Fix lint errors and bump golangci-lint to v2/action v9

- Migrate .golangci.yml to golangci-lint v2 config format
- Bump golangci-lint-action from v6 (Node 20, deprecated) to v9 (Node 24)
- Fix errcheck: check fmt.Fscanln and fmt.Sscanf return values
- Fix ineffassign: replace unused vars with _ in test files
- Fix revive unused-parameter: rename unused cmd/args/r/c params to _
- Fix revive empty-block: invert if condition in push command
- Fix revive redefines-builtin-id: rename 'clear' to 'clearsigned'
- Fix revive blank-imports: add comment on modernc.org/sqlite import
- Fix unused: remove unused 'suite' and 'gen' fields from cache entry

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
         with:
           go-version: '1.26'
           cache: true
-      - uses: golangci/golangci-lint-action@v6
+      - uses: golangci/golangci-lint-action@v9
         with:
           version: latest
 

.golangci.yml

@@ -1,21 +1,36 @@
+version: "2"
 run:
-  timeout: 5m
-  go: "1.22"
-
+  go: "1.26"
 linters:
-  disable-all: true
+  default: none
   enable:
     - errcheck
     - govet
     - ineffassign
-    - staticcheck
-    - unused
     - misspell
     - revive
-
-issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck
-        - revive
+    - staticcheck
+    - unused
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - errcheck
+          - revive
+        path: _test\.go
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

cli/commands/aptconfig.go

@@ -16,7 +16,7 @@ func (r *Root) aptConfigCmd() *cobra.Command {
 		Use:   "apt-config <repo> <distro>",
 		Short: "Print apt client configuration (sources.list, key, and auth) for a repository",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			repoName, dist := args[0], args[1]
 			c, err := r.client()
 			if err != nil {

cli/commands/auth.go

@@ -15,7 +15,7 @@ func (r *Root) loginCmd() *cobra.Command {
 		Use:   "login [server]",
 		Short: "Log in to a urapt server and save an API token",
 		Args:  cobra.MaximumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			server := r.flagServer
 			if len(args) == 1 {
 				server = args[0]
@@ -65,7 +65,7 @@ func (r *Root) logoutCmd() *cobra.Command {
 	return &cobra.Command{
 		Use:   "logout",
 		Short: "Revoke the current API token and clear the saved profile",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -86,7 +86,7 @@ func (r *Root) whoamiCmd() *cobra.Command {
 	return &cobra.Command{
 		Use:   "whoami",
 		Short: "Show the currently authenticated user",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -111,7 +111,7 @@ func (r *Root) registerCmd() *cobra.Command {
 		Use:   "register [server]",
 		Short: "Create a new account on a urapt server (first account becomes admin)",
 		Args:  cobra.MaximumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			server := r.flagServer
 			if len(args) == 1 {
 				server = args[0]
@@ -175,7 +175,7 @@ func (r *Root) tokenCreateCmd() *cobra.Command {
 	c := &cobra.Command{
 		Use:   "create",
 		Short: "Create a new API token",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			client, err := r.client()
 			if err != nil {
 				return err
@@ -202,7 +202,7 @@ func (r *Root) tokenListCmd() *cobra.Command {
 	c := &cobra.Command{
 		Use:   "list",
 		Short: "List your API tokens",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			client, err := r.client()
 			if err != nil {
 				return err
@@ -238,7 +238,7 @@ func (r *Root) tokenRevokeCmd() *cobra.Command {
 		Use:   "revoke <id>",
 		Short: "Revoke an API token by id",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			client, err := r.client()
 			if err != nil {
 				return err

cli/commands/packages.go

@@ -18,7 +18,7 @@ func (r *Root) pushCmd() *cobra.Command {
 		Use:   "push <repo> <distro> <component> <file.deb>",
 		Short: "Upload a .deb package to a repository",
 		Args:  cobra.ExactArgs(4),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			repo, dist, component, file := args[0], args[1], args[2], args[3]
 
 			// Local pre-validation for early, clear errors.
@@ -31,9 +31,7 @@ func (r *Root) pushCmd() *cobra.Command {
 			if archOverride != "" {
 				arch = archOverride
 			}
-			if r.flagJSON {
-				// no-op: keep flag accepted
-			} else {
+			if !r.flagJSON {
 				fmt.Printf("Pushing %s_%s_%s (%d bytes)\n", pkgName, ver, arch, inspected.Size)
 			}
 
