gitlab.MockPostReceive,
 	))
 
+	//nolint:gitaly-linters
 	gittest.WriteCustomHook(t, repoPath, "update", []byte(fmt.Sprintf(
 		`#!/bin/sh
 		git cat-file -p '%s' || true
diff --git a/internal/gitaly/linguist/linguist_test.go b/internal/gitaly/linguist/linguist_test.go
index 71ac7f03e..5690ba15d 100644
--- a/internal/gitaly/linguist/linguist_test.go
+++ b/internal/gitaly/linguist/linguist_test.go
@@ -582,7 +582,7 @@ func TestInstance_Stats_failureGitattributes(t *testing.T) {
 	linguist := New(cfg, catfileCache, repo)
 	_, err := linguist.Stats(ctx, commitID.String())
 
-	expectedErr := `linguist object iterator: ls-tree skip: "new file instance: checking attribute:`
+	expectedErr := `linguist object iterator: ls-tree skip: new file instance: checking attribute:`
 	require.ErrorContains(t, err, expectedErr)
 }
 
diff --git a/internal/gitaly/rubyserver/health.go b/internal/gitaly/rubyserver/health.go
index 2802487c5..ed77de1e9 100644
--- a/internal/gitaly/rubyserver/health.go
+++ b/internal/gitaly/rubyserver/health.go
@@ -24,7 +24,7 @@ func ping(address string) error {
 		}),
 	)
 	if err != nil {
-		return fmt.Errorf("failed to connect to gitaly-ruby worker: %v", err)
+		return fmt.Errorf("failed to connect to gitaly-ruby worker: %w", err)
 	}
 	defer conn.Close()
 
diff --git a/internal/gitaly/rubyserver/rubyserver.go b/internal/gitaly/rubyserver/rubyserver.go
index d047f8707..47c6b8096 100644
--- a/internal/gitaly/rubyserver/rubyserver.go
+++ b/internal/gitaly/rubyserver/rubyserver.go
@@ -242,7 +242,7 @@ func (s *Server) createConnection(ctx context.Context) (*grpc.ClientConn, error)
 
 	conn, err := grpc.DialContext(dialCtx, balancer.Scheme+":///gitaly-ruby", dialOptions()...)
 	if err != nil {
-		return nil, fmt.Errorf("failed to connect to gitaly-ruby worker: %v", err)
+		return nil, fmt.Errorf("failed to connect to gitaly-ruby worker: %w", err)
 	}
 
 	s.clientConn = conn
diff --git a/internal/gitaly/server/server.go b/internal/gitaly/server/server.go
index 861140cd8..d1ee729aa 100644
--- a/internal/gitaly/server/server.go
+++ b/internal/gitaly/server/server.go
@@ -89,7 +89,7 @@ func (s *GitalyServerFactory) New(secure bool, opts ...Option) (*grpc.Server, er
 	if secure {
 		cert, err := tls.LoadX509KeyPair(s.cfg.TLS.CertPath, s.cfg.TLS.KeyPath)
 		if err != nil {
-			return nil, fmt.Errorf("error reading certificate and key paths: %v", err)
+			return nil, fmt.Errorf("error reading certificate and key paths: %w", err)
 		}
 
 		transportCredentials = credentials.NewTLS(&tls.Config{
diff --git a/internal/gitaly/service/conflicts/list_conflict_files.go b/internal/gitaly/service/conflicts/list_conflict_files.go
index 59c5cc7b9..f7cf317ac 100644
--- a/internal/gitaly/service/conflicts/list_conflict_files.go
+++ b/internal/gitaly/service/conflicts/list_conflict_files.go
@@ -26,12 +26,12 @@ func (s *server) ListConflictFiles(request *gitalypb.ListConflictFilesRequest, s
 
 	ours, err := repo.ResolveRevision(ctx, git.Revision(request.OurCommitOid+"^{commit}"))
 	if err != nil {
-		return structerr.NewFailedPrecondition("could not lookup 'our' OID: %s", err)
+		return structerr.NewFailedPrecondition("could not lookup 'our' OID: %w", err)
 	}
 
 	theirs, err := repo.ResolveRevision(ctx, git.Revision(request.TheirCommitOid+"^{commit}"))
 	if err != nil {
-		return structerr.NewFailedPrecondition("could not lookup 'their' OID: %s", err)
+		return structerr.NewFailedPrecondition("could not lookup 'their' OID: %w", err)
 	}
 
