chore: upgrade golangci-lint to v2.12.2 for Go 1.25 support

Upgrade golangci-lint from v1.60.3 to v2.12.2 and migrate the config
to v2 format. The previous version was built with Go 1.23 and cannot
analyze Go 1.25 code.

Changes:
- Migrate .golangci.yaml to v2 schema
- Update GitHub Actions workflow to use golangci-lint-action v7
- Remove unused //nolint:gosec directives (gosec no longer flags these)
- Add //nolint:gosec where needed for G101 and G115 false positives

Author: Nick Peters

.github/workflows/ci.yaml

@@ -38,13 +38,13 @@ jobs:
         with:
           go-version: '1.25'
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v7
         with:
           # Pin the version in case all the builds start to fail at the same time.
           # There may not be an automatic way (e.g., dependabot) to update a specific parameter of a GitHub Action,
           # so we will just update it manually whenever it makes sense (e.g., a feature that we want is added).
-          version: v1.60.3
-          args: --build-tags e2e,unit --fix=false --timeout=5m --out-format=colored-line-number
+          version: v2.12.2
+          args: --build-tags e2e,unit
   unit-tests:
     strategy:
       fail-fast: false

.golangci.yaml

@@ -1,40 +1,25 @@
-# The sections in this file are ordered in the order presented in https://golangci-lint.run/usage/configuration/.
+version: "2"
+
+# The sections in this file are ordered in the order presented in https://golangci-lint.run/docs/configuration/.
 # The nested fields are ordered alphabetically.
 
-linters-settings:
-  goheader:
-    template-path: copyright_header
-  goimports:
-    local-prefixes: github.com/aws/shim-loggers-for-containerd
-  gosec:
-    config:
-      G306: "0o644"
-  lll:
-    # 145 is just a lax value that does not require too much work to add this check,
-    # and we don't want this to be too strict anyway.
-    line-length: 145
-    tab-width: 4
-  makezero:
-    always: true
-  nolintlint:
-    require-explanation: true
-    require-specific: true
-  stylecheck:
-    # ST1003 is left out because it is a bit opinionated.
-    checks: ["all", "-ST1003"]
-  paralleltest:
-    # Ignore missing calls to `t.Parallel()` and only report incorrect uses of it.
-    # Default: false
-    ignore-missing: true
+formatters:
+  enable:
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/aws/shim-loggers-for-containerd
+
 linters:
+  default: none
   enable:
     - errname
     - errorlint
     - forcetypeassert
     - gocritic
     - godot
     - goheader
-    - goimports
     - gosec
     - lll
     - misspell
@@ -45,22 +30,44 @@ linters:
     - paralleltest
     - predeclared
     - revive
+    - staticcheck
     - testableexamples
     - unconvert
     - unparam
     - usestdlibvars
     # TODO: Enable wastedassign after https://github.com/sanposhiho/wastedassign/issues/41 is fixed.
     # - wastedassign
     - whitespace
-    - stylecheck
-issues:
-  exclude-rules:
-    - linters:
-        - lll
-      # A go:generate statement has to be in the same line: https://github.com/golang/go/issues/46050.
-      source: "^//go:generate "
-  # Some checks enabled in the stylecheck setting are disabled by default
-  # (e.g., https://golangci-lint.run/usage/false-positives/#exc0013),
-  # so we need to enable them explicitly here.
-  exclude-use-default: false
-  fix: true
+  settings:
+    goheader:
+      template-path: copyright_header
+    gosec:
+      config:
+        G306: "0o644"
+    lll:
+      # 145 is just a lax value that does not require too much work to add this check,
+      # and we don't want this to be too strict anyway.
+      line-length: 145
+      tab-width: 4
+    makezero:
+      always: true
+    nolintlint:
+      require-explanation: true
+      require-specific: true
+    paralleltest:
+      # Ignore missing calls to `t.Parallel()` and only report incorrect uses of it.
+      # Default: false
+      ignore-missing: true
+    staticcheck:
+      checks: ["all", "-ST1003"]
+  exclusions:
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - lll
+        # A go:generate statement has to be in the same line: https://github.com/golang/go/issues/46050.
+        source: "^//go:generate "

Makefile

@@ -25,7 +25,7 @@ $(AWS_CONTAINERD_LOGGERS_BINARY):
 
 .PHONY: test-unit
 test-unit: $(SOURCES)
-	go test -tags unit -race -timeout 120s -cover $(shell go list ./... | grep -v e2e) --count=1
+	go test -tags unit -race -timeout 120s -cover $(shell go list -tags unit ./... | grep -v -e e2e -e /mocks -e /debug) --count=1
 
