bump golangci-lint, fix code

.github/workflows/ci.yml

@@ -16,10 +16,10 @@ jobs:
           sudo systemctl stop mono-xsp4.service || true
           sudo systemctl disable mono-xsp4.service || true
 
-      - name: set up go 1.20
+      - name: set up go 1.18
         uses: actions/setup-go@v3
         with:
-          go-version: "1.20"
+          go-version: "1.18"
         id: go
 
       - name: launch mongodb

.golangci.yml

@@ -67,5 +67,9 @@ issues:
       text: "Potential Slowloris Attack because ReadHeaderTimeout is not configured in the http.Server"
       linters:
         - gosec
+    - path: _test\.go
+      text: "Deferring unsafe method \"Close\" on type \"io.ReadCloser\""
+      linters:
+        - gosec
 
   exclude-use-default: false

avatar/avatar.go

@@ -217,7 +217,7 @@ func GetGravatarURL(email string) (res string, err error) {
 	if err != nil {
 		return "", err
 	}
-	defer resp.Body.Close()
+	defer resp.Body.Close() //nolint gosec // we don't care about response body
 	if resp.StatusCode != 200 {
 		return "", fmt.Errorf("%s", resp.Status)
 	}

middleware/auth_test.go

@@ -231,7 +231,7 @@ func TestAuthJWTRefreshFailed(t *testing.T) {
 	require.Nil(t, err)
 	resp, err := client.Do(req)
 	require.NoError(t, err)
-	defer resp.Body.Close()
+	defer resp.Body.Close() //nolint gosec // we don't care about response body
 	assert.Equal(t, 401, resp.StatusCode)
 
 	data, err := io.ReadAll(resp.Body)
@@ -458,7 +458,7 @@ func TestRBAC(t *testing.T) {
 	req.Header.Add("X-XSRF-TOKEN", "random id")
 	resp, err = client.Do(req)
 	require.NoError(t, err)
-	defer resp.Body.Close()
+	defer resp.Body.Close() //nolint gosec // we don't care about response body
 	assert.Equal(t, 403, resp.StatusCode)
 
 	data, err := io.ReadAll(resp.Body)

provider/telegram.go

@@ -459,7 +459,7 @@ func (tg *tgAPI) request(ctx context.Context, method string, data interface{}) e
 		if err != nil {
 			return fmt.Errorf("failed to send request: %w", err)
 		}
-		defer resp.Body.Close()
+		defer resp.Body.Close() //nolint gosec // we don't care about response body
 
 		if resp.StatusCode != http.StatusOK {
 			return tg.parseError(resp.Body, resp.StatusCode)