 	repoPath, err := s.locator.GetPath(request.Repository)
diff --git a/internal/gitaly/service/diff/find_changed_paths.go b/internal/gitaly/service/diff/find_changed_paths.go
index ba6bb4026..29f4c8f6d 100644
--- a/internal/gitaly/service/diff/find_changed_paths.go
+++ b/internal/gitaly/service/diff/find_changed_paths.go
@@ -92,7 +92,7 @@ func parsePaths(reader *bufio.Reader, chunker *chunk.Chunker) error {
 		}
 
 		if err := chunker.Send(path); err != nil {
-			return fmt.Errorf("err sending to chunker: %v", err)
+			return fmt.Errorf("err sending to chunker: %w", err)
 		}
 	}
 
diff --git a/internal/gitaly/service/diff/patch_id_test.go b/internal/gitaly/service/diff/patch_id_test.go
index 1ac3d85fc..386ad45c9 100644
--- a/internal/gitaly/service/diff/patch_id_test.go
+++ b/internal/gitaly/service/diff/patch_id_test.go
@@ -239,6 +239,7 @@ func TestGetPatchID(t *testing.T) {
 						OldRevision: []byte(fmt.Sprintf("%s:file", oldCommit)),
 						NewRevision: []byte(fmt.Sprintf("%s:file", newCommit)),
 					},
+					//nolint:gitaly-linters
 					expectedErr: structerr.New("waiting for git-diff: exit status 128").
 						WithInterceptedMetadata("stderr", fmt.Sprintf("fatal: path 'file' does not exist in '%s'\n", oldCommit)),
 				}
diff --git a/internal/gitaly/service/hook/pack_objects_test.go b/internal/gitaly/service/hook/pack_objects_test.go
index 8d1344983..49deba854 100644
--- a/internal/gitaly/service/hook/pack_objects_test.go
+++ b/internal/gitaly/service/hook/pack_objects_test.go
@@ -754,7 +754,7 @@ func testPackObjectsConcurrency(t *testing.T, ctx context.Context) {
 			testutil.GatherAndCompare(registry,
 				bytes.NewBufferString(fmt.Sprintf(`# HELP gitaly_pack_objects_in_progress Gauge of number of concurrent in-progress calls
 # TYPE gitaly_pack_objects_in_progress gauge
-gitaly_pack_objects_in_progress{type="%s"} 1
+gitaly_pack_objects_in_progress{type=%q} 1
 `, keyType)), "gitaly_pack_objects_in_progress"))
 
 		ticker.Tick()
@@ -770,10 +770,10 @@ gitaly_pack_objects_in_progress{type="%s"} 1
 
 		expectedMetrics := bytes.NewBufferString(fmt.Sprintf(`# HELP gitaly_pack_objects_dropped_total Number of requests dropped from the queue
 # TYPE gitaly_pack_objects_dropped_total counter
-gitaly_pack_objects_dropped_total{reason="max_time", type="%s"} 1
+gitaly_pack_objects_dropped_total{reason="max_time", type=%q} 1
 # HELP gitaly_pack_objects_queued Gauge of number of queued calls
 # TYPE gitaly_pack_objects_queued gauge
-gitaly_pack_objects_queued{type="%s"} 0
+gitaly_pack_objects_queued{type=%q} 0
 `, keyType, keyType))
 
 		require.NoError(t,
diff --git a/internal/gitaly/service/hook/pre_receive_test.go b/internal/gitaly/service/hook/pre_receive_test.go
index 1515618de..14a0289cc 100644
--- a/internal/gitaly/service/hook/pre_receive_test.go
+++ b/internal/gitaly/service/hook/pre_receive_test.go
@@ -335,6 +335,7 @@ func TestPreReceiveHook_CustomHookErrors(t *testing.T) {
 	customHookReturnCode := int32(128)
 	customHookReturnMsg := "custom hook error"
 