 .PHONY: test-e2e
 test-e2e:

args_test.go

@@ -392,7 +392,7 @@ func TestGetAWSLogsArgs(t *testing.T) {
 			credentialsEndpoint:         "",
 			expectedCredentialsEndpoint: "",
 		},
-		{
+		{ //nolint:gosec // G101: test data, not real credentials
 			name:                        "credentials endpoint provided",
 			credentialsEndpoint:         "http://localhost:8080/credentials",
 			expectedCredentialsEndpoint: "http://localhost:8080/credentials",

debug/debug_linux.go

@@ -64,7 +64,7 @@ func StartStackTraceHandler() {
 // started by containerd, we can check the logs using `journalctl -u containerd.service`.
 func sendEventsToJournal(syslogIdentifier string, msg string, msgType journal.Priority, delay time.Duration) {
 	vars := map[string]string{"SYSLOG_IDENTIFIER": syslogIdentifier}
-	journal.Send(msg, msgType, vars) //nolint:errcheck,gosec // asynchronous process
+	journal.Send(msg, msgType, vars) //nolint:errcheck // asynchronous process
 	time.Sleep(delay * time.Second)
 }
 

e2e/fluentd_test.go

@@ -142,7 +142,7 @@ func validateTestLogsInFluentd(dirName string, testLog string, testTag string) {
 	})
 	gomega.Expect(err).ShouldNot(gomega.HaveOccurred())
 	gomega.Expect(fileName).ShouldNot(gomega.Equal(""))
-	file, err := os.Open(fileName) //nolint:gosec // testing only
+	file, err := os.Open(fileName)
 	gomega.Expect(err).ShouldNot(gomega.HaveOccurred())
 	defer file.Close() //nolint:errcheck // closing the file
 	var lastLine string

e2e/jsonfile_test.go

@@ -268,7 +268,7 @@ var testJSONFile = func() {
 // readEnvelopeLines parses every JSON-line in the given file as a jsonFileEnvelope.
 // Empty lines are skipped. The test fails fast on any parse error.
 func readEnvelopeLines(path string) []jsonFileEnvelope {
-	file, err := os.Open(path) //nolint:gosec // testing only
+	file, err := os.Open(path)
 	gomega.Expect(err).ShouldNot(gomega.HaveOccurred())
 	defer file.Close() //nolint:errcheck // closing the file
 

logger/common.go

@@ -479,7 +479,7 @@ func readFromContainerPipe(pipe io.Reader, buf []byte, bytesInBuffer, maxReadByt
 			// Pipe is closed, set flag to true.
 			eof = true
 		}
-		atomic.AddUint64(&bytesReadFromSrc, uint64(readBytesFromPipe))
+		atomic.AddUint64(&bytesReadFromSrc, uint64(readBytesFromPipe)) //nolint:gosec // non-negative
 		bytesInBuffer += readBytesFromPipe
 	}
 

logger/common_linux_test.go

@@ -65,6 +65,7 @@ func TestTracingLogRouting(t *testing.T) {
 	require.Equal(t, uint64(len(inputForStdout)+len(inputForStderr)), atomic.LoadUint64(&bytesReadFromSrc))
 	// Exclude the new line characters because they will be removed when sending logs to the log driver.
 	require.Equal(t,
+		//nolint:gosec // G115: values are small test constants, no overflow risk.
 		uint64(len(inputForStdout)+len(inputForStderr)-countOfNewLinesForStdout-countOfNewLinesForStderr),
 		atomic.LoadUint64(&bytesSentToDst))
 	require.Equal(t,

logger/common_test.go

@@ -72,15 +72,15 @@ func (d *dummyClient) Log(msg *dockerlogger.Message) error {
 	if err != nil {
 		return err
 	}
-	f, err := os.OpenFile(logDestinationFileName, os.O_APPEND|os.O_RDWR, 0644) //nolint:gosec // testing only
+	f, err := os.OpenFile(logDestinationFileName, os.O_APPEND|os.O_RDWR, 0644)
 	if err != nil {
 		return fmt.Errorf("unable to open file %s to record log message: %w", logDestinationFileName, err)
 	}
 	defer f.Close() //nolint:errcheck // testing only
 	b, err = json.Marshal(msg)
 	require.NoError(d.t, err)
-	f.Write(b)            //nolint:errcheck,gosec // testing only
-	f.Write([]byte{'\n'}) //nolint:errcheck,gosec // testing only
+	f.Write(b)            //nolint:errcheck // testing only
+	f.Write([]byte{'\n'}) //nolint:errcheck // testing only
 
 	return nil
 }
@@ -93,7 +93,7 @@ func checkLogFile(t *testing.T, fileName string, expectedNumLines int,
 		lastPartialID      string
 		lastPartialOrdinal int
 	)
-	file, err := os.Open(fileName) //nolint:gosec // testing only
+	file, err := os.Open(fileName)
 	require.NoError(t, err)
 	defer file.Close() //nolint:errcheck // testing only
 
@@ -275,7 +275,7 @@ func TestPipeNotBroken(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify that the log destination received partial msg only.
-	file, err := os.Open(logDestinationFileName) //nolint:gosec // testing only
+	file, err := os.Open(logDestinationFileName)
 	require.NoError(t, err)
 	defer file.Close() //nolint:errcheck // testing only