From b8e8256e62d9cc69eb6b9ec5c0c920d4574bad61 Mon Sep 17 00:00:00 2001
From: David Gageot <david.gageot@docker.com>
Date: Thu, 16 Jul 2026 09:23:26 +0200
Subject: [PATCH] lint: enable 14 new linters, bump golangci-lint-action to
 v9.3.0

Assisted-By: Claude
---
 .github/workflows/ci.yml |  2 +-
 .golangci.yml            | 30 ++++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ea3335..6c31b8b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
           cache: true
 
       - name: Lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: v2.12.2
 
diff --git a/.golangci.yml b/.golangci.yml
index 7839d40..0eae1b7 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -9,18 +9,26 @@ linters:
     - copyloopvar
     - depguard
     - dogsled
+    - dupword
     - durationcheck
+    - embeddedstructfieldcheck
     - errcheck
+    - errchkjson
     - errname
     - errorlint
+    - exhaustive
     - exptostd
     - fatcontext
+    - forcetypeassert
     - gocheckcompilerdirectives
     - gochecknoinits
     - gocritic
+    - godot
     - gomoddirectives
     - goprintffuncname
+    - gosec
     - govet
+    - iface
     - inamedparam
     - ineffassign
     - intrange
@@ -29,15 +37,21 @@ linters:
     - mirror
     - modernize
     - nakedret
+    - nilerr
+    - nilnesserr
+    - nilnil
     - nolintlint
+    - nosprintfhostport
     - perfsprint
     - predeclared
     - reassign
+    - recvcheck
     - revive
     - staticcheck
     - testableexamples
     - testifylint
     - thelper
+    - tparallel
     - unconvert
     - unparam
     - unused
@@ -60,6 +74,16 @@ linters:
           deny:
             - pkg: github.com/stretchr/testify
               desc: testify is for tests only
+    gosec:
+      excludes:
+        # Zero-copy []byte->string via unsafe is deliberate and
+        # documented (FindBytes/ContainsBytes).
+        - G103
+        # Flagged int conversions are bounds-checked by construction
+        # (trie indices, base32/bech32 5-bit groups).
+        - G115
+        # The scanner's job is opening user-supplied paths.
+        - G304
     gocritic:
       disabled-checks:
         - dupImport
@@ -86,6 +110,12 @@ linters:
     presets:
       - comments
       - std-error-handling
+    rules:
+      # Tests hardcode fake credentials on purpose and use relaxed
+      # file permissions / math/rand; gosec adds only noise there.
+      - path: _test\.go
+        linters:
+          - gosec
 issues:
   max-same-issues: 3
 formatters: