ci: wire golangci-lint + gosec into CI (advisory); migrate config to v2

[LukasWodka]

What

• .github/workflows/golangci.yml (new) — runs golangci-lint via the official action (golangci/golangci-lint-action@v9.3.0, golangci-lint pinned v2.12.2) against the repo's .golangci.yml, on every PR + push to develop/main. Same trigger/concurrency shape as build.yml.
• .golangci.yml — migrated v1 → v2 format (via golangci-lint migrate, narrative comments preserved) and enables gosec: the first scanner of our own code for insecure patterns (G-rules). govulncheck (already gating) only covers known CVEs in dependencies — different half of the problem. Linter set otherwise unchanged (still no SSA linters, per Re-enable staticcheck + unused linters once we have a strategy for the k8s.io dep tree #6). Test files are gosec/errcheck-exempt per convention — 12 additional findings fire there, all fixed-temp-path/relaxed-perms test idioms.

Why

.golangci.yml existed but nothing in CI loaded it — build.yml's Lint job runs pinned standalone tools (the action was dropped in #6 when staticcheck/unused choked on the k8s.io dep tree). Two things have changed since:

• The config no longer enables any SSA linter, and a full run measures ~11s wall locally — the Re-enable staticcheck + unused linters once we have a strategy for the k8s.io dep tree #6 failure mode can't reproduce with this set.
• go.mod's go 1.26.0 made the v1-format config dead weight regardless: golangci-lint v1 is EOL (can't typecheck Go 1.26), and v2 binaries — including what brew install golangci-lint ships, per CONTRIBUTING.md — refuse v1 configs. So make lint-full was broken for anyone with a fresh install. The v2 migration fixes local dev and unblocks CI in one move.

Advisory first (deliberate)

This check is not required — branch protection is untouched — and the run step passes --issues-exit-code=0 with a loud comment: golangci-lint exits non-zero on any finding by default, and the backlog below predates this PR. Findings surface as inline annotations + in the job log while the job stays green; infrastructure breakage (bad config, typecheck failure) still fails it. (First attempt used job-level continue-on-error: true — the first run on this PR confirmed the known quirk that it greens the workflow run but still red-Xs the job in the PR checks list, so it was swapped for the exit-code arg.) The first run on this very PR sized the backlog. Flip to required (and remove the arg — a required check that can't fail is worse than none) after the backlog is worked off: the advisory → required pattern from tracebloc/backend#1303.

The backlog this sizes: 8 findings, all gosec

(errcheck / govet / ineffassign / misspell / unconvert / gofmt / goimports: already clean — build.yml enforces the standalone equivalents.)

Rule	Sites	Character
G204 subprocess with variable (×4)	internal/cli/prepare_host.go:113, internal/cli/upgrade.go:123, internal/helm/upgrade.go:56, internal/nodeboot/nodeboot.go:35	By design — the CLI's job is shelling out to helm/bash. Right fix: per-site reviewed #nosec G204 waivers with justification.
G304 file read via variable (×3)	internal/config/config.go:125, internal/push/detect.go:30, internal/push/image_resolution.go:30	By design — user-supplied paths on the user's own machine. Same treatment.
G115 rune→byte overflow (×1)	internal/slug/slug.go:90	False positive — conversion is guarded by if r < 128; gosec doesn't credit the bound. #nosec G115 + comment.

None are mechanical: all 8 want a per-site justification comment, which deserves its own reviewed pass rather than riding along on a CI-wiring PR. That cleanup + the required-flip is the follow-up tracked under tracebloc/backend#1305.

How verified

• golangci-lint config verify passes on the migrated config (the action's default verify: true re-checks this in CI)
• Full local run with golangci-lint v2.12.2 (same pin as the workflow): 8 findings, 10.6s wall
• actionlint -oneline clean on the new workflow

Part of tracebloc/backend#1305 (epic #930, Layer 1).

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are CI and lint configuration only; no runtime application logic is modified, with advisory mode limiting merge impact until gosec backlog is addressed.

Overview
CI now runs golangci-lint against the repo config on PRs and pushes to develop/main, via a new workflow using pinned golangci/golangci-lint-action and golangci-lint v2.12.2. The job is advisory: --issues-exit-code=0 keeps an existing 8 gosec findings from failing PRs while still surfacing annotations and logs; flipping to a required check is deferred until that backlog is cleared.

.golangci.yml is migrated to golangci-lint v2 (version: "2", Go 1.26 aligned with go.mod), with gosec enabled as the first linter scanning application code for insecure patterns (alongside dependency-only govulncheck). gofmt/goimports move to the v2 formatters block; test files stay exempt from errcheck and gosec under updated exclusion rules.

^{Reviewed by Cursor Bugbot for commit ea7832d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

👋 Heads-up — Code review queue is at 45 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#219 — release-train: develop -> staging · author: @LukasWodka · no reviewer assigned
• averaging-service#220 — ci: code-quality caller (advisory) · author: @LukasWodka · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
• backend#1297 — feat(db): gate MSSQL-only ODBC driver per engine + add psycopg (#1164) · author: @saadqbal · no reviewer assigned
• backend#1298 — fix(guardrails): reuse existing dimensional anomaly monitor (#1160) · author: @saadqbal · no reviewer assigned
• backend#1299 — release-train: develop -> staging · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 190c6c3. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ea7832d. Configure here.}