chore: add golangci-lint, bump Go to 1.26, fix all lint issues (#133)

## Summary
- Add `.golangci.yml` with linter configuration matching the main gitea repo
- Add `lint`, `lint-fix`, `lint-go`, `lint-go-fix`, and `security-check` Makefile targets
- Add `tidy` Makefile target (extracts min Go version from `go.mod` for `-compat` flag)
- Bump minimum Go version to 1.26
- Update golangci-lint to v2.10.1
- Replace `golang/govulncheck-action` with `make security-check` in CI
- Add `make lint` step to CI
- Fix all lint issues across the codebase (formatting, `errors.New` vs `fmt.Errorf`, `any` vs `interface{}`, unused returns, stuttering names, Go 1.26 `new(expr)`, etc.)
- Remove unused `pkg/ptr` package (inlined by Go 1.26 `new(expr)`)
- Remove dead linter exclusions (staticcheck, gocritic, testifylint, dupl)

## Test plan
- [x] `make lint` passes
- [x] `go test ./...` passes
- [x] `make build` succeeds

Reviewed-on: https://gitea.com/gitea/gitea-mcp/pulls/133
Reviewed-by: techknowlogick <techknowlogick@noreply.gitea.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>

pkg/gitea/gitea.go

@@ -34,7 +34,7 @@ func NewClient(token string) (*gitea.Client, error) {
 	}
 
 	// Set user agent for the client
-	client.SetUserAgent(fmt.Sprintf("gitea-mcp-server/%s", flag.Version))
+	client.SetUserAgent("gitea-mcp-server/" + flag.Version)
 	return client, nil
 }
 

pkg/gitea/rest.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"crypto/tls"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -40,7 +41,7 @@ func tokenFromContext(ctx context.Context) string {
 func newRESTHTTPClient() *http.Client {
 	transport := http.DefaultTransport.(*http.Transport).Clone()
 	if flag.Insecure {
-		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec // user-requested insecure mode
 	}
 	return &http.Client{
 		Transport: transport,
@@ -51,7 +52,7 @@ func newRESTHTTPClient() *http.Client {
 func buildAPIURL(path string, query url.Values) (string, error) {
 	host := strings.TrimRight(flag.Host, "/")
 	if host == "" {
-		return "", fmt.Errorf("gitea host is empty")
+		return "", errors.New("gitea host is empty")
 	}
 	p := strings.TrimLeft(path, "/")
 	u, err := url.Parse(fmt.Sprintf("%s/api/v1/%s", host, p))
@@ -66,7 +67,7 @@ func buildAPIURL(path string, query url.Values) (string, error) {
 
 // DoJSON performs an API request and decodes a JSON response into respOut (if non-nil).
 // It returns the HTTP status code.
-func DoJSON(ctx context.Context, method, path string, query url.Values, body any, respOut any) (int, error) {
+func DoJSON(ctx context.Context, method, path string, query url.Values, body, respOut any) (int, error) {
 	var bodyReader io.Reader
 	if body != nil {
 		b, err := json.Marshal(body)
@@ -87,7 +88,7 @@ func DoJSON(ctx context.Context, method, path string, query url.Values, body any
 
 	token := tokenFromContext(ctx)
 	if token != "" {
-		req.Header.Set("Authorization", fmt.Sprintf("token %s", token))
+		req.Header.Set("Authorization", "token "+token)
 	}
 	req.Header.Set("Accept", "application/json")
 	if body != nil {
@@ -107,7 +108,7 @@ func DoJSON(ctx context.Context, method, path string, query url.Values, body any
 	}
 
 	if respOut == nil {
-		io.Copy(io.Discard, resp.Body) // best-effort
+		_, _ = io.Copy(io.Discard, resp.Body) // best-effort
 		return resp.StatusCode, nil
 	}
 
@@ -140,7 +141,7 @@ func DoBytes(ctx context.Context, method, path string, query url.Values, body an
 
 	token := tokenFromContext(ctx)
 	if token != "" {
-		req.Header.Set("Authorization", fmt.Sprintf("token %s", token))
+		req.Header.Set("Authorization", "token "+token)
 	}
 	if accept != "" {
 		req.Header.Set("Accept", accept)
@@ -171,5 +172,3 @@ func DoBytes(ctx context.Context, method, path string, query url.Values, body an
 
 	return respBytes, resp.StatusCode, nil
 }
-
-

pkg/gitea/rest_test.go

@@ -28,5 +28,3 @@ func TestTokenFromContext(t *testing.T) {
 		}
 	})
 }
-
-

pkg/log/log.go

@@ -1,7 +1,6 @@
 package log
 
 import (
-	"fmt"
 	"os"
 	"sync"
 	"time"
@@ -35,14 +34,14 @@ func Default() *zap.Logger {
 			home = os.TempDir()
 		}
 
