Scope candidate blob readers to validation

internal/validation/validation.go

@@ -63,7 +63,7 @@ func (request Request) ReadCandidateTree(ctx context.Context) (*CandidateTree, e
 }
 
 // Run executes shared validation for the captured candidate.
-func Run(ctx context.Context, request Request) error {
+func Run(ctx context.Context, request Request) (result error) {
 	if request.Settings.FileSize != nil && request.Settings.FileSize.LimitBytes != nil && *request.Settings.FileSize.LimitBytes < 0 {
 		return &Failure{
 			Check:    FileSize,
@@ -136,7 +136,17 @@ func Run(ctx context.Context, request Request) error {
 			}
 			return &Failure{Check: check, Cause: err}
 		}
+		lastContentCheck := Check("")
+		defer func() {
+			if closeErr := tree.Close(); closeErr != nil && result == nil && lastContentCheck != "" {
+				result = &Failure{
+					Check: lastContentCheck,
+					Cause: fmt.Errorf("close candidate Git blob reader: %w", closeErr),
+				}
+			}
+		}()
 		if request.Settings.GoFormat {
+			lastContentCheck = GoFormat
 			if err := checkGoFormat(ctx, tree); err != nil {
 				return err
 			}
@@ -147,6 +157,7 @@ func Run(ctx context.Context, request Request) error {
 			}
 		}
 		if request.Settings.ModuleDistribution.LocalReplacements {
+			lastContentCheck = LocalReplacements
 			if err := checkLocalReplacements(ctx, tree); err != nil {
 				return err
 			}
@@ -157,6 +168,7 @@ func Run(ctx context.Context, request Request) error {
 			}
 		}
 		if request.Settings.Markdown != nil {
+			lastContentCheck = MarkdownLinks
 			if err := checkMarkdownLinks(ctx, tree, request.Settings.Markdown.EnforceCheckoutBoundary, request.Output); err != nil {
 				return err
 			}