pkg/cli/process_env_lookup.go already provides a lookupEnv(key string) string helper that routes through an overrideable processEnvLookup function (set to os.LookupEnv in production but swappable in tests). Two files in pkg/cli already use it (add_interactive_engine.go, outcomes_command.go).

Of the 32 nolint additions in pkg/cli, most could be replaced by calling lookupEnv(...) instead of os.Getenv(...) — no nolint needed, and tests gain env-override capability for free.

Suggested follow-up: replace os.Getenv → lookupEnv across pkg/cli and retire the nolint comments there. pkg/workflow and the other packages that already use suppression are fine as-is.

The pkg/cli package already has an injectable lookupEnv wrapper in process_env_lookup.go that routes through the overrideable processEnvLookup function — exactly the pattern intended to decouple this package from the process environment.

Using lookupEnv(req.Name) (and the equivalent at the other 31 os.Getenv call sites in pkg/cli) would fix the lint correctly and preserve test-time env injectability, rather than permanently suppressing the finding:

// Instead of:
envValu…

</details>

<details><summary>pkg/workflow/process_env_lookup.go:4</summary>

This wrapper suppresses the lint on the single `os.LookupEnv` call inside the package — but notice that `pkg/workflow/compilerenv/manager.go` lines 29 and 37 still pass `os.Getenv` as a function reference (not a call, so the analyzer does not flag them). `pkg/workflow/action_mode.go:73` similarly passes `os.Getenv` as a first-class function.

These are architecturally sound (they inject `os.Getenv` via the `EnvGetter` abstraction rather than calling it directly), so no suppression is needed the…

</details>

Key Themes

• Wrapper bypass: IsRunningInCI() and isRunningInCodespace() already abstract the same env-var checks being suppressed in add_interactive_orchestrator.go, add_wizard_command.go, interactive.go, and add_interactive_workflow.go. Routing through those wrappers removes the suppressions and keeps detection logic in one place.
• Bulk suppression approach: For the remaining 31 sites (secrets, host detection, MCP context, shell detection, update-check), the inline //nolint approach is the right pattern — it follows the established convention, is call-site-scoped (not file-wide), and is easy to audit. ✅
• process_env_lookup.go: Correctly the designated abstraction point for env reads in pkg/workflow. ✅

Positive Highlights

• ✅ Call-site (not file-wide) suppressions — easy to audit and grep
• ✅ Consistent with the existing pattern in pkg/constants, pkg/logger, pkg/envutil, etc.
• ✅ No behavior changes — purely lint compliance

1. 32 suppressions in pkg/cli defeat the testability seam (high)

Every suppressed os.Getenv call permanently bypasses processEnvLookup. Tests that override env behavior through that seam will silently miss all 32 sites. The fix is one line per site: replace os.Getenv(x) with lookupEnv(x) — no new abstraction needed.

2. Security-sensitive reads in engine_secrets.go bypass the wrapper (high)

The five os.Getenv calls reading secret names and token values are now hardwired to the real process environment. Tests asserting secret-resolution behavior must mutate the live process env, risking parallel-test interference and accidental token exposure in CI logs.

3. pkg/workflow/process_env_lookup.go suppression is correct — that is the designated wrapper file; the nolint there is appropriate.

Recommended action: Revert the 32 pkg/cli nolint annotations and replace each os.Getenv(x) call with lookupEnv(x). The single nolint on pkg/workflow/process_env_lookup.go can stay.

All 5 secret env reads bypass the injectable lookupEnv() wrapper and cannot be overridden in tests.

<details>
<summary>💡 Suggested fix</summary>

pkg/cli already has process_env_lookup.go with a mutex-protected lookupEnv(key string) string wrapper and an injectable processEnvLookup function variable — designed exactly for this. Instead of suppressing the lint diagnostic, use the wrapper:

// Before (suppressed with nolint)
envValue := os.Getenv(req.Name) (nolint/redacted):…

</details>

<details><summary>pkg/workflow/process_env_lookup.go:341</summary>

**The nolint suppression on `pkg/workflow/process_env_lookup.go` is correct, but the 32 suppressions added to `pkg/cli` files are the wrong fix** — `pkg/cli` already has its own `lookupEnv()` wrapper with an injectable `processEnvLookup` variable.

&lt;details&gt;
&lt;summary&gt;💡 Why this matters&lt;/summary&gt;

`pkg/cli/process_env_lookup.go` defines:

```go
var (
    processEnvLookupMu sync.RWMutex
    processEnvLookup   envLookupFunc = os.LookupEnv
)

func lookupEnv(key string) string { ... }

This inj…

IsRunningInCI() reads env vars directly and cannot be faked in tests without t.Setenv clobber — should use lookupEnv().

<details>
<summary>💡 Suggested fix</summary>

// Before
if os.Getenv(v) != "" { (nolint/redacted):osgetenvlibrary

// After
if lookupEnv(v) != "" {

lookupEnv() is already present in pkg/cli/process_env_lookup.go and routes through the injectable processEnvLookup function — meaning tests can swap out env behavior without mutating the real process en…