@@ -66,7 +64,7 @@ func (r *Root) lsCmd() *cobra.Command {
 		Use:   "ls <repo> <distro>",
 		Short: "List packages in a repository/distribution",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -106,7 +104,7 @@ func (r *Root) showCmd() *cobra.Command {
 		Use:   "show <repo> <id|name[@version][:arch]>",
 		Short: "Show package metadata",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -137,7 +135,7 @@ func (r *Root) pullCmd() *cobra.Command {
 		Use:   "pull <repo> <id|name[@version][:arch]>",
 		Short: "Download a package's .deb file",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -174,7 +172,7 @@ func (r *Root) rmCmd() *cobra.Command {
 		Use:   "rm <repo> <id|name[@version][:arch]>",
 		Short: "Delete a package",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err

cli/commands/repos.go

@@ -33,7 +33,7 @@ func (r *Root) repoCreateCmd() *cobra.Command {
 		Use:   "create <name>",
 		Short: "Create a new repository",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			vis := visibility
 			if public {
 				vis = "public"
@@ -70,7 +70,7 @@ func (r *Root) repoListCmd() *cobra.Command {
 	return &cobra.Command{
 		Use:   "list",
 		Short: "List repositories visible to you",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -101,7 +101,7 @@ func (r *Root) repoInfoCmd() *cobra.Command {
 		Use:   "info <name>",
 		Short: "Show details of a repository",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -129,7 +129,7 @@ func (r *Root) repoSetVisibilityCmd() *cobra.Command {
 		Use:   "set-visibility <name>",
 		Short: "Change a repository's visibility",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			vis := ""
 			if public {
 				vis = "public"
@@ -165,7 +165,7 @@ func (r *Root) repoDeleteCmd() *cobra.Command {
 		Use:   "delete <name>",
 		Short: "Delete a repository and all its packages",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -185,7 +185,7 @@ func (r *Root) repoPubkeyCmd() *cobra.Command {
 		Use:   "pubkey <name>",
 		Short: "Print the server's armored public key for a repository",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -224,7 +224,7 @@ func (r *Root) repoMembersListCmd() *cobra.Command {
 		Use:   "list <repo>",
 		Short: "List members of a repository",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -252,7 +252,7 @@ func (r *Root) repoMembersAddCmd() *cobra.Command {
 		Use:   "add <repo> <username>",
 		Short: "Grant a user access to a repository",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -279,7 +279,7 @@ func (r *Root) repoMembersUpdateCmd() *cobra.Command {
 		Use:   "update <repo> <username>",
 		Short: "Change a member's access level",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -305,7 +305,7 @@ func (r *Root) repoMembersRemoveCmd() *cobra.Command {
 		Use:   "remove <repo> <username>",
 		Short: "Revoke a user's access to a repository",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err

cli/commands/structure.go

@@ -22,7 +22,7 @@ func (r *Root) distroCreateCmd() *cobra.Command {
 		Use:   "create <repo> <distro>",
 		Short: "Add a distribution to a repository",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -46,7 +46,7 @@ func (r *Root) distroListCmd() *cobra.Command {
 		Use:   "list <repo>",
 		Short: "List distributions in a repository",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -72,7 +72,7 @@ func (r *Root) distroDeleteCmd() *cobra.Command {
 		Use:   "delete <repo> <distro>",
 		Short: "Delete a distribution and its packages",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -100,7 +100,7 @@ func (r *Root) componentCreateCmd() *cobra.Command {
 		Use:   "create <repo> <distro> <component>",
 		Short: "Add a component to a distribution",
 		Args:  cobra.ExactArgs(3),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -124,7 +124,7 @@ func (r *Root) componentListCmd() *cobra.Command {
 		Use:   "list <repo> <distro>",
 		Short: "List components in a distribution",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -150,7 +150,7 @@ func (r *Root) componentDeleteCmd() *cobra.Command {
 		Use:   "delete <repo> <distro> <component>",
 		Short: "Delete a component",
 		Args:  cobra.ExactArgs(3),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -178,7 +178,7 @@ func (r *Root) archAddCmd() *cobra.Command {
 		Use:   "add <repo> <distro> <arch>",
 		Short: "Add an architecture to a distribution",
 		Args:  cobra.ExactArgs(3),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -202,7 +202,7 @@ func (r *Root) archListCmd() *cobra.Command {
 		Use:   "list <repo> <distro>",
 		Short: "List architectures in a distribution",
 		Args:  cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err
@@ -228,7 +228,7 @@ func (r *Root) archRemoveCmd() *cobra.Command {
 		Use:   "remove <repo> <distro> <arch>",
 		Short: "Remove an architecture from a distribution",
 		Args:  cobra.ExactArgs(3),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			c, err := r.client()
 			if err != nil {
 				return err

