Update golangci-lint to v2.12.2 with canonical config #187

2026-08-07T19:17:16+02:00

clawbot commented

2026-08-07 19:17:16 +02:00

Bumps golangci-lint from v2.10.1 to v2.12.2 everywhere it is pinned and installs the canonical .golangci.yml, then fixes every finding the new linter surfaces so make check is green.

Version pins

Dockerfile lint stage: golangci/golangci-lint:v2.12.2 (Debian-based), tag plus digest pin
script/bootstrap: GOLANGCI_LINT_VERSION=2.12.2 with updated linux-amd64/linux-arm64 release-archive sha256 pins

Config

.golangci.yml replaced with the canonical config. Material change: the old file declared version: "2" but kept settings under the legacy top-level linters-settings key, which golangci-lint v2 ignores — so the intended thresholds (lll 88, funlen 80/50, cyclop 15, dupl 100) were not being applied. The canonical file moves them under linters.settings and drops issues.exclude-use-default.

Lint fixes (216 findings)

lll (96): wrapped lines to the 88-column limit
noctx (46): httptest.NewRequestWithContext with t.Context() throughout the tests
goconst (24): shared constants for template/JSON keys in internal/handlers and repeated test literals
gosec (23): app-page redirects now go through a redirectToApp helper that path-escapes the app ID (G710 open redirect); http.ServeFile of the internally derived deployment log path annotated like the adjacent os.Stat (G703)
dupl (22): extracted a generic findAllByAppID in internal/models, a deleteAppResource helper in internal/handlers, a shared parsePush in internal/service/webhook, and table-driven/helper-based dedup in tests
nolintlint (5): removed //nolint:funlen directives made obsolete by the new limits (plus one more that became obsolete after refactoring)
nilerr (3, surfaced during fixing): resource-delete lookups now propagate the find error to the caller

No behavior changes intended; all tests pass and make check is green.

Note: golangci-lint v2.12 warns that gomodguard is deprecated in favor of gomodguard_v2 — a future canonical-config update should address this centrally.

Bumps golangci-lint from v2.10.1 to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then fixes every finding the new linter surfaces so `make check` is green. ## Version pins - `Dockerfile` lint stage: `golangci/golangci-lint:v2.12.2` (Debian-based), tag plus digest pin - `script/bootstrap`: `GOLANGCI_LINT_VERSION=2.12.2` with updated `linux-amd64`/`linux-arm64` release-archive sha256 pins ## Config `.golangci.yml` replaced with the canonical config. Material change: the old file declared `version: "2"` but kept settings under the legacy top-level `linters-settings` key, which golangci-lint v2 ignores — so the intended thresholds (`lll` 88, `funlen` 80/50, `cyclop` 15, `dupl` 100) were not being applied. The canonical file moves them under `linters.settings` and drops `issues.exclude-use-default`. ## Lint fixes (216 findings) - `lll` (96): wrapped lines to the 88-column limit - `noctx` (46): `httptest.NewRequestWithContext` with `t.Context()` throughout the tests - `goconst` (24): shared constants for template/JSON keys in `internal/handlers` and repeated test literals - `gosec` (23): app-page redirects now go through a `redirectToApp` helper that path-escapes the app ID (G710 open redirect); `http.ServeFile` of the internally derived deployment log path annotated like the adjacent `os.Stat` (G703) - `dupl` (22): extracted a generic `findAllByAppID` in `internal/models`, a `deleteAppResource` helper in `internal/handlers`, a shared `parsePush` in `internal/service/webhook`, and table-driven/helper-based dedup in tests - `nolintlint` (5): removed `//nolint:funlen` directives made obsolete by the new limits (plus one more that became obsolete after refactoring) - `nilerr` (3, surfaced during fixing): resource-delete lookups now propagate the find error to the caller No behavior changes intended; all tests pass and `make check` is green. Note: golangci-lint v2.12 warns that `gomodguard` is deprecated in favor of `gomodguard_v2` — a future canonical-config update should address this centrally.

clawbot added 1 commit 2026-08-07 19:17:16 +02:00

Update golangci-lint to v2.12.2 with canonical config

Check / check (pull_request) Successful in 3m22s

Details

a4b8ea4402

Bump golangci-lint from v2.10.1 to v2.12.2 in the Dockerfile lint
stage (tag+digest pin) and script/bootstrap release-archive pins
(linux amd64/arm64 sha256s). Replace .golangci.yml with the canonical
v2-layout config so linter settings (lll 88, funlen 80/50, cyclop 15,
dupl 100) actually apply.

Fix all findings surfaced by the new linter and config:

- noctx: use httptest.NewRequestWithContext in all tests
- gosec G710/G703: route app redirects through a path-escaping
  redirectToApp helper; annotate internal log path usage
- goconst: introduce shared constants for template/JSON keys and
  repeated test literals
- lll: wrap lines to the 88-column limit
- dupl: extract shared helpers (generic findAllByAppID in models,
  deleteAppResource in handlers, parsePush in webhook payloads,
  table-driven/helper-based test dedup)
- nolintlint: drop nolint directives made obsolete by the new limits

Record the change in TODO.md; make check is green.

sneak merged commit 7a34fc999c into main

2026-08-07 22:21:42 +02:00

sneak deleted branch golangci-v2.12.2

2026-08-07 22:21:42 +02:00

sneak referenced this issue from a commit

2026-08-07 22:21:44 +02:00

Update golangci-lint to v2.12.2 with canonical config (#187)

clawbot referenced this pull request

2026-08-07 22:27:02 +02:00

fix: resolve all 47 noctx lint findings in tests (closes #175) #183

clawbot referenced this pull request

2026-08-07 22:27:07 +02:00