Fix CI on Go 1.26.7: golangci-lint-action v8 and vulncheck on 1.27.

v4 installs golangci-lint v1.64.8 (built with Go 1.24) which cannot lint a
1.26 module; v8 pulls v2.12. govulncheck@latest still fails to install on
1.26.7, so run that job on Go 1.27. Keep tests on push to main.

.gitea/workflows/test-pr.yaml

@@ -17,9 +17,9 @@ jobs:
       - run: go build ./...
       - run: go vet ./...
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v8
         with:
-          version: latest
+          version: v2.12
           args: --timeout=5m
       - run: go test -race -v -shuffle=on -coverprofile=coverage.out -timeout=5m ./...
       - run: go tool cover -func=coverage.out | tail -10  # basic coverage report
@@ -30,6 +30,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26.7'
+          go-version: '1.27.0'
-      - run: GOTOOLCHAIN=auto go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
       - run: govulncheck ./...

.golangci.yml

@@ -1,86 +1,87 @@
-# .golangci.yml - steamcache2 lint config
+# .golangci.yml - steamcache2 lint config (golangci-lint v2)
 # Philosophy: enable reasonable linters by default (golangci curated set + key additions)
 # then use most specific suppressions possible (source //nosec with justification,
 # _ = discard for errcheck on unavoidable client writes, narrow exclude-rules only for tests).
 # This makes remaining accepted issues visible and actionable in the code.
 # Run with: make lint (or golangci-lint run ./...)
-# Install: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+version: "2"
 
 run:
   timeout: 5m
   modules-download-mode: readonly
 
 linters:
-  # No disable-all: use golangci defaults (errcheck, govet, ineffassign, staticcheck, unused, gosimple, etc.)
+  # No default: none — use golangci defaults (errcheck, govet, ineffassign, staticcheck, unused, etc.)
   # Explicitly enable the non-default linters we require for this LAN cache proxy.
   enable:
     - gosec     # security checks (re-audited; see source //nosec for justified cases)
     - misspell  # documentation hygiene
-    - goimports # import formatting (enforced)
+  settings:
-    # gofmt covered via linter or goimports; errcheck/govet etc. from defaults
+    errcheck:
+      check-type-assertions: false
+      check-blank: false
+    gosec:
+      # Broad global excludes removed (G104/G115/G301/G304/G306).
+      # - G301 addressed by switching cache MkdirAll to 0700 (least privilege for CDN content).
+      # - Remaining justified cases documented with precise //nosec (or #nosec) + comments at the call sites.
+      # - G104 largely eliminated by errcheck + explicit _ = handling (or defer wrappers).
+    staticcheck:
+      checks: ["all"] # SA1019 exclusion removed (no deprecated API usages in tree)
+    govet:
+      enable-all: true
+      disable:
+        - fieldalignment # performance tuning not a priority for this proxy appliance
+        - shadow # common idiomatic "err" redeclarations in error-handling chains (large ServeHTTP, root, parse funcs); enabling adds noise with no real bugs; would require scope refactor for little gain
+  exclusions:
+    generated: lax
+    paths:
+      - dist
+      - bin
+    rules:
+      - path: _test\.go
+        linters:
+          - errcheck
+          - gosec # tests often use weak patterns intentionally (e.g. error injection, temp files)
+      # NOTE: narrow SA9003 exclude retained only for the one remaining intentional empty branch in test (best-effort status check; main assert is metrics side-effect).
+      - path: steamcache/steamcache_test.go
+        linters:
+          - staticcheck
+        text: "SA9003: empty branch"
+      # Narrow gosec excludes for unavoidable classes after re-audit (LAN proxy threat model):
+      # - G115: int64<->uint casts in eviction/GC math (all sizes positive, guarded by capacity checks; API uses uint for bytesNeeded)
+      # - G304: path vars for Read/Open/Remove under trusted disk.root or user config file (sanitized keys, no traversal, no arbitrary inclusion from untrusted URLs)
+      # G306 for config WriteFile kept as source //nosec (one site).
+      # G301 fixed at source (0700 dirs). G104 addressed via errcheck fixes.
+      - path: vfs/memory/memory.go
+        linters:
+          - gosec
+        text: "G115"
+      - path: vfs/disk/disk.go
+        linters:
+          - gosec
+        text: "G115"
+      - path: vfs/gc/gc.go
+        linters:
+          - gosec
+        text: "G115"
+      - path: config/config.go
+        linters:
+          - gosec
+        text: "G304"
+      - path: vfs/disk/disk.go
+        linters:
+          - gosec
+        text: "G304"
 
-linters-settings:
+formatters:
-  errcheck:
+  enable:
-    check-type-assertions: false
+    - goimports
-    check-blank: false
+  exclusions:
-  gosec:
+    generated: lax
-    # Broad global excludes removed (G104/G115/G301/G304/G306).
+    paths:
-    # - G301 addressed by switching cache MkdirAll to 0700 (least privilege for CDN content).
+      - dist
-    # - Remaining justified cases documented with precise //nosec (or #nosec) + comments at the call sites.
+      - bin
-    # - G104 largely eliminated by errcheck + explicit _ = handling (or defer wrappers).
-  staticcheck:
-    checks: ["all"] # SA1019 exclusion removed (no deprecated API usages in tree)
-  govet:
-    enable-all: true
-    disable:
-      - fieldalignment # performance tuning not a priority for this proxy appliance
-      - shadow # common idiomatic "err" redeclarations in error-handling chains (large ServeHTTP, root, parse funcs); enabling adds noise with no real bugs; would require scope refactor for little gain
-
-# Old global errcheck disable + aspirational "re-enable after refactors" comments deleted.
-# errcheck is now on via defaults. Unavoidable cases handled at source with _ = or (rarely) narrow rules.
 
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
-  exclude-use-default: false
-  exclude-dirs:
-    - dist
-    - bin
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck
-        - gosec # tests often use weak patterns intentionally (e.g. error injection, temp files)
-    # NOTE: narrow SA9003 exclude retained only for the one remaining intentional empty branch in test (best-effort status check; main assert is metrics side-effect).
-    # The config one was a truly redundant check (already errored above); deleted surgically in Fix Round 1 (Issue 1), eliminating its exclude-rule.
-    - path: steamcache/steamcache_test.go
-      linters:
-        - staticcheck
-      text: "SA9003: empty branch"
-    # Narrow gosec excludes for unavoidable classes after re-audit (LAN proxy threat model):
-    # - G115: int64<->uint casts in eviction/GC math (all sizes positive, guarded by capacity checks; API uses uint for bytesNeeded)
-    # - G304: path vars for Read/Open/Remove under trusted disk.root or user config file (sanitized keys, no traversal, no arbitrary inclusion from untrusted URLs)
-    # G306 for config WriteFile kept as source //nosec (one site).
-    # G301 fixed at source (0700 dirs). G104 addressed via errcheck fixes.
-    - path: vfs/memory/memory.go
-      linters:
-        - gosec
-      text: "G115"
-    - path: vfs/disk/disk.go
-      linters:
-        - gosec
-      text: "G115"
-    - path: vfs/gc/gc.go
-      linters:
-        - gosec
-      text: "G115"
-    - path: config/config.go
-      linters:
-        - gosec
-      text: "G304"
-    - path: vfs/disk/disk.go
-      linters:
-        - gosec
-      text: "G304"
-    # Predictive/* rules deleted: vfs/predictive/ removed in commit 0dbb2e0; rules were stale/dead.
-    # All other suppressions use source-level //nosec (gosec) or _= (errcheck) for precision and visibility.