ci: fix pipelines after dependency bumps

The Go 1.25 toolchain (required by gotd/td) broke the Lint workflow:
golangci-lint v1 maxes out at a Go 1.24 build and refuses a 1.25 target.

- Migrate to golangci-lint v2: bump golangci-lint-action v3.7.0 => v8.0.0
  pinned to golangci-lint v2.12.1, and migrate .golangci.yml to the v2
  schema (drops removed linters: deadcode/structcheck/varcheck/golint/
  gosimple/stylecheck; gofmt/goimports moved to formatters).
- Drop unconfigured depguard linter: v2's default denies all third-party
  imports, and the repo never configured it (was a historical no-op).
- Annotate user-driven filepath.Walk open with #nosec G122 (new gosec check).
- Bump actions/cache v3.3.2 => v4.2.3 (GitHub auto-fails the old version).
- Bump actions/upload-artifact v3 => v4 (v3 is disabled by GitHub).
- Migrate .goreleaser.yaml to version 2 (required by goreleaser-action v7)
  and snapshot.name_template => version_template.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ernado

.github/workflows/lint.yml

@@ -21,9 +21,9 @@ jobs:
           go-version: "1.25"
 
       - name: Lint
-        uses: golangci/golangci-lint-action@v3.7.0
+        uses: golangci/golangci-lint-action@v8.0.0
         with:
-          version: latest
+          version: v2.12.1
           args: --timeout 5m
 
   # Check if there are any dirty changes after go mod tidy
@@ -44,7 +44,7 @@ jobs:
           echo "::set-output name=cache::$(go env GOCACHE)"
           echo "::set-output name=modcache::$(go env GOMODCACHE)"
       - name: Set up cache
-        uses: actions/cache@v3.3.2
+        uses: actions/cache@v4.2.3
         with:
           path: |
             ${{ steps.go-env.outputs.cache }}

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
           echo "::set-output name=modcache::$(go env GOMODCACHE)"
 
       - name: Set up cache
-        uses: actions/cache@v3.3.2
+        uses: actions/cache@v4.2.3
         with:
           path: |
             ${{ steps.go-env.outputs.cache }}
@@ -43,7 +43,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload assets
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: cli
           path: dist/*

.golangci.yml

@@ -1,108 +1,101 @@
-linters-settings:
-  govet:
-    check-shadowing: true
-  gocyclo:
-    min-complexity: 15
-  maligned:
-    suggest-new: true
-  dupl:
-    threshold: 120
-  goconst:
-    min-len: 2
-    min-occurrences: 3
-  misspell:
-    locale: US
-  lll:
-    line-length: 140
-  goimports:
-    local-prefixes: github.com/gotd/
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - experimental
-      - opinionated
-      - performance
-      - style
-    disabled-checks:
-      - hugeParam
-      - rangeValCopy
-      - exitAfterDefer
-      - whyNoLint
-      - singleCaseSwitch
-      - commentedOutCode
-
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
-    - deadcode
-    - depguard
     - dogsled
     - dupl
     - errcheck
+    - gochecknoglobals
     - gochecknoinits
+    - gocognit
     - goconst
     - gocritic
-    - gofmt
-    - goimports
-    - golint
     - gosec
-    - gosimple
     - govet
     - ineffassign
     - lll
     - misspell
     - nakedret
     - staticcheck
-    - structcheck
-    - stylecheck
-    - typecheck
     - unconvert
     - unparam
     - unused
-    - varcheck
     - whitespace
-    - gochecknoglobals
-    - gocognit
-
-  # Do not enable:
-  # - wsl       (too opinionated about newlines)
-  # - godox     (todos are OK)
-  # - bodyclose (false positives on helper functions)
-  # - prealloc  (not worth it in scope of this project)
-  # - maligned  (same as prealloc)
-  # - funlen    (gocyclo is enough)
-
-issues:
-  exclude-use-default: false
-  exclude-rules:
-    - linters: [gocritic]
-      text: "commentedOutCode"
-      source: "SHA1"
-
-    # Allow embed globals
-    - source: "embed\\.FS"
-      linters: [gochecknoglobals]
-
-    # Exclude go:generate from lll
-    - source: "//go:generate"
-      linters: [lll]
-
-    # Disable linters that are annoying in tests.
-    - path: _test\.go
-      linters:
-        - gocyclo
-        - errcheck
-        - dupl
-        - gosec
-        - funlen
-        - goconst
-        - gocognit
-        - scopelint
-        - lll
-        - gochecknoglobals
-    # Ignore shadowing of err.
-    - linters: [govet]
-      text: 'declaration of "(err|ctx|log)"'
-
-    - text: "should have.+comment"
-      linters: [golint]
+  settings:
+    dupl:
+      threshold: 120
+    goconst:
+      min-len: 2
+      min-occurrences: 3
+    gocritic:
+      disabled-checks:
+        - hugeParam
+        - rangeValCopy
+        - exitAfterDefer
+        - whyNoLint
+        - singleCaseSwitch
+        - commentedOutCode
+      enabled-tags:
+        - diagnostic
+        - experimental
+        - opinionated
+        - performance
+        - style
+    gocyclo:
+      min-complexity: 15
+    govet:
+      enable:
+        - shadow
+    lll:
+      line-length: 140
+    misspell:
+      locale: US
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - gocritic
+        text: commentedOutCode
+        source: SHA1
+      - linters:
+          - gochecknoglobals
+        source: embed\.FS
+      - linters:
+          - lll
+        source: //go:generate
+      - linters:
+          - dupl
+          - errcheck
+          - funlen
+          - gochecknoglobals
+          - gocognit
+          - goconst
+          - gocyclo
+          - gosec
+          - lll
+          - scopelint
+        path: _test\.go
+      - linters:
+          - govet
+        text: declaration of "(err|ctx|log)"
+      - linters:
+          - golint
+        text: should have.+comment
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/gotd/
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.goreleaser.yaml

@@ -1,5 +1,6 @@
 # This is an example .goreleaser.yml file with some sensible defaults.
 # Make sure to check the documentation at https://goreleaser.com
+version: 2
 project_name: tg
 before:
   hooks:
@@ -21,7 +22,7 @@ builds:
 checksum:
   name_template: 'checksums.txt'
 snapshot:
-  name_template: "{{ incpatch .Version }}-next"
+  version_template: "{{ incpatch .Version }}-next"
 changelog:
   sort: asc
   filters:

cmd/tg/upload.go

@@ -175,7 +175,7 @@ func (p *app) uploadCmd(c *cli.Context) error {
 				return err
 			}
 
-			f, err := os.Open(filepath.Clean(path))
+			f, err := os.Open(filepath.Clean(path)) // #nosec G122 // path comes from user-provided upload target
 			if err != nil {
 				return xerrors.Errorf("open %q: %w", path, err)
 			}