cli/commands/version.go

@@ -10,7 +10,7 @@ func (r *Root) versionCmd() *cobra.Command {
 	return &cobra.Command{
 		Use:   "version",
 		Short: "Print the urapt CLI version",
-		Run: func(cmd *cobra.Command, args []string) {
+		Run: func(_ *cobra.Command, _ []string) {
 			fmt.Println(r.version)
 		},
 	}

cli/interact/interact.go

@@ -34,7 +34,7 @@ func ReadLine(prompt string) (string, error) {
 func Confirm(prompt string) bool {
 	fmt.Fprintf(os.Stderr, "%s [y/N]: ", prompt)
 	var s string
-	fmt.Fscanln(os.Stdin, &s)
+	_, _ = fmt.Fscanln(os.Stdin, &s)
 	s = strings.ToLower(strings.TrimSpace(s))
 	return s == "y" || s == "yes"
 }

server/cache/cache.go

@@ -19,8 +19,6 @@ type IndexCache struct {
 
 type entry struct {
 	indices *apt.Indices
-	suite   *apt.Suite
-	gen     int64
 	dirty   bool
 }
 

server/restapi/api_test.go

@@ -136,7 +136,7 @@ func TestRegisterFirstUserIsAdmin(t *testing.T) {
 	h.token = resp.Token
 
 	// /me with token
-	code, body = h.do("GET", "/api/v1/me", h.token, nil)
+	code, _ = h.do("GET", "/api/v1/me", h.token, nil)
 	if code != 200 {
 		t.Fatalf("me status %d", code)
 	}
@@ -199,7 +199,7 @@ func TestLoginAndAuthFlow(t *testing.T) {
 	}
 
 	// create token
-	code, body = h.do("POST", "/api/v1/me/tokens", resp.Token, map[string]string{"name": "laptop"})
+	code, _ = h.do("POST", "/api/v1/me/tokens", resp.Token, map[string]string{"name": "laptop"})
 	if code != 201 {
 		t.Fatalf("create token status %d", code)
 	}
@@ -241,7 +241,7 @@ func TestUsersAdminOnly(t *testing.T) {
 		t.Fatalf("non-admin list users should be 403, got %d", code)
 	}
 	// admin can list users
-	code, body = h.do("GET", "/api/v1/users", admin.Token, nil)
+	code, _ = h.do("GET", "/api/v1/users", admin.Token, nil)
 	if code != 200 {
 		t.Fatalf("admin list users should be 200, got %d", code)
 	}

server/restapi/packages_test.go

@@ -149,7 +149,7 @@ func TestPushPullDeletePackage(t *testing.T) {
 	}
 
 	// list
-	code, body = h.do("GET", "/api/v1/repositories/pkgrepo/distributions/stable/packages", owner.Token, nil)
+	code, _ = h.do("GET", "/api/v1/repositories/pkgrepo/distributions/stable/packages", owner.Token, nil)
 	if code != 200 {
 		t.Fatalf("list packages status %d", code)
 	}

server/restapi/repos_test.go

@@ -31,7 +31,7 @@ func TestRepoCreateAndPermissions(t *testing.T) {
 	}
 
 	// bob cannot see it (private, not a member)
-	code, body = h.do("GET", "/api/v1/repositories/myrepo", bob.Token, nil)
+	code, _ = h.do("GET", "/api/v1/repositories/myrepo", bob.Token, nil)
 	if code != 403 {
 		t.Fatalf("bob should be forbidden from private repo, got %d", code)
 	}

server/restapi/server.go

@@ -28,7 +28,7 @@ func (api *API) ServerInfo(w http.ResponseWriter, r *http.Request) {
 }
 
 // ServerPubkey returns the ASCII-armored default signing key.
-func (api *API) ServerPubkey(w http.ResponseWriter, r *http.Request) {
+func (api *API) ServerPubkey(w http.ResponseWriter, _ *http.Request) {
 	if api.Signer == nil {
 		httputil.WriteError(w, http.StatusServiceUnavailable, httputil.CodeInternal, "no signing key configured")
 		return

server/store/packages_test.go

@@ -136,11 +136,11 @@ func TestListPackages_FiltersAndPagination(t *testing.T) {
 	}
 