-		logDir := fmt.Sprintf("%s/.gitea-mcp", home)
+		logDir := home + "/.gitea-mcp"
 		if err := os.MkdirAll(logDir, 0o700); err != nil {
 			// Fallback to temp directory if creation fails
 			logDir = os.TempDir()
 		}
 
 		wss = append(wss, zapcore.AddSync(&lumberjack.Logger{
-			Filename:   fmt.Sprintf("%s/gitea-mcp.log", logDir),
+			Filename:   logDir + "/gitea-mcp.log",
 			MaxSize:    100,
 			MaxBackups: 10,
 			MaxAge:     30,

pkg/params/params.go

@@ -9,7 +9,7 @@ import (
 // It accepts both numeric (float64 from JSON) and string representations.
 // This provides better UX for LLM callers that may naturally use strings
 // for identifiers like issue/PR numbers.
-func GetIndex(args map[string]interface{}, key string) (int64, error) {
+func GetIndex(args map[string]any, key string) (int64, error) {
 	val, exists := args[key]
 	if !exists {
 		return 0, fmt.Errorf("%s is required", key)

pkg/params/params_test.go

@@ -8,7 +8,7 @@ import (
 func TestGetIndex(t *testing.T) {
 	tests := []struct {
 		name      string
-		args      map[string]interface{}
+		args      map[string]any
 		key       string
 		wantIndex int64
 		wantErr   bool
@@ -16,63 +16,63 @@ func TestGetIndex(t *testing.T) {
 	}{
 		{
 			name:      "valid float64",
-			args:      map[string]interface{}{"index": float64(123)},
+			args:      map[string]any{"index": float64(123)},
 			key:       "index",
 			wantIndex: 123,
 			wantErr:   false,
 		},
 		{
 			name:      "valid string",
-			args:      map[string]interface{}{"index": "456"},
+			args:      map[string]any{"index": "456"},
 			key:       "index",
 			wantIndex: 456,
 			wantErr:   false,
 		},
 		{
 			name:      "valid string with large number",
-			args:      map[string]interface{}{"index": "999999"},
+			args:      map[string]any{"index": "999999"},
 			key:       "index",
 			wantIndex: 999999,
 			wantErr:   false,
 		},
 		{
 			name:    "missing parameter",
-			args:    map[string]interface{}{},
+			args:    map[string]any{},
 			key:     "index",
 			wantErr: true,
 			errMsg:  "index is required",
 		},
 		{
 			name:    "invalid string (not a number)",
-			args:    map[string]interface{}{"index": "abc"},
+			args:    map[string]any{"index": "abc"},
 			key:     "index",
 			wantErr: true,
 			errMsg:  "must be a valid integer",
 		},
 		{
 			name:    "invalid string (decimal)",
-			args:    map[string]interface{}{"index": "12.34"},
+			args:    map[string]any{"index": "12.34"},
 			key:     "index",
 			wantErr: true,
 			errMsg:  "must be a valid integer",
 		},
 		{
 			name:    "invalid type (bool)",
-			args:    map[string]interface{}{"index": true},
+			args:    map[string]any{"index": true},
 			key:     "index",
 			wantErr: true,
 			errMsg:  "must be a number or numeric string",
 		},
 		{
 			name:    "invalid type (map)",
-			args:    map[string]interface{}{"index": map[string]string{"foo": "bar"}},
+			args:    map[string]any{"index": map[string]string{"foo": "bar"}},
 			key:     "index",
 			wantErr: true,
 			errMsg:  "must be a number or numeric string",
 		},
 		{
 			name:      "custom key name",
-			args:      map[string]interface{}{"pr_index": "789"},
+			args:      map[string]any{"pr_index": "789"},
 			key:       "pr_index",
 			wantIndex: 789,
 			wantErr:   false,

pkg/ptr/ptr.go

@@ -1,73 +0,0 @@
-/*
-Copyright 2023 The Kubernetes Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package ptr
-
-import (
-	"fmt"
-	"reflect"
-)
-
-// AllPtrFieldsNil tests whether all pointer fields in a struct are nil.  This is useful when,
-// for example, an API struct is handled by plugins which need to distinguish
-// "no plugin accepted this spec" from "this spec is empty".
-//
-// This function is only valid for structs and pointers to structs.  Any other
-// type will cause a panic.  Passing a typed nil pointer will return true.
-func AllPtrFieldsNil(obj interface{}) bool {
-	v := reflect.ValueOf(obj)
-	if !v.IsValid() {
-		panic(fmt.Sprintf("reflect.ValueOf() produced a non-valid Value for %#v", obj))
-	}
-	if v.Kind() == reflect.Ptr {
-		if v.IsNil() {
-			return true
-		}
-		v = v.Elem()
-	}
-	for i := 0; i < v.NumField(); i++ {
-		if v.Field(i).Kind() == reflect.Ptr && !v.Field(i).IsNil() {
-			return false
-		}
-	}
-	return true
-}
-
-// To returns a pointer to the given value.
-func To[T any](v T) *T {
-	return &v
-}
-
-// Deref dereferences ptr and returns the value it points to if no nil, or else
-// returns def.
-func Deref[T any](ptr *T, def T) T {
-	if ptr != nil {
-		return *ptr
-	}
-	return def
-}
-
-// Equal returns true if both arguments are nil or both arguments
-// dereference to the same value.
-func Equal[T comparable](a, b *T) bool {
-	if (a == nil) != (b == nil) {
-		return false
-	}
-	if a == nil {
-		return true
-	}
-	return *a == *b
-}