+	//nolint:gitaly-linters
 	gittest.WriteCustomHook(t, repoPath, "pre-receive", []byte(fmt.Sprintf(`#!/usr/bin/env bash
 echo '%s' 1>&2
 exit %d
diff --git a/internal/gitaly/service/operations/rebase.go b/internal/gitaly/service/operations/rebase.go
index 2010ed8c0..4c9554dec 100644
--- a/internal/gitaly/service/operations/rebase.go
+++ b/internal/gitaly/service/operations/rebase.go
@@ -121,6 +121,7 @@ func (s *Server) UserRebaseConfirmable(stream gitalypb.OperationService_UserReba
 		var customHookErr updateref.CustomHookError
 		switch {
 		case errors.As(err, &customHookErr):
+			//nolint:gitaly-linters
 			return structerr.NewPermissionDenied("access check: %q", err).WithDetail(
 				&gitalypb.UserRebaseConfirmableError{
 					Error: &gitalypb.UserRebaseConfirmableError_AccessCheck{
diff --git a/internal/gitaly/service/operations/submodules_test.go b/internal/gitaly/service/operations/submodules_test.go
index 88d2306e7..a5aac1610 100644
--- a/internal/gitaly/service/operations/submodules_test.go
+++ b/internal/gitaly/service/operations/submodules_test.go
@@ -55,7 +55,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -85,7 +85,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -115,7 +115,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "foo/sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "foo/sub", subRepoPath),
 					},
 					gittest.TreeEntry{
 						Mode: "040000",
@@ -161,7 +161,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -203,7 +203,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -232,7 +232,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -261,7 +261,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -290,7 +290,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -319,7 +319,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -349,7 +349,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -378,7 +378,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -407,7 +407,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -437,7 +437,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -469,7 +469,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -501,7 +501,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -584,7 +584,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -615,7 +615,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -648,7 +648,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 					gittest.TreeEntry{
 						Mode:    "100644",
 						Path:    ".gitmodules",
-						Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+						Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 					},
 					gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 				))
@@ -684,7 +684,7 @@ func testUserUpdateSubmodule(t *testing.T, ctx context.Context) {
 						gittest.TreeEntry{
 							Mode:    "100644",
 							Path:    ".gitmodules",
-							Content: fmt.Sprintf(`[submodule "%s"]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
+							Content: fmt.Sprintf(`[submodule %q]\n\tpath = %s\n\turl = file://%s`, "sub", "sub", subRepoPath),
 						},
 						gittest.TreeEntry{OID: subCommitID, Mode: "160000", Path: "sub"},
 					),
diff --git a/internal/gitaly/service/repository/fetch_remote_test.go b/internal/gitaly/service/repository/fetch_remote_test.go
index 96dd1f999..3ae37edca 100644
--- a/internal/gitaly/service/repository/fetch_remote_test.go
+++ b/internal/gitaly/service/repository/fetch_remote_test.go
@@ -954,6 +954,7 @@ func TestFetchRemote_sshCommand(t *testing.T) {
 	// We ain't got a nice way to intercept the SSH call, so we just write a custom git command
 	// which simply prints the GIT_SSH_COMMAND environment variable.
 	gitCmdFactory := gittest.NewInterceptingCommandFactory(t, ctx, cfg, func(execEnv git.ExecutionEnvironment) string {
+		//nolint:gitaly-linters
 		return fmt.Sprintf(
 			`#!/usr/bin/env bash
 
diff --git a/internal/gitaly/service/repository/fsck_test.go b/internal/gitaly/service/repository/fsck_test.go
index bbaf8e617..51dd64771 100644
--- a/internal/gitaly/service/repository/fsck_test.go
+++ b/internal/gitaly/service/repository/fsck_test.go
@@ -83,6 +83,7 @@ func TestFsck(t *testing.T) {
 				return setupData{
 					repo: repo,
 					expectedResponse: &gitalypb.FsckResponse{
+						//nolint:gitaly-linters
 						Error: []byte(fmt.Sprintf("fatal: not a git repository: '%s'\n", repoPath)),
 					},
 				}
diff --git a/internal/gitaly/service/repository/license.go b/internal/gitaly/service/repository/license.go
index e91355dfa..cbad970cd 100644
--- a/internal/gitaly/service/repository/license.go
+++ b/internal/gitaly/service/repository/license.go
@@ -60,7 +60,7 @@ func (s *server) FindLicense(ctx context.Context, req *gitalypb.FindLicenseReque
 		if errors.Is(err, git.ErrReferenceNotFound) {
 			return &gitalypb.FindLicenseResponse{}, nil
 		}
-		return nil, structerr.NewInternal("cannot find HEAD revision: %v", err)
+		return nil, structerr.NewInternal("cannot find HEAD revision: %w", err)
 	}
 
