Clear what CI found the first time it ran

.github/workflows/ci.yml

@@ -169,10 +169,14 @@ jobs:
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
           "$(go env GOPATH)/bin/govulncheck" ./...
+      # v2, not v1.62: that binary is built with Go 1.23 and refuses to load a
+      # module targeting 1.25 — "the Go language version used to build
+      # golangci-lint is lower than the targeted Go version". It failed on its
+      # first CI run for that reason and nothing to do with the code.
       - name: Lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
-          version: v1.62
+          version: v2.12
           args: --timeout=5m
 
   integration:

.golangci.yml

@@ -3,20 +3,27 @@
 #
 # The full set was run first, and it reports 489 findings — 409 of them errcheck
 # on deliberate discards like `defer f.Close()`, 43 noctx, 15 errorlint. Turning
-# all of that on at once produces a gate that is red from the first commit, and a
+# all of that on at once produces a gate that is red from its first commit, and a
 # gate nobody can get green is a gate somebody deletes. Those three are tracked
 # as their own piece of work, with the numbers, rather than being enabled and
 # then permanently ignored.
 #
 # What is here catches defects rather than taste, and passes today — so a new
 # finding is a new mistake, which is the only way a linter earns its place in CI.
+#
+# Schema v2. The v1 config went in with golangci-lint pinned to v1.62, whose
+# binary is built with Go 1.23 and refuses to load a module targeting 1.25 —
+# "the Go language version used to build golangci-lint is lower than the
+# targeted Go version". It failed on its first CI run for that reason and
+# nothing to do with the code.
+version: "2"
 
 run:
   timeout: 5m
   tests: true
 
 linters:
-  disable-all: true
+  default: none
   enable:
     - govet
     # staticcheck found the real one: an `if` with an empty body where backend
@@ -25,19 +32,17 @@ linters:
     - ineffassign
     - unused
 
-linters-settings:
-  staticcheck:
-    checks: ["all"]
+  # staticcheck's checks are left at their default. In v2 it absorbed stylecheck,
+  # so "all" would pull in naming and comment-formatting opinions — the kind of
+  # finding that turns a gate into noise and then into something disabled.
 
-issues:
-  exclude-use-default: false
-  max-issues-per-linter: 0
-  max-same-issues: 0
-  exclude-rules:
-    # SA1019 on the TUI is bubbles renaming its viewport scrolling methods. Real,
-    # but it is a rename to follow deliberately in one change, not a reason to
-    # block every unrelated commit in the meantime.
-    - path: internal/tui/
-      linters:
-        - staticcheck
-      text: "SA1019"
+  exclusions:
+    generated: lax
+    rules:
+      # SA1019 on the TUI is bubbles renaming its viewport scrolling methods.
+      # Real, but a rename to follow deliberately in one change, not a reason to
+      # block every unrelated commit in the meantime.
+      - path: internal/tui/
+        linters:
+          - staticcheck
+        text: "SA1019"

go.mod

@@ -13,18 +13,19 @@ require (
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/charmbracelet/ssh v0.0.0-20250128164007-98fd5ae11894
 	github.com/charmbracelet/wish v1.4.7
-	github.com/go-acme/lego/v4 v4.22.2
-	github.com/go-git/go-git/v5 v5.16.2
+	github.com/go-acme/lego/v4 v4.25.2
+	github.com/go-git/go-git/v5 v5.19.1
 	github.com/gofrs/flock v0.12.1
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/modelcontextprotocol/go-sdk v1.6.1
 	github.com/spf13/cobra v1.8.1
-	github.com/yuin/goldmark v1.7.13
+	github.com/yuin/goldmark v1.7.17
 	go.opentelemetry.io/otel v1.44.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0
 	go.opentelemetry.io/otel/sdk v1.44.0
 	go.opentelemetry.io/otel/trace v1.44.0
-	golang.org/x/crypto v0.51.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/sys v0.47.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -62,21 +63,18 @@ require (
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/charmbracelet/x/termios v0.1.0 // indirect
 	github.com/charmbracelet/x/windows v0.2.0 // indirect
-	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/cloudflare/cloudflare-go v0.112.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/creack/pty v1.1.21 // indirect
-	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-git/go-billy/v5 v5.9.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/goccy/go-json v0.10.4 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/jsonschema-go v0.4.3 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
@@ -86,15 +84,16 @@ require (
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
-	github.com/miekg/dns v1.1.62 // indirect
+	github.com/miekg/dns v1.1.67 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
-	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/segmentio/asm v1.1.3 // indirect
 	github.com/segmentio/encoding v0.5.4 // indirect
@@ -108,18 +107,16 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
-	golang.org/x/exp v0.0.0-20241210194714-1829a127f884 // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
-	google.golang.org/grpc v1.81.1 // indirect
+	google.golang.org/grpc v1.82.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )