Error messages with % in them print garbled (%2F shows as %!F(MISSING)) #1279

What goes wrong

When a command fails, the CLI prints the error through logger.Error(err.Error()) in cmd/kosli/main.go. logger.Error works like printf: its first argument is a format string. So any % in the error text is read as a formatting instruction.

A URL-encoded slash (%2F) prints as %!F(MISSING). For example, kosli attest sonar --sonar-branch feature/x against a SonarQube server it can't reach prints:

Get "...branch=feature%!F(MISSING)x...": dial tcp ... connection refused

The request itself is encoded correctly. Only the printed message is wrong. Seen on v2.48.0 and still on main.

Why it matters

A customer engineer read this as the CLI encoding slashes wrongly and pinned their pipeline back to an older Sonar recorder. The real failure was a connection error. The garbled text sent them the wrong way.

Why vet didn't catch it

go vet rejects a non-constant format string, but only for functions it knows are printf-style. Every logger method rewrote format before using it, so vet couldn't tell. Once the methods pass format straight to fmt.Sprintf, vet flags 18 call sites like this one, plus three Azure debug lines that pass values with no %s.

Fix

Pass message text as an argument (logger.Error("%s", err.Error())), and make the logger methods visible to vet so CI's golangci-lint stops this coming back.