 	response, err := s.licenseCache.GetOrCompute(ctx, repo, headOID)
diff --git a/internal/gitaly/service/repository/write_ref.go b/internal/gitaly/service/repository/write_ref.go
index 4bd8aef52..a20644981 100644
--- a/internal/gitaly/service/repository/write_ref.go
+++ b/internal/gitaly/service/repository/write_ref.go
@@ -73,7 +73,7 @@ func updateRef(ctx context.Context, repo *localrepo.Repo, req *gitalypb.WriteRef
 
 	u, err := updateref.New(ctx, repo)
 	if err != nil {
-		return fmt.Errorf("error when running creating new updater: %v", err)
+		return fmt.Errorf("error when running creating new updater: %w", err)
 	}
 	defer func() {
 		if err := u.Close(); err != nil && returnedErr == nil {
@@ -86,11 +86,11 @@ func updateRef(ctx context.Context, repo *localrepo.Repo, req *gitalypb.WriteRef
 	}
 
 	if err = u.Update(git.ReferenceName(req.GetRef()), newObjectID, oldObjectID); err != nil {
-		return fmt.Errorf("error when creating update-ref command: %v", err)
+		return fmt.Errorf("error when creating update-ref command: %w", err)
 	}
 
 	if err = u.Commit(); err != nil {
-		return fmt.Errorf("error when running update-ref command: %v", err)
+		return fmt.Errorf("error when running update-ref command: %w", err)
 	}
 
 	return nil
@@ -101,14 +101,14 @@ func validateWriteRefRequest(req *gitalypb.WriteRefRequest) error {
 		return err
 	}
 	if err := git.ValidateRevision(req.Ref); err != nil {
-		return fmt.Errorf("invalid ref: %v", err)
+		return fmt.Errorf("invalid ref: %w", err)
 	}
 	if err := git.ValidateRevision(req.Revision); err != nil {
-		return fmt.Errorf("invalid revision: %v", err)
+		return fmt.Errorf("invalid revision: %w", err)
 	}
 	if len(req.OldRevision) > 0 {
 		if err := git.ValidateRevision(req.OldRevision); err != nil {
-			return fmt.Errorf("invalid OldRevision: %v", err)
+			return fmt.Errorf("invalid OldRevision: %w", err)
 		}
 	}
 
diff --git a/internal/gitaly/service/smarthttp/upload_pack_test.go b/internal/gitaly/service/smarthttp/upload_pack_test.go
index a53da2294..28a35c517 100644
--- a/internal/gitaly/service/smarthttp/upload_pack_test.go
+++ b/internal/gitaly/service/smarthttp/upload_pack_test.go
@@ -234,6 +234,7 @@ func testServerPostUploadPackUsesPackObjectsHook(t *testing.T, ctx context.Conte
 	cfg.BinDir = testhelper.TempDir(t)
 
 	outputPath := filepath.Join(cfg.BinDir, "output")
+	//nolint:gitaly-linters
 	hookScript := fmt.Sprintf("#!/bin/sh\necho 'I was invoked' >'%s'\nshift\nexec git \"$@\"\n", outputPath)
 
 	// We're using a custom pack-objects hook for git-upload-pack. In order
diff --git a/internal/gitaly/service/ssh/upload_pack_test.go b/internal/gitaly/service/ssh/upload_pack_test.go
index 900e05d62..cde448dda 100644
--- a/internal/gitaly/service/ssh/upload_pack_test.go
+++ b/internal/gitaly/service/ssh/upload_pack_test.go
@@ -662,6 +662,7 @@ func TestUploadPack_packObjectsHook(t *testing.T) {
 	// custom script which replaces the hook binary. It doesn't do anything
 	// special, but writes an error message and errors out and should thus
 	// cause the clone to fail with this error message.
+	//nolint:gitaly-linters
 	testhelper.WriteExecutable(t, cfg.BinaryPath("gitaly-hooks"), []byte(fmt.Sprintf(
 		`#!/usr/bin/env bash
 		set -eo pipefail
diff --git a/internal/gitaly/storage/servers.go b/internal/gitaly/storage/servers.go
index 68f710286..69ba1bb54 100644
--- a/internal/gitaly/storage/servers.go
+++ b/internal/gitaly/storage/servers.go
@@ -103,11 +103,11 @@ func InjectGitalyServersEnv(ctx context.Context) (context.Context, error) {
 func unmarshalGitalyServers(encoded string, servers *GitalyServers) error {
 	gitalyServersJSON, err := base64.StdEncoding.DecodeString(encoded)
 	if err != nil {
-		return fmt.Errorf("failed decoding base64: %v", err)
+		return fmt.Errorf("failed decoding base64: %w", err)
 	}
 
