Bump golangci-lint to v2.12.2 and fix new lint findings

Co-Authored-By: shayan <shayan@cognition.ai>

Author: devin-ai-integration[bot]

.github/workflows/lint.yml

@@ -20,4 +20,4 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.1
+          version: v2.12.2

cmd/github-mcp-server/generate_docs.go

@@ -86,6 +86,7 @@ func generateReadmeDocs(readmePath string) error {
 	updatedContent = replaceSection(updatedContent, "START AUTOMATED TOOLS", "END AUTOMATED TOOLS", toolsDoc)
 
 	// Write back to file
+	// #nosec G703 - readmePath is controlled by command line flag, not user input
 	err = os.WriteFile(readmePath, []byte(updatedContent), 0600)
 	if err != nil {
 		return fmt.Errorf("failed to write README.md: %w", err)
@@ -117,7 +118,8 @@ func generateRemoteServerDocs(docsPath string) error {
 
 	newContent := contentStr[:startIndex] + startMarker + "\n" + toolsetsDoc + "\n" + endMarker + contentStr[endIndex+len(endMarker):]
 
-	return os.WriteFile(docsPath, []byte(newContent), 0600) //#nosec G306
+	// #nosec G306,G703 - docsPath is controlled by command line flag, not user input
+	return os.WriteFile(docsPath, []byte(newContent), 0600)
 }
 
 func generateToolsetsDoc(tsg *toolsets.ToolsetGroup) string {
@@ -340,14 +342,14 @@ func generateRemoteToolsetsDoc() string {
 		installLink := fmt.Sprintf("[Install](https://insiders.vscode.dev/redirect/mcp/install?name=gh-%s&config=%s)", name, installConfig)
 		readonlyInstallLink := fmt.Sprintf("[Install read-only](https://insiders.vscode.dev/redirect/mcp/install?name=gh-%s&config=%s)", name, readonlyConfig)
 
-		buf.WriteString(fmt.Sprintf("| %-14s | %-48s | %-53s | %-218s | %-110s | %-288s |\n",
+		fmt.Fprintf(&buf, "| %-14s | %-48s | %-53s | %-218s | %-110s | %-288s |\n",
 			formattedName,
 			description,
 			apiURL,
 			installLink,
 			fmt.Sprintf("[read-only](%s)", readonlyURL),
 			readonlyInstallLink,
-		))
+		)
 	}
 
 	return buf.String()

internal/githubv4mock/query.go

@@ -81,7 +81,7 @@ func queryArguments(variables map[string]any) string {
 // value indicates whether t is a value (required) type or pointer (optional) type.
 // If value is true, then "!" is written at the end of t.
 func writeArgumentType(w io.Writer, t reflect.Type, value bool) {
-	if t.Kind() == reflect.Ptr {
+	if t.Kind() == reflect.Pointer {
 		// Pointer is an optional type, so no "!" at the end of the pointer's underlying type.
 		writeArgumentType(w, t.Elem(), false)
 		return
@@ -122,7 +122,7 @@ func query(v any) string {
 // If inline is true, the struct fields of t are inlined into parent struct.
 func writeQuery(w io.Writer, t reflect.Type, inline bool) {
 	switch t.Kind() {
-	case reflect.Ptr, reflect.Slice:
+	case reflect.Pointer, reflect.Slice:
 		writeQuery(w, t.Elem(), false)
 	case reflect.Struct:
 		// If the type implements json.Unmarshaler, it's a scalar. Don't expand it.

pkg/github/issues.go

@@ -686,15 +686,15 @@ func (d *mvpDescription) String() string {
 		sb.WriteString("\n\n")
 		sb.WriteString("This tool can help with the following outcomes:\n")
 		for _, outcome := range d.outcomes {
-			sb.WriteString(fmt.Sprintf("- %s\n", outcome))
+			fmt.Fprintf(&sb, "- %s\n", outcome)
 		}
 	}
 
 	if len(d.referenceLinks) > 0 {
 		sb.WriteString("\n\n")
 		sb.WriteString("More information can be found at:\n")
 		for _, link := range d.referenceLinks {
-			sb.WriteString(fmt.Sprintf("- %s\n", link))
+			fmt.Fprintf(&sb, "- %s\n", link)
 		}
 	}
 

pkg/github/secret_scanning.go

@@ -72,6 +72,7 @@ func GetSecretScanningAlert(getClient GetClientFn, t translations.TranslationHel
 				return mcp.NewToolResultError(fmt.Sprintf("failed to get alert: %s", string(body))), nil
 			}
 
+			// #nosec G117 - returning the alert payload is the purpose of this tool
 			r, err := json.Marshal(alert)
 			if err != nil {
 				return nil, fmt.Errorf("failed to marshal alert: %w", err)
@@ -153,6 +154,7 @@ func ListSecretScanningAlerts(getClient GetClientFn, t translations.TranslationH
 				return mcp.NewToolResultError(fmt.Sprintf("failed to list alerts: %s", string(body))), nil
 			}
 
+			// #nosec G117 - returning the alert payloads is the purpose of this tool
 			r, err := json.Marshal(alerts)
 			if err != nil {
 				return nil, fmt.Errorf("failed to marshal alerts: %w", err)