From 29c57dca9a343a4fb1e7bd7e249b1bb081caed71 Mon Sep 17 00:00:00 2001
From: Chris Hager <chris@linuxuser.at>
Date: Wed, 12 Nov 2025 13:17:50 +0100
Subject: [PATCH] fix ci: update tools

---
 .github/workflows/checks.yml |  6 +--
 .golangci.yaml               | 86 ++++++++++++++++++++++++++++++++++++
 2 files changed, 89 insertions(+), 3 deletions(-)
 create mode 100644 .golangci.yaml

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 1921a67..cdffa1c 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -37,13 +37,13 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Install gofumpt
-        run: go install mvdan.cc/gofumpt@v0.4.0
+        run: go install mvdan.cc/gofumpt@v0.6.0
 
       - name: Install staticcheck
-        run: go install honnef.co/go/tools/cmd/staticcheck@2024.1.1
+        run: go install honnef.co/go/tools/cmd/staticcheck@2025.1.1
 
       - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.61.0
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.2
 
       - name: Lint
         run: make lint
diff --git a/.golangci.yaml b/.golangci.yaml
new file mode 100644
index 0000000..e44a5f0
--- /dev/null
+++ b/.golangci.yaml
@@ -0,0 +1,86 @@
+version: "2"
+linters:
+  enable-all: true
+  disable:
+    - cyclop
+    - forbidigo
+    - funlen
+    - gochecknoglobals
+    - gochecknoinits
+    - gocritic
+    - godot
+    - godox
+    - mnd
+    - lll
+    - nestif
+    - nilnil
+    - nlreturn
+    - noctx
+    - nonamedreturns
+    - paralleltest
+    - revive
+    - testpackage
+    - unparam
+    - varnamelen
+    - wrapcheck
+    - wsl
+    - exhaustruct
+    - depguard
+    - err113
+
+    #
+    # Disabled because of generics:
+    #
+    - contextcheck
+    - rowserrcheck
+    - sqlclosecheck
+    - wastedassign
+
+    #
+    # Disabled because deprecated:
+    #
+
+linters-settings:
+  #
+  # The G108 rule throws a false positive. We're not actually vulnerable. If
+  # you're not careful the profiling endpoint is automatically exposed on
+  # /debug/pprof if you import net/http/pprof. See this link:
+  #
+  #   https://mmcloughlin.com/posts/your-pprof-is-showing
+  #
+  gosec:
+    excludes:
+      - G108
+
+  tagliatelle:
+    case:
+      rules:
+        json: snake
+
+  gofumpt:
+    extra-rules: true
+
+  exhaustruct:
+    exclude:
+      #
+      # Structures outside our control that have a ton of settings. It doesn't
+      # make sense to specify all of the fields.
+      #
+      - 'cobra.Command'
+      - 'logrus.*Formatter'
+
+formatters:
+  enable:
+    - gci
+    - gofmt
+    - gofumpt
+    - goimports
+  settings:
+    gofumpt:
+      extra-rules: true
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$