 	if err := json.Unmarshal(gitalyServersJSON, servers); err != nil {
-		return fmt.Errorf("failed unmarshalling json: %v", err)
+		return fmt.Errorf("failed unmarshalling json: %w", err)
 	}
 
 	return nil
diff --git a/internal/gitlab/client/httpclient.go b/internal/gitlab/client/httpclient.go
index 9333d4881..b15643f4a 100644
--- a/internal/gitlab/client/httpclient.go
+++ b/internal/gitlab/client/httpclient.go
@@ -60,7 +60,7 @@ func validateCaFile(filename string) error {
 
 	if _, err := os.Stat(filename); err != nil {
 		if os.IsNotExist(err) {
-			return fmt.Errorf("cannot find cafile '%s': %w", filename, ErrCafileNotFound)
+			return fmt.Errorf("cannot find cafile %q: %w", filename, ErrCafileNotFound)
 		}
 
 		return err
diff --git a/internal/gitlab/http_client.go b/internal/gitlab/http_client.go
index 2f02a3d3f..77599cb18 100644
--- a/internal/gitlab/http_client.go
+++ b/internal/gitlab/http_client.go
@@ -128,7 +128,7 @@ func (a *allowedRequest) parseAndSetGLID(glID string) error {
 	}
 
 	if !glIDRegex.MatchString(value) {
-		return fmt.Errorf("gl_id='%s' is invalid", glID)
+		return fmt.Errorf("gl_id=%q is invalid", glID)
 	}
 
 	return nil
diff --git a/internal/middleware/statushandler/statushandler.go b/internal/middleware/statushandler/statushandler.go
index ebec2b478..063389287 100644
--- a/internal/middleware/statushandler/statushandler.go
+++ b/internal/middleware/statushandler/statushandler.go
@@ -32,9 +32,9 @@ func wrapCtxErr(ctx context.Context, err error) error {
 	case err == nil:
 		return nil
 	case ctx.Err() == context.DeadlineExceeded:
-		return structerr.NewDeadlineExceeded("%v", err)
+		return structerr.NewDeadlineExceeded("%w", err)
 	case ctx.Err() == context.Canceled:
-		return structerr.NewCanceled("%v", err)
+		return structerr.NewCanceled("%w", err)
 	default:
 		return structerr.NewInternal("%w", err)
 	}
diff --git a/internal/praefect/datastore/listener_test.go b/internal/praefect/datastore/listener_test.go
index 38db2a1a4..dae8c52ab 100644
--- a/internal/praefect/datastore/listener_test.go
+++ b/internal/praefect/datastore/listener_test.go
@@ -51,6 +51,7 @@ func TestListener_Listen(t *testing.T) {
 	notifyListener := func(t *testing.T, channels []string, payload string) {
 		t.Helper()
 		for _, channel := range channels {
+			//nolint:gitaly-linters
 			_, err := db.Exec(fmt.Sprintf(`NOTIFY %s, '%s'`, channel, payload))
 			assert.NoError(t, err)
 		}
diff --git a/internal/praefect/datastore/postgres.go b/internal/praefect/datastore/postgres.go
index dc393c260..514226cf8 100644
--- a/internal/praefect/datastore/postgres.go
+++ b/internal/praefect/datastore/postgres.go
@@ -29,7 +29,7 @@ func CheckPostgresVersion(db *sql.DB) error {
 
 	var serverVersion int
 	if err := db.QueryRowContext(ctx, "SHOW server_version_num").Scan(&serverVersion); err != nil {
-		return fmt.Errorf("get postgres server version: %v", err)
+		return fmt.Errorf("get postgres server version: %w", err)
 	}
 
 	// The minimum required Postgres server version is v11.0.
@@ -50,7 +50,7 @@ func MigrateDownPlan(conf config.Config, max int) ([]string, error) {
 	defer cancel()
 	db, err := glsql.OpenDB(openDBCtx, conf.DB)
 	if err != nil {
-		return nil, fmt.Errorf("sql open: %v", err)
+		return nil, fmt.Errorf("sql open: %w", err)
 	}
 	defer db.Close()
 
