ci(golangci): drop the advisory flag + uncap max-same-issues

.github/workflows/golangci.yml

@@ -30,34 +30,18 @@ concurrency:
 jobs:
  golangci:
  timeout-minutes: 10
- name: golangci-lint (advisory)
+ name: golangci-lint
  runs-on: ubuntu-latest
- # ============================ ADVISORY ============================
- # DELIBERATELY not a required check, and `--issues-exit-code=0` on
- # the run step keeps findings from red-Xing the job: golangci-lint
- # exits non-zero on any finding by default, and the pre-existing
- # gosec backlog (8 findings at introduction: 4x G204, 3x G304,
- # 1x G115 — sized on #423, the PR that added this job) would
- # otherwise fail every PR for issues it didn't introduce. Findings
- # still surface as inline annotations and in the job log.
- #
- # Known blind spot while advisory: typecheck (compile) errors ride
- # the same issues exit path as lint findings, so under this flag
- # they exit 0 too (verified empirically on #423 — this is NOT a
- # separate exit code). No real signal is lost: a non-compiling PR
- # reds the required Test / Lint / Build jobs anyway, and a broken
- # .golangci.yml still fails THIS job via the action's
- # `golangci-lint config verify` pre-step, which --issues-exit-code
- # does not touch.
- #
- # (Job-level `continue-on-error: true` is NOT the tool for this —
- # it greens the workflow run but still shows the job itself as
- # failed in the PR checks list; see the first run on #423.)
- #
- # REMOVE the `--issues-exit-code=0` arg when the backlog hits zero
- # and this check flips to required (the advisory -> required
- # pattern from backend#1303; tracked under backend#1305 / epic
- # #930). A required check that can't fail is worse than no check.
+ # ============================= GATE ==============================
+ # Blocking by exit code since the backlog hit zero: the gosec
+ # findings sized on #423 were all resolved with per-site reviewed
+ # #nosec waivers (#427), so any finding this job reports from now
+ # on is NEW and fails the job — including typecheck errors, which
+ # ride the same exit path. History of the advisory era (the
+ # --issues-exit-code=0 flag, why job-level continue-on-error was
+ # not the tool) is in the #423/#426 discussions if you need it.
+ # Final step of the flip = marking this check required in branch
+ # protection (backend#1305 / epic #930).
  # ==================================================================
  steps:
  - uses: actions/checkout@v7
@@ -73,11 +57,10 @@ jobs:
  # built with Go 1.26 (required: go.mod says `go 1.26.0`; v1-era
  # binaries can't typecheck this module). Bump deliberately, and
  # keep the version in step with the format expectations noted in
- # .golangci.yml.
+ # .golangci.yml AND with GOLANGCI_LINT_VERSION in the Makefile
+ # (make lint-full runs the same pinned version -- the local/CI
+ # mirror depends on the two never drifting).
  - name: golangci-lint run (.golangci.yml)
  uses: golangci/golangci-lint-action@v9.3.0
  with:
  version: v2.12.2
- # ADVISORY MODE — see the block comment above (incl. the
- # typecheck caveat). Remove at the required-flip.
- args: --issues-exit-code=0

.golangci.yml

@@ -96,3 +96,9 @@ formatters:
  - third_party$
  - builtin$
  - examples$
+
+issues:
+ # Never cap repeated findings: the default (3) hid 10 of the 13 G304s
+ # behind a cache-flappy sample — "8 findings" were really 18 (#427).
+ # A gate must see the whole backlog, every run.
+ max-same-issues: 0

Makefile

@@ -9,11 +9,12 @@
 # ---- toggles -----------------------------------------------------
 
 GO ?= go
-GOLANGCI_LINT ?= golangci-lint
 PKGS := ./...
 
 # Pinned lint/analysis tool versions (reproducibility — no more @latest drift).
-# Keep these in lockstep with .github/workflows/build.yml. Bump deliberately.
+# Keep these in lockstep with .github/workflows/build.yml — and
+# GOLANGCI_LINT_VERSION with .github/workflows/golangci.yml. Bump deliberately.
+GOLANGCI_LINT_VERSION ?= v2.12.2
 ERRCHECK_VERSION ?= v1.20.0
 INEFFASSIGN_VERSION ?= v0.2.0
 MISSPELL_VERSION ?= v0.3.4
@@ -24,8 +25,11 @@ GOIMPORTS_VERSION ?= v0.48.0
 
 # ---- top-level targets -------------------------------------------
 
+# ci mirrors the PR gates exactly — including golangci-lint (lint-full),
+# which fails on findings since #430. A green `make ci` must imply a green
+# PR; lint-full's own guard tells you how to install the tool if missing.
 .PHONY: ci
-ci: vet test lint fmt-check schema-check vulncheck file-budget deadcode check-style
+ci: vet test lint lint-full fmt-check schema-check vulncheck file-budget deadcode check-style
 	@echo "==> ci: all green"
 
 .PHONY: build
@@ -126,15 +130,14 @@ deadcode:
 vulncheck:
 	$(GO) run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) ./...
 
+# Pinned to the exact version the golangci CI job runs (see
+# .github/workflows/golangci.yml), via the same `go run tool@version`
+# pattern as the tools above — no PATH dependency, so a green
+# `make ci` and the PR gate can never disagree on golangci version.
+# First run builds from source (~1-2 min); cached afterwards.
 .PHONY: lint-full
 lint-full:
-	@command -v $(GOLANGCI_LINT) >/dev/null 2>&1 || { \
- echo "==> $(GOLANGCI_LINT) not on PATH"; \
- echo " install via: brew install golangci-lint"; \
- echo " or see: https://golangci-lint.run/usage/install/"; \
- exit 1; \
-	}
-	$(GOLANGCI_LINT) run
+	$(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) run
 
 .PHONY: fmt
 fmt: