adopt golangci-lint, replace the CI gofmt check with a lint job

Enable errcheck, gosec, misspell, unconvert, and ineffassign plus the
gofmt/goimports formatters; staticcheck and unused stay off until
golangci-lint ships staticcheck 2026.2+, whose current IR builder panics
on the Go 1.27 standard library. Noisy gosec rules (G115 integer
conversions in tlog index math, operator-supplied path/URL taint rules,
public-data file modes) are excluded with justifications in
.golangci.yml.

golangci-lint release binaries are built with released Go and cannot
type-check a `go 1.27` module, so CI and the new make lint/fmt targets
install it from source with the 1.27 toolchain instead of using
golangci-lint-action.

Author: mcpherrinm

.github/workflows/ci.yml

@@ -35,15 +35,6 @@ jobs:
       - name: Toolchain version
         run: go version
 
-      - name: Check gofmt
-        run: |
-          fmtout=$(gofmt -l .)
-          if [ -n "$fmtout" ]; then
-            echo "These files are not gofmt-clean:"
-            echo "$fmtout"
-            exit 1
-          fi
-
       # The Makefile defaults to gotip for local development; CI has a
       # real 1.27 toolchain on PATH as `go`.
       - name: Vet
@@ -64,3 +55,26 @@ jobs:
       # workflow's job.
       - name: Vet stress-tagged tests
         run: go vet -tags=stress ./integration/...
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      # golangci-lint release binaries are built with the latest released
+      # Go and cannot type-check a `go 1.27` module, so build it from
+      # source with the toolchain installed above instead of using
+      # golangci/golangci-lint-action. setup-go's cache keeps this fast
+      # after the first run. Keep the pinned version in sync with the
+      # Makefile comment. Formatting (gofmt + goimports) is checked here
+      # too, via the formatters enabled in .golangci.yml.
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+
+      - name: Lint
+        run: make GO=go lint

.golangci.yml

@@ -0,0 +1,85 @@
+version: "2"
+
+run:
+  # The stress tag only adds integration/stress_test.go; linting with it
+  # on covers the whole tree in one pass.
+  build-tags:
+    - stress
+
+linters:
+  # Standard set: errcheck, govet, ineffassign, staticcheck, unused.
+  default: standard
+  enable:
+    - gosec
+    - misspell
+    - unconvert
+  # golangci-lint vendors honnef.co/go/tools v0.7.0 (staticcheck
+  # 2026.1), whose IR builder panics on the Go 1.27 standard library.
+  # Re-enable staticcheck and unused once golangci-lint ships
+  # staticcheck 2026.2+.
+  disable:
+    - staticcheck
+    - unused
+  settings:
+    errcheck:
+      exclude-functions:
+        # Best-effort HTTP response writes; there is nothing useful to
+        # do with a client that hung up.
+        - (net/http.ResponseWriter).Write
+        # Close on a read-only body; errors there are meaningless.
+        - (io.ReadCloser).Close
+        # Fprint* is used on HTTP responses and hash.Hash writers, where
+        # the error is likewise not actionable.
+        - fmt.Fprint
+        - fmt.Fprintf
+        - fmt.Fprintln
+    gosec:
+      excludes:
+        # G104 (unhandled errors) duplicates errcheck, which is
+        # configured precisely above.
+        - G104
+        # G115 (integer overflow on conversion): tlog tile/index math
+        # converts between uint64, int64, and int pervasively and
+        # intentionally; the flagged sites are all bounded by tree size.
+        - G115
+        # G304 (file path from variable): key seeds, configs, and the
+        # storage root are operator-supplied paths by design.
+        - G304
+      config:
+        # Log data (tiles, checkpoints) is public and served over HTTP;
+        # world-readable directories and files are intentional.
+        G301: "0755"
+        G302: "0644"
+  exclusions:
+    rules:
+      # Tests build/run local binaries, hit local test servers with
+      # constructed URLs, and write world-readable fixtures; gosec's
+      # G107/G204/G306/G602 hits there are all noise.
+      - path: _test\.go
+        linters:
+          - gosec
+      # cactus-cli's purpose is fetching operator-supplied log URLs and
+      # reading operator-supplied cert files, so G703 (path traversal)
+      # and G704 (SSRF) flag the tool working as intended.
+      - path: cmd/cactus-cli/
+        text: "G70[34]"
+      # The tile handler serves stored binary tiles as
+      # application/octet-stream; G705's XSS taint trace (URL path ->
+      # storage key -> response body) is not script injection.
+      - path: tile/server\.go
+        text: "G705"
+
+issues:
+  # Report everything; the default per-linter and per-issue caps hide
+  # findings.
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/letsencrypt/cactus

CLAUDE.md

@@ -23,6 +23,8 @@ make build              # builds bin/cactus, bin/cactus-cli, bin/cactus-keygen,
 make test               # gotip test ./...
 make test-race          # gotip test -race ./...
 make vet                # gotip vet ./...
+make lint               # golangci-lint run (config: .golangci.yml)
+make fmt                # golangci-lint fmt (gofmt + goimports)
 make integration        # gotip test -race -count=1 -tags=integration ./integration/...
 make stress             # bulk issuance stress test (800 certs, `stress` build tag)
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test test-race vet integration stress clean \
+.PHONY: build test test-race vet lint fmt integration stress clean \
 	docker-binaries docker-build docker-up docker-down docker-logs
 
 # cactus requires Go 1.27+ (built-in crypto/mldsa). Until 1.27 ships, the
@@ -22,6 +22,20 @@ test-race:
 vet:
 	$(GO) vet ./...
 
+# golangci-lint must itself be built with a Go 1.27+ toolchain to
+# type-check this module, and its release binaries are built with the
+# latest released Go, so install it from source:
+#   gotip install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+# The PATH prefix makes golangci-lint's `go` invocations use $(GO)'s
+# toolchain.
+GOLANGCI_LINT ?= golangci-lint
+
+lint:
+	PATH="$$($(GO) env GOROOT)/bin:$$PATH" GOTOOLCHAIN=local $(GOLANGCI_LINT) run
+
+fmt:
+	PATH="$$($(GO) env GOROOT)/bin:$$PATH" GOTOOLCHAIN=local $(GOLANGCI_LINT) fmt
+
 integration:
 	$(GO) test -race -count=1 -tags=integration ./integration/...