diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1bc20d0..e24af7a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,13 +21,13 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Run lint uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 with: - version: v2.4.0 + version: v2.11.4 - name: Validate schemas and examples run: make validate @@ -38,9 +38,7 @@ jobs: - name: Run govulncheck uses: golang/govulncheck-action@v1 with: - # Use Go 1.26.1 to pick up crypto/x509 vulnerability fixes (GO-2026-4600, GO-2026-4599). - # go.mod stays at go 1.25.8 for golangci-lint compatibility until it supports Go 1.26. - go-version-input: '1.26.1' + go-version-input: 'stable' go-package: ./... repo-checkout: false @@ -55,7 +53,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Set up ko diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 0ca5224..cd03772 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -28,7 +28,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'deploy/go.mod' + go-version: 'stable' cache: true - name: Setup Pulumi diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 85f52df..946aaaf 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -27,7 +27,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Set up ko @@ -75,7 +75,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'deploy/go.mod' + go-version: 'stable' cache: true - name: Setup Pulumi diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d4c65c4..b1f807f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Install cosign @@ -50,7 +50,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Set up ko diff --git a/.golangci.yml b/.golangci.yml index dfb7587..5f3ad3c 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -66,6 +66,11 @@ linters: - common-false-positives - legacy - std-error-handling + rules: + # httptest.NewRequest is idiomatic in tests; noctx is not useful there. + - path: _test\.go + linters: + - noctx paths: - third_party$ - builtin$ diff --git a/cmd/publisher/auth/common.go b/cmd/publisher/auth/common.go index 2ffdb7d..28829e8 100644 --- a/cmd/publisher/auth/common.go +++ b/cmd/publisher/auth/common.go @@ -160,7 +160,7 @@ func parseRawPrivateKey(curve elliptic.Curve, privateKeyBytes []byte) (*ecdsa.Pr return nil, fmt.Errorf("invalid private scalar") } - x, y := curve.ScalarBaseMult(d.Bytes()) + x, y := curve.ScalarBaseMult(d.Bytes()) //nolint:staticcheck // SA1019: needs crypto/ecdh refactor return &ecdsa.PrivateKey{ PublicKey: ecdsa.PublicKey{ Curve: curve, @@ -192,7 +192,7 @@ func PrintEcdsaP384KeyInfo(pubKey ecdsa.PublicKey) { } func printEcdsaKeyInfo(k string, pubKey ecdsa.PublicKey) { - compressed := elliptic.MarshalCompressed(pubKey.Curve, pubKey.X, pubKey.Y) + compressed := elliptic.MarshalCompressed(pubKey.Curve, pubKey.X, pubKey.Y) //nolint:staticcheck // SA1019: needs crypto/ecdh refactor pubKeyString := base64.StdEncoding.EncodeToString(compressed) fmt.Fprint(os.Stdout, "Expected proof record:\n") fmt.Fprintf(os.Stdout, "v=MCPv1; k=%s; p=%s\n", k, pubKeyString) diff --git a/cmd/publisher/auth/github-oidc.go b/cmd/publisher/auth/github-oidc.go index 7caebfe..55fa350 100644 --- a/cmd/publisher/auth/github-oidc.go +++ b/cmd/publisher/auth/github-oidc.go @@ -122,7 +122,7 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string fullURL := requestURL + "&audience=mcp-registry" // Create the request - req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil) + req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil) //nolint:gosec // G704: URL is from GitHub Actions ACTIONS_ID_TOKEN_REQUEST_URL env var if err != nil { return "", fmt.Errorf("failed to create request: %w", err) } @@ -133,7 +133,7 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string // Make the request client := &http.Client{} - resp, err := client.Do(req) + resp, err := client.Do(req) //nolint:gosec // G704: URL is from GitHub Actions env var if err != nil { return "", fmt.Errorf("failed to send request: %w", err) } diff --git a/deploy/go.mod b/deploy/go.mod index 199188d..8edac31 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.25.8 +go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 diff --git a/go.mod b/go.mod index 5f1e76c..d08ff7b 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.25.8 +go 1.26 require ( cloud.google.com/go/kms v1.26.0 diff --git a/internal/api/handlers/v0/auth/oidc_test.go b/internal/api/handlers/v0/auth/oidc_test.go index 4ad8acb..d4e9500 100644 --- a/internal/api/handlers/v0/auth/oidc_test.go +++ b/internal/api/handlers/v0/auth/oidc_test.go @@ -31,7 +31,7 @@ func TestOIDCHandler_ExchangeToken(t *testing.T) { token string expectedError bool }{ - { + { //nolint:gosec // G101: test data, not real credentials name: "successful token exchange with publish permissions", config: &config.Config{ OIDCEnabled: true, diff --git a/internal/database/postgres.go b/internal/database/postgres.go index 70bfe43..a86e44b 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -764,7 +764,6 @@ func hashServerName(name string) int64 { hash ^= uint64(name[i]) hash *= prime64 } - //nolint:gosec // Intentional conversion with masking to 63 bits return int64(hash & 0x7FFFFFFFFFFFFFFF) } diff --git a/internal/database/testutil.go b/internal/database/testutil.go index c67e3a1..8fbdb60 100644 --- a/internal/database/testutil.go +++ b/internal/database/testutil.go @@ -64,7 +64,7 @@ func NewTestDB(t *testing.T) Database { defer cancel() // Connect to postgres database - adminURI := "postgres://mcpregistry:mcpregistry@localhost:5432/postgres?sslmode=disable" + adminURI := "postgres://mcpregistry:mcpregistry@localhost:5432/postgres?sslmode=disable" //nolint:gosec // G101: test database credentials adminConn, err := pgx.Connect(ctx, adminURI) require.NoError(t, err, "Failed to connect to PostgreSQL. Make sure PostgreSQL is running via: docker-compose up -d postgres") defer adminConn.Close(ctx) diff --git a/internal/validators/schema.go b/internal/validators/schema.go index 8a64b32..37d335e 100644 --- a/internal/validators/schema.go +++ b/internal/validators/schema.go @@ -284,7 +284,7 @@ func ConvertJSONPointerToBracketNotation(jsonPointer string) string { // Check if part is a pure number (array index) if _, err := strconv.Atoi(part); err == nil { // It's a numeric index - use bracket notation - result.WriteString(fmt.Sprintf("[%s]", part)) + fmt.Fprintf(&result, "[%s]", part) // Add dot after bracket if next part exists and is a field name (not a number) if i < len(parts)-1 { nextPart := parts[i+1]