feat: add linter config file

.github/workflows/verify.yaml

@@ -17,19 +17,22 @@ jobs:
       contents: read
 
     steps:
-      - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
         with:
           egress-policy: audit
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version-file: go.mod
           check-latest: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
           version: v1.64.8
           args: --timeout=5m

.golangci.yml

@@ -0,0 +1,67 @@
+version: "2"
+run:
+  issues-exit-code: 1
+linters:
+  enable:
+    - asciicheck
+    - errorlint
+    - forbidigo
+    - gocritic
+    - gosec
+    - importas
+    - misspell
+    - prealloc
+    - staticcheck
+    - tparallel
+    - unconvert
+    - unparam
+    - whitespace
+  settings:
+    forbidigo:
+      forbid:
+        - pattern: ^print.*$
+        - pattern: ^os\.Create$
+          msg: os.Create creates files with 666 permissions, use os.OpenFile(<FILE_NAME>, os.O_CREATE|os.O_TRUNC|os.O_RDWR, 0o644) instead.
+      # This makes it possible to handle import renaming and forbid struct fields and methods.
+      analyze-types: true
+    goheader:
+      values:
+        regexp:
+          ws: \s*
+      template-path: header.tmpl
+    gosec:
+      excludes:
+        - G115
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - errcheck
+          - gosec
+        path: _test\.go
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - chainguard.dev/melange
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$