@@ -79,7 +79,7 @@ func MigrateDown(conf config.Config, max int) (int, error) {
 	defer cancel()
 	db, err := glsql.OpenDB(openDBCtx, conf.DB)
 	if err != nil {
-		return 0, fmt.Errorf("sql open: %v", err)
+		return 0, fmt.Errorf("sql open: %w", err)
 	}
 	defer db.Close()
 
@@ -99,7 +99,7 @@ func MigrateStatus(conf config.Config) (map[string]*MigrationStatusRow, error) {
 	defer cancel()
 	db, err := glsql.OpenDB(openDBCtx, conf.DB)
 	if err != nil {
-		return nil, fmt.Errorf("sql open: %v", err)
+		return nil, fmt.Errorf("sql open: %w", err)
 	}
 	defer db.Close()
 
diff --git a/internal/praefect/middleware/errorhandler.go b/internal/praefect/middleware/errorhandler.go
index e609d5313..722a74753 100644
--- a/internal/praefect/middleware/errorhandler.go
+++ b/internal/praefect/middleware/errorhandler.go
@@ -17,6 +17,7 @@ func StreamErrorHandler(registry *protoregistry.Registry, errorTracker tracker.E
 
 		mi, lookupErr := registry.LookupMethod(method)
 		if err != nil {
+			//nolint:gitaly-linters
 			return nil, fmt.Errorf("error when looking up method: %w %v", err, lookupErr)
 		}
 
diff --git a/internal/praefect/protoregistry/find_oid.go b/internal/praefect/protoregistry/find_oid.go
index 3f29358fa..8ce91c0dd 100644
--- a/internal/praefect/protoregistry/find_oid.go
+++ b/internal/praefect/protoregistry/find_oid.go
@@ -74,7 +74,7 @@ func reflectFindOID(pbMsg proto.Message, targetOID []int) (reflect.Value, error)
 		msgV, err = findProtoField(msgV, fieldNo)
 		if err != nil {
 			return reflect.Value{}, fmt.Errorf(
-				"unable to descend OID %+v into message %s: %v",
+				"unable to descend OID %+v into message %s: %w",
 				targetOID, proto.MessageName(pbMsg), err,
 			)
 		}
diff --git a/internal/praefect/rename_repository.go b/internal/praefect/rename_repository.go
index 9e48337cc..6dc8c7030 100644
--- a/internal/praefect/rename_repository.go
+++ b/internal/praefect/rename_repository.go
@@ -30,7 +30,7 @@ func validateRenameRepositoryRequest(req *gitalypb.RenameRepositoryRequest, virt
 		// seeing whether the relative path escapes the root directory. It's not possible to traverse up
 		// from the /, so the traversals in the path wouldn't be caught. To allow for the check to work,
 		// we use the /fake-root directory simply to notice if there were traversals in the path.
-		return structerr.NewInvalidArgument("GetRepoPath: %s", err)
+		return structerr.NewInvalidArgument("GetRepoPath: %w", err)
 	}
 
 	return nil
diff --git a/internal/praefect/service/info/repositories.go b/internal/praefect/service/info/repositories.go
index 1d8f7def0..8e09eaba7 100644
--- a/internal/praefect/service/info/repositories.go
+++ b/internal/praefect/service/info/repositories.go
@@ -17,7 +17,7 @@ func (s *Server) RepositoryReplicas(ctx context.Context, in *gitalypb.Repository
 
 	repositoryID, err := s.rs.GetRepositoryID(ctx, virtualStorage, relativePath)
 	if err != nil {
-		return nil, fmt.Errorf("get repository id: %q", err)
+		return nil, fmt.Errorf("get repository id: %w", err)
 	}
 
