backend/.golangci.yml declared version: "2" on line 1 but used the
golangci-lint v1 schema below it: a top-level linters-settings key and
an issues.exclude-use-default key that does not exist in v2. Under v2
that config does not validate, so every threshold in it was inert --
lll fell back to its 120-column default rather than the intended 88,
and funlen, cyclop and dupl were not applied at all. The `0 issues.`
result the repo has been relying on was therefore meaningless.
Replace it with the org-standard file verbatim (sha256
021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb) and
move the lint stage of Dockerfile.backend from golangci-lint v2.7.2 to
the org-standard v2.12.2 by repinning the golangci/golangci-lint image
digest:
sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240
The digest was resolved from the v2.12.2 tag and verified by running
the linter out of that exact image, which reports "golangci-lint has
version 2.12.2 built with go1.26.2 from c0d3ddc9 on
2026-05-06T11:07:58Z".
Guard against the config drifting from the standard again by asserting
its sha256 as the first step of the backend lint target. The check is a
local hash comparison against a constant in the Makefile: it needs no
network, fetches nothing, and adds no unpinned external reference to
the build path. It also catches a strictly larger class of breakage
than schema validation would, since a schema-valid but non-canonical
config is exactly how this file got into its broken state.
With the config actually loading, lll reports server.go:65 at 93
columns. Fix it, plus the two other over-long lines called out on the
issue (server.go:97 at 81 and reportbuf.go:166 at 88) which are inside
the 88-column lint limit but over the 77-column hard wrap in the Go
styleguide. All three were long //nolint justifications on the code
line; move the justification into a preceding comment block and leave
a short directive behind. No suppression is added or widened, and
.golangci.yml is not touched after the copy.
Drop the //nolint:wsl in server.go entirely rather than relocating it.
The standard config disables wsl, so the directive suppressed nothing;
removing it still yields `0 issues.`
Verified: `docker build --no-cache -f Dockerfile.backend .` is green,
with the lint stage running uncached for 14.9s and reporting
`0 issues.` -- the first proof that v2.12.2 and the canonical config
pass together through the multistage lint stage. Root `make check` and
`cd backend && make check` both pass. The drift guard's failure path
was re-proved inside the lint image: appending a byte to
.golangci.yml fails `make lint` at 0.17s with the expected and actual
hashes, before golangci-lint runs at all.
golangci-lint v2.12.2 emits a deprecation warning for the gomodguard
linter the standard config enables. It is a warning, not a failure,
and the config is not editable here; it is tracked separately.
Place the backend Dockerfile at repo root as Dockerfile.backend so
the build context includes .git, giving git describe access for
version stamping. Fix .gitignore pattern to anchor /netwatch-server
so it does not exclude cmd/netwatch-server/. Remove .git from
.dockerignore. Update CI workflow and backend Makefile docker target.
