build: standardize golangci-lint tooling and rules

[appleboy]

Summary

Synchronize .golangci.yml with Signet, adapting only the local-module import prefix. Apply the enabled lint and formatting fixes so the same policy passes locally and in CI. Pin golangci-lint v2.14.0 in go.tools.mod / go.tools.sum; Makefile formatting/lint targets and the CI lint job use this tool module. Include both runtime and tool sums in the lint cache. Preserve public APIs and observable behavior; narrowly explained suppressions cover legacy exported names, platform conversions, intentional nil-success contracts, or established output where applicable.

Scope and review classification

Core change. Shared production code is touched; request two reviewers including the module owner, with line-by-line review of non-formatting changes.
Runtime Go module dependencies and existing non-lint CI test jobs remain unchanged. The tool module uses Go 1.26; application minimum versions are preserved. No Jira/GitHub issue was supplied.

flowchart TD
    CI[CI lint job] --> Make[Makefile lint]
    Make --> Tool[golangci-lint from go.tools.mod]
    Config[.golangci.yml shared policy] --> Tool
    Tool --> Source[Formatted and lint-clean Go code]
    style Config fill:#dff0d8,stroke:#3c763d
    style Source fill:#dff0d8,stroke:#3c763d

Loading

Verification

Check out chore/pin-golangci-lint and run commands from the repository root. Prerequisites: Go 1.26+, Make, network access for tool modules. A globally installed golangci-lint is unnecessary. Local execution used Go 1.26.7 on macOS/arm64.

Command / check	Coverage	Status	Observed result
make lint	Shared policy and pinned tool against source	Passed	Exit 0, 0 issues
Pinned formatter on changed Go files	gci, gofmt, gofumpt, golines	Passed	Formatting applied and final lint passed
Compare policy to Signet	Identical rules with repository-specific import prefix	Passed	Only the module prefix differs
`go test -count=1 -run '^(TestGetKeyFile	TestShellQuote	TestWriteFileRejectsInvalidTargetName)$' ./...`	Self-contained regression subset
Service-dependent integration tests	Existing integration coverage	Not run successfully locally	The full SSH suite requires the disposable Alpine SSH fixture configured by the existing CI job. Do not run make ssh-server on a workstation.
git diff --check and staged equivalent	Patch whitespace	Passed	Exit 0
GitHub CI matrix	Hosted OS/Go and service fixtures	Not run locally	Check current PR checks after push

Reviewer scenario: run go tool -modfile=go.tools.mod golangci-lint version, then make lint. Expect version 2.14.0 and 0 issues. Version resolution and lint passed locally. Inspect gci sections: standard imports, this module's imports, then third-party imports. Formatter and lint checks use the same module/configuration. No service setup or cleanup is needed for this scenario; test commands may generate local coverage files.

AI authorship

• AI used: Codex, including delegated code review and narrow lint repairs.

• Human line-by-line reviewed: None — not yet reviewed by a human.

• AI-authored or tool-generated files included in this PR:

• .github/workflows/testing.yml

• Makefile

• _examples/stream/stream.go

• easyssh.go

• easyssh_test.go

• go.tools.mod

• go.tools.sum

Risks and rollback

Review non-formatting production edits and compatibility suppressions carefully; inspect tests for environment restoration and fatal assertions only in the test goroutine. Spot-check generated tool sums and formatting-only changes. No secrets/credentials were introduced and no new external or permission interface is intended.

Revert the PR commits to restore the earlier tooling/rules. Source formatting spans many files in legacy repositories; it is required by the synchronized policy. Service-dependent checks still need their existing CI fixtures.

Go 1.26.8 upgrade

Upgrade every go.mod in this repository, including example modules, to Go 1.26.8. Update fixed CI Go versions where necessary. Existing dependency versions are unchanged.

Verification: run the following from the repository root with GOTOOLCHAIN=go1.26.8:

• git diff --check — passed.
• make lint — passed.
• go test -mod=readonly -run ^$ ./... — passed.
• In _examples/proxy: go test -mod=readonly -run ^$ ./... — passed.
• In _examples/scp: go test -mod=readonly -run ^$ ./... — passed.
• In _examples/ssh: go test -mod=readonly -run ^$ ./... — passed.
• In _examples/stream: go test -mod=readonly -run ^$ ./... — passed.
• In _examples/writeFile: go test -mod=readonly -run ^$ ./... — passed.
  Full external-service integration suites were not run locally; compilation checks do not verify service behavior.

AI authorship: Codex authored the Go version and CI updates; no human line-by-line review yet.

Go test matrix

Test Go 1.26 and 1.27 across the existing OS/service combinations. Version-specific cache keys prevent sharing the same primary cache key across Go versions. Non-matrix jobs continue reading go.mod.

Validation: workflow YAML parsing, test-matrix assertions, and git diff --check passed. Remote CI results are pending; matrix jobs were not executed locally.

AI authorship: Codex authored the scoped changes; no human line-by-line review yet.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.