8759d9d8c0CI is red on `main` and on every open PR (including the Dependabot PRs #1531, #1552–#1554) with: ``` panic: file requires newer Go version go1.27 (application built with go1.26) golangci-lint exit with code 2 ``` ## Cause `actions/setup-go` with `go-version: 'stable'` started resolving to **go1.27.0**. The pinned golangci-lint **v2.11.4** release binary is built with **go1.26**, and its `go/types` refuses to typecheck source files declaring a newer language version. Nothing in the failing PRs is at fault. ## Fix Bump to **golangci-lint v2.13.1**, whose release binaries are built with go1.27, so linting works under `stable` again. That bump also pulls in newer linter versions, which surface 57 findings this tree did not have before. Handled as follows: | Linter | Count | Resolution | |---|---|---| | `goconst` | 50 | 39 were repeated literals in `_test.go` files — goconst started counting those in v2.12.0 (golangci-lint#6480 exposed `ignore-tests`). Fixture data like `"1.0.0"` (89 occurrences) is not a missing constant, so `goconst.ignore-tests: true`. The other 11 were real duplication in production code (OpenAPI tags, the `bearer` security scheme name, `$ref`, `http`/`https`) and became named constants. | | `gosec` G710 | 1 | **True positive, fixed.** See below. | | `staticcheck` SA1019 | 6 | Go 1.26 deprecated `ecdsa.PublicKey.X/Y` and `PrivateKey.D`. Annotated with the same targeted `nolint` + rationale already used for `ScalarBaseMult` in `cmd/publisher/auth/common.go`. | ### The open redirect is real `TrailingSlashMiddleware` copied the entire `*url.URL` before rewriting the path. For an absolute-form request URI — legal for a Go HTTP server to parse, e.g. `GET http://evil.com/foo/ HTTP/1.1` — `r.URL.Scheme` and `r.URL.Host` are populated, and they were echoed straight back in the `Location` header. The redirect target is now built from the cleaned path and query alone. The existing `path.Clean` hardening for GHSA-v8vw-gw5j-w7m6 (protocol-relative `//evil.com/`) is unchanged. ### Also Switched `gomodguard` → `gomodguard_v2`; the former is deprecated as of v2.12.0 and was emitting a warning on every run. ## Verification - `golangci-lint v2.13.1` against this tree: **0 issues**, no deprecation warnings - `make validate`: all validations passed - `go build ./...` and tests for every touched package pass (DB-backed tests need Postgres; left to CI) ## Note on migrating the ecdsa key paths Moving those six sites to `PublicKey.Bytes` / `ParseUncompressedPublicKey` / `crypto/ecdh` touches key parsing and signature verification. It should be its own reviewed PR rather than riding along on a CI unblock. Happy to open one. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
90 lines
1.6 KiB
YAML
90 lines
1.6 KiB
YAML
version: "2"
|
|
run:
|
|
modules-download-mode: readonly
|
|
linters:
|
|
enable:
|
|
- asasalint
|
|
- asciicheck
|
|
- bidichk
|
|
- bodyclose
|
|
- containedctx
|
|
- contextcheck
|
|
- cyclop
|
|
- dupl
|
|
- durationcheck
|
|
- errname
|
|
- errorlint
|
|
- exhaustive
|
|
- forbidigo
|
|
- gocognit
|
|
- goconst
|
|
- gocritic
|
|
- gocyclo
|
|
- godox
|
|
- gomoddirectives
|
|
- gomodguard_v2
|
|
- goprintffuncname
|
|
- gosec
|
|
- grouper
|
|
- importas
|
|
- makezero
|
|
- misspell
|
|
- nakedret
|
|
- nestif
|
|
- nilerr
|
|
- nilnil
|
|
- noctx
|
|
- nolintlint
|
|
- nosprintfhostport
|
|
- predeclared
|
|
- promlinter
|
|
- reassign
|
|
- revive
|
|
- rowserrcheck
|
|
- sqlclosecheck
|
|
- testpackage
|
|
- thelper
|
|
- tparallel
|
|
- unconvert
|
|
- unparam
|
|
- usestdlibvars
|
|
- wastedassign
|
|
- whitespace
|
|
settings:
|
|
cyclop:
|
|
max-complexity: 20
|
|
dupl:
|
|
threshold: 300
|
|
goconst:
|
|
# Repeated literals in tests are fixture data ("1.0.0", "Test server", ...);
|
|
# hoisting them into constants hurts readability more than it helps.
|
|
ignore-tests: true
|
|
gocognit:
|
|
min-complexity: 51
|
|
nestif:
|
|
min-complexity: 10
|
|
exclusions:
|
|
generated: lax
|
|
presets:
|
|
- comments
|
|
- common-false-positives
|
|
- legacy
|
|
- std-error-handling
|
|
rules:
|
|
# httptest.NewRequest is idiomatic in tests; noctx is not useful there.
|
|
- path: _test\.go
|
|
linters:
|
|
- noctx
|
|
paths:
|
|
- third_party$
|
|
- builtin$
|
|
- examples$
|
|
formatters:
|
|
enable:
|
|
- gofmt
|
|
exclusions:
|
|
generated: lax
|
|
paths:
|
|
- third_party$
|
|
- builtin$
|
|
- examples$
|