 	primary, err := s.primaryGetter.GetPrimary(ctx, virtualStorage, repositoryID)
diff --git a/internal/praefect/service/transaction/server.go b/internal/praefect/service/transaction/server.go
index f4b2baec5..8752fd52f 100644
--- a/internal/praefect/service/transaction/server.go
+++ b/internal/praefect/service/transaction/server.go
@@ -29,7 +29,7 @@ func NewServer(txMgr *transactions.Manager) gitalypb.RefTransactionServer {
 func (s *Server) VoteTransaction(ctx context.Context, in *gitalypb.VoteTransactionRequest) (*gitalypb.VoteTransactionResponse, error) {
 	vote, err := voting.VoteFromHash(in.GetReferenceUpdatesHash())
 	if err != nil {
-		return nil, structerr.NewInvalidArgument("invalid reference update hash: %v", err)
+		return nil, structerr.NewInvalidArgument("invalid reference update hash: %w", err)
 	}
 
 	if err := s.txMgr.VoteTransaction(ctx, in.TransactionId, in.Node, vote); err != nil {
diff --git a/internal/safe/file_writer.go b/internal/safe/file_writer.go
index 0a2f1eb12..76ab0bcc2 100644
--- a/internal/safe/file_writer.go
+++ b/internal/safe/file_writer.go
@@ -71,22 +71,22 @@ func (fw *FileWriter) Commit() error {
 
 	fw.commitOrClose.Do(func() {
 		if err = fw.tmpFile.Sync(); err != nil {
-			err = fmt.Errorf("syncing temp file: %v", err)
+			err = fmt.Errorf("syncing temp file: %w", err)
 			return
 		}
 
 		if err = fw.tmpFile.Close(); err != nil {
-			err = fmt.Errorf("closing temp file: %v", err)
+			err = fmt.Errorf("closing temp file: %w", err)
 			return
 		}
 
 		if err = fw.rename(); err != nil {
-			err = fmt.Errorf("renaming temp file: %v", err)
+			err = fmt.Errorf("renaming temp file: %w", err)
 			return
 		}
 
 		if err = fw.syncDir(); err != nil {
-			err = fmt.Errorf("syncing dir: %v", err)
+			err = fmt.Errorf("syncing dir: %w", err)
 			return
 		}
 	})
diff --git a/internal/stream/std_stream.go b/internal/stream/std_stream.go
index b807a0118..d6e277c19 100644
--- a/internal/stream/std_stream.go
+++ b/internal/stream/std_stream.go
@@ -62,7 +62,7 @@ func Handler(recv func() (StdoutStderrResponse, error), send func(chan error), s
 	case errSend := <-errC:
 		if errSend != nil {
 			// This should not happen
-			errSend = fmt.Errorf("stdin send error: %v", errSend)
+			errSend = fmt.Errorf("stdin send error: %w", errSend)
 		}
 		return exitStatus, errSend
 	default:
diff --git a/internal/testhelper/leakage.go b/internal/testhelper/leakage.go
index 5dc9cae20..0b78353f7 100644
--- a/internal/testhelper/leakage.go
+++ b/internal/testhelper/leakage.go
@@ -92,6 +92,7 @@ func mustFindNoRunningChildProcess() error {
 
 	exitError, ok := err.(*exec.ExitError)
 	if !ok {
+		//nolint:gitaly-linters
 		return fmt.Errorf("expected ExitError, got %T", err)
 	}
 
diff --git a/tools/golangci-lint/gitaly/lint.go b/tools/golangci-lint/gitaly/lint.go
index 23f99e6aa..1d76a9400 100644
--- a/tools/golangci-lint/gitaly/lint.go
+++ b/tools/golangci-lint/gitaly/lint.go
@@ -19,7 +19,7 @@ func (p *analyzerPlugin) GetAnalyzers() []*analysis.Analyzer {
 		}),
 		newErrorWrapAnalyzer(&errorWrapAnalyzerSettings{
 			IncludedFunctions: p.configStringSlicesAt(
-				quoteInterpolationAnalyzerName,
+				errorWrapAnalyzerName,
 				"included-functions",
 			),
 		}),
diff --git a/tools/module-updater/main.go b/tools/module-updater/main.go
index d8cfbda1e..608980d4c 100644
--- a/tools/module-updater/main.go
+++ b/tools/module-updater/main.go
@@ -65,15 +65,15 @@ func changeModuleVersion() error {
 	}
 
 	if err := rewriteImports(moduleAbsRootPath, prev, next); err != nil {
-		return fmt.Errorf("re-write go imports: %s", err)
+		return fmt.Errorf("re-write go imports: %w", err)
 	}
 
 	if err := rewriteProto(moduleAbsRootPath, prev, next); err != nil {
-		return fmt.Errorf("re-write .proto files: %s", err)
+		return fmt.Errorf("re-write .proto files: %w", err)
 	}
 