 	// Filter by arch (matches arch OR 'all').
-	list, total, _ = s.ListPackages(ctx, repo.ID, d.ID, PackageFilters{Arch: "amd64"}, 1, 100)
+	_, total, _ = s.ListPackages(ctx, repo.ID, d.ID, PackageFilters{Arch: "amd64"}, 1, 100)
 	if total != 3 { // alpha, beta, delta
 		t.Fatalf("amd64 filter: expected 3, got %d", total)
 	}
-	list, total, _ = s.ListPackages(ctx, repo.ID, d.ID, PackageFilters{Arch: "arm64"}, 1, 100)
+	_, total, _ = s.ListPackages(ctx, repo.ID, d.ID, PackageFilters{Arch: "arm64"}, 1, 100)
 	if total != 2 { // gamma, epsilon
 		t.Fatalf("arm64 filter: expected 2, got %d", total)
 	}
@@ -152,7 +152,7 @@ func TestListPackages_FiltersAndPagination(t *testing.T) {
 	}
 
 	// Query (LIKE on name/description).
-	list, total, _ = s.ListPackages(ctx, repo.ID, d.ID, PackageFilters{Query: "a test"}, 1, 100)
+	_, total, _ = s.ListPackages(ctx, repo.ID, d.ID, PackageFilters{Query: "a test"}, 1, 100)
 	if total != 5 {
 		t.Fatalf("query filter: expected all 5 to match description, got %d", total)
 	}
@@ -163,7 +163,7 @@ func TestListPackages_FiltersAndPagination(t *testing.T) {
 		t.Fatalf("page 1: total=%d len=%d", total, len(list))
 	}
 	// page 3 -> only 1 item.
-	list, total, _ = s.ListPackages(ctx, repo.ID, d.ID, PackageFilters{}, 3, 2)
+	list, _, _ = s.ListPackages(ctx, repo.ID, d.ID, PackageFilters{}, 3, 2)
 	if len(list) != 1 {
 		t.Fatalf("page 3: expected 1 item, got %d", len(list))
 	}

shared/apt/apt.go

@@ -115,11 +115,11 @@ func Generate(s *Suite, signer Signer) (*Indices, error) {
 	idx.Release = release
 
 	if signer != nil {
-		clear, err := signer.ClearSign(release)
+		clearsigned, err := signer.ClearSign(release)
 		if err != nil {
 			return nil, fmt.Errorf("clearsign: %w", err)
 		}
-		idx.InRelease = clear
+		idx.InRelease = clearsigned
 		det, err := signer.DetachedSign(release)
 		if err != nil {
 			return nil, fmt.Errorf("detach sign: %w", err)

shared/config/config.go

@@ -190,13 +190,13 @@ func (c *Config) Validate() error {
 	return nil
 }
 
-func set(c *Config, env string, dst *string) {
+func set(_ *Config, env string, dst *string) {
 	if v, ok := os.LookupEnv(env); ok && v != "" {
 		*dst = v
 	}
 }
 
-func setInt(c *Config, env string, dst *int) {
+func setInt(_ *Config, env string, dst *int) {
 	if v, ok := os.LookupEnv(env); ok && v != "" {
 		if n, err := strconv.Atoi(v); err == nil {
 			*dst = n
@@ -204,7 +204,7 @@ func setInt(c *Config, env string, dst *int) {
 	}
 }
 
-func setInt64(c *Config, env string, dst *int64) {
+func setInt64(_ *Config, env string, dst *int64) {
 	if v, ok := os.LookupEnv(env); ok && v != "" {
 		if n, err := strconv.ParseInt(v, 10, 64); err == nil {
 			*dst = n
@@ -212,7 +212,7 @@ func setInt64(c *Config, env string, dst *int64) {
 	}
 }
 
-func setBool(c *Config, env string, dst *bool) {
+func setBool(_ *Config, env string, dst *bool) {
 	if v, ok := os.LookupEnv(env); ok && v != "" {
 		if b, err := strconv.ParseBool(v); err == nil {
 			*dst = b

shared/db/db.go

@@ -14,7 +14,7 @@ import (
 	"strings"
 	"time"
 
-	_ "modernc.org/sqlite"
+	_ "modernc.org/sqlite" // register the pure-Go SQLite driver
 )
 
 //go:embed all:migrations

shared/deb/deb.go

@@ -164,7 +164,9 @@ func readAR(r io.Reader) ([]arMember, error) {
 		name = strings.TrimSuffix(name, "/")
 		sizeStr := strings.TrimSpace(string(header[48:58]))
 		var size int64
-		fmt.Sscanf(sizeStr, "%d", &size)
+		if _, err := fmt.Sscanf(sizeStr, "%d", &size); err != nil {
+			return nil, fmt.Errorf("parse ar member size %q: %w", sizeStr, err)
+		}
 		if size < 0 {
 			return nil, fmt.Errorf("negative ar member size")
 		}