.golangci.yml

# golangci-lint v2 config. The CI job runs with only-new-issues, so the existing
# baseline never blocks a PR — the gate only flags lint debt a change introduces.
version: "2"

linters:
  # Default set (errcheck, govet, ineffassign, staticcheck, unused) plus a few
  # cheap, high-signal additions.
  default: standard
  enable:
    - bodyclose   # every HTTP response body must be closed (leak guard)
    - misspell    # catches typos in comments/strings
    # logInfo/logWarn/logErr wrap slog, so their variadic args are key/value pairs,
    # NOT printf args. Calls written printf-style silently logged garbage
    # ("!BADKEY=2 cryptobot=1") — and did so in the payment path, exactly where an
    # operator needs to audit money. go vet can't see through the wrappers; this can.
    - sloglint
  settings:
    staticcheck:
      checks:
        - all
        # User-facing error messages are Russian and intentionally start with a
        # capital letter, so the "error strings should not be capitalized" check
        # is a false positive across this codebase.
        - -ST1005
        # De Morgan's law on a character-class test (a<=c<=z || ... ) reads worse
        # inverted than as a negated allow-list; keep the explicit form.
        - -QF1001
  exclusions:
    presets:
      - std-error-handling