 	if err := rewriteGoMod(moduleAbsRootPath, next); err != nil {
-		return fmt.Errorf("re-write go.mod file: %s", err)
+		return fmt.Errorf("re-write go.mod file: %w", err)
 	}
 
 	return nil
diff --git a/tools/protoc-gen-gitaly-lint/main.go b/tools/protoc-gen-gitaly-lint/main.go
index 9a1a610c8..25e63527b 100644
--- a/tools/protoc-gen-gitaly-lint/main.go
+++ b/tools/protoc-gen-gitaly-lint/main.go
@@ -96,12 +96,12 @@ func lintProtos(req *pluginpb.CodeGeneratorRequest) error {
 	// Send back the results.
 	data, err := proto.Marshal(resp)
 	if err != nil {
-		return fmt.Errorf("failed to marshal output proto: %s", err)
+		return fmt.Errorf("failed to marshal output proto: %w", err)
 	}
 
 	_, err = os.Stdout.Write(data)
 	if err != nil {
-		return fmt.Errorf("failed to write output proto: %s", err)
+		return fmt.Errorf("failed to write output proto: %w", err)
 	}
 	return nil
 }
diff --git a/tools/protoc-gen-gitaly-protolist/main.go b/tools/protoc-gen-gitaly-protolist/main.go
index c05facdae..d85c74acd 100644
--- a/tools/protoc-gen-gitaly-protolist/main.go
+++ b/tools/protoc-gen-gitaly-protolist/main.go
@@ -77,28 +77,28 @@ func generateProtolistGo(req *pluginpb.CodeGeneratorRequest) error {
 	var protoNames []string
 
 	if gitalyProtoDir, err = filepath.Abs(gitalyProtoDir); err != nil {
-		return fmt.Errorf("failed to get absolute path for %s: %v", gitalyProtoDir, err)
+		return fmt.Errorf("failed to get absolute path for %s: %w", gitalyProtoDir, err)
 	}
 
 	files, err := os.ReadDir(gitalyProtoDir)
 	if err != nil {
-		return fmt.Errorf("failed to read %s: %v", gitalyProtoDir, err)
+		return fmt.Errorf("failed to read %s: %w", gitalyProtoDir, err)
 	}
 
 	for _, fi := range files {
 		if !fi.IsDir() && strings.HasSuffix(fi.Name(), ".proto") {
-			protoNames = append(protoNames, fmt.Sprintf(`"%s"`, fi.Name()))
+			protoNames = append(protoNames, fmt.Sprintf(`%q`, fi.Name()))
 		}
 	}
 
 	f, err := os.Create(filepath.Join(gitalypbDir, "protolist.go"))
 	if err != nil {
-		return fmt.Errorf("could not create protolist.go: %v", err)
+		return fmt.Errorf("could not create protolist.go: %w", err)
 	}
 	defer f.Close()
 
 	if err = renderProtoList(f, protoNames); err != nil {
-		return fmt.Errorf("could not render go code: %v", err)
+		return fmt.Errorf("could not render go code: %w", err)
 	}
 
 	return nil
@@ -117,22 +117,22 @@ func renderProtoList(dest io.WriteCloser, protoNames []string) error {
 	`
 	protoListTempl, err := template.New("protoList").Funcs(joinFunc).Parse(protoList)
 	if err != nil {
-		return fmt.Errorf("could not create go code template: %v", err)
+		return fmt.Errorf("could not create go code template: %w", err)
 	}
 
 	var rawGo bytes.Buffer
 
 	if err := protoListTempl.Execute(&rawGo, protoNames); err != nil {
-		return fmt.Errorf("could not execute go code template: %v", err)
+		return fmt.Errorf("could not execute go code template: %w", err)
 	}
 
 	formattedGo, err := format.Source(rawGo.Bytes())
 	if err != nil {
-		return fmt.Errorf("could not format go code: %v", err)
+		return fmt.Errorf("could not format go code: %w", err)
 	}
 
 	if _, err = io.Copy(dest, bytes.NewBuffer(formattedGo)); err != nil {
-		return fmt.Errorf("failed to write protolist.go file: %v", err)
+		return fmt.Errorf("failed to write protolist.go file: %w", err)
 	}
 
 	return nil