ci: add golangci-lint and -race; fix git-restore regression; wire lint to CI

Author: fullstackjam

.github/workflows/test.yml

@@ -20,6 +20,19 @@ on:
         default: false
 
 jobs:
+  lint:
+    name: lint
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: latest
+
   unit:
     name: unit (L1)
     runs-on: macos-latest

.golangci.yml

@@ -0,0 +1,32 @@
+version: "2"
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+
+linters:
+  default: none
+  enable:
+    - errcheck
+    - govet
+    - staticcheck
+    - unused
+    - misspell
+    - unconvert
+    - exhaustive
+  settings:
+    exhaustive:
+      default-signifies-exhaustive: true
+    errcheck:
+      exclude-functions:
+        - (net/http.Response).Body.Close
+        - (net/http.ResponseWriter).Write
+        - (*encoding/json.Encoder).Encode
+        - os.WriteFile
+        - (*os.File).Close
+  exclusions:
+    rules:
+      - path: "_test\\.go"
+        linters:
+          - errcheck

Makefile

@@ -10,7 +10,10 @@ COVERAGE_FILE=coverage.out
 COVERAGE_HTML=coverage.html
 
 test-unit:
-	go test -v -timeout 5m ./...
+	go test -v -race -timeout 5m ./...
+
+lint:
+	golangci-lint run ./...
 
 test-integration:
 	go test -v -timeout 5m -tags=integration ./...

cmd/openboot/main.go

@@ -13,7 +13,7 @@ func main() {
 	// or exits without proper cleanup (e.g., when invoked via curl|bash).
 	if fd := int(os.Stdin.Fd()); term.IsTerminal(fd) {
 		if oldState, err := term.GetState(fd); err == nil {
-			defer term.Restore(fd, oldState)
+			defer term.Restore(fd, oldState) //nolint:errcheck // best-effort terminal restore on exit
 		}
 	}
 

internal/auth/auth.go

@@ -87,4 +87,3 @@ func IsAuthenticated() bool {
 	auth, err := LoadToken()
 	return err == nil && auth != nil
 }
-

internal/auth/auth_test.go

@@ -267,7 +267,7 @@ func TestDeleteToken_PermissionError(t *testing.T) {
 
 	require.NoError(t, os.Chmod(authDir, 0500))
 	t.Cleanup(func() {
-		os.Chmod(authDir, 0700)
+		os.Chmod(authDir, 0700) //nolint:errcheck // cleanup restore; failure is non-critical in tests
 	})
 
 	t.Setenv("HOME", tmpDir)
@@ -386,7 +386,7 @@ func TestLoadToken_ReadPermissionError(t *testing.T) {
 	require.NoError(t, os.WriteFile(authFile, []byte("{}"), 0000))
 
 	t.Cleanup(func() {
-		os.Chmod(authFile, 0600)
+		os.Chmod(authFile, 0600) //nolint:errcheck // cleanup restore; failure is non-critical in tests
 	})
 
 	t.Setenv("HOME", tmpDir)

internal/auth/login.go

@@ -111,7 +111,7 @@ func startAuthSession(apiBase string) (codeID, code string, err error) {
 	if err != nil {
 		return "", "", fmt.Errorf("start auth session: %w", err)
 	}
-	defer resp.Body.Close()
+	defer resp.Body.Close() //nolint:errcheck // best-effort; body already read
 
 	if resp.StatusCode != http.StatusOK {
 		return "", "", fmt.Errorf("auth start failed with status %d", resp.StatusCode)
@@ -162,7 +162,7 @@ func pollOnce(pollURL string) (*cliPollResponse, bool, error) {
 	if err != nil {
 		return nil, false, nil
 	}
-	defer resp.Body.Close()
+	defer resp.Body.Close() //nolint:errcheck // best-effort; body already read
 
 	var result cliPollResponse
 	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&result); err != nil {