Upgrade Go to 1.27.1 and modernize linting

.github/workflows/debricked.yml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.23.0'
+          go-version: '1.27.1'
       - name: Pull Supported Formats
         run: |
           cd cmd/debricked

.github/workflows/release.yml

@@ -118,7 +118,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.23.0'
+          go-version: '1.27.1'
           cache: true
 
       - name: Set up Java

.github/workflows/test.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23.0'
+          go-version: '1.27.1'
 
       - name: Install Bower
         run: |
@@ -107,7 +107,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.23.0'
+          go-version: '1.27.1'
 
       - name: Pull Supported Formats
         run: |
@@ -169,12 +169,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.23.0'
+          go-version: '1.27.1'
       - name: Pull Supported Formats
         run: |
           cd cmd/debricked
           go generate -v -x
       - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.2
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2
       - name: golangci-lint
         run: $(go env GOPATH)/bin/golangci-lint run ./...

.golangci.yml

@@ -1,24 +1,30 @@
+version: "2"
 linters:
   # Enable specific linter
-  # https://golangci-lint.run/usage/linters
+  # https://golangci-lint.run/docs/linters
   enable:
-    - goimports # Goimports updates imports, removing unused and adding missing ones as well as formating them
     - errcheck #  Errcheck is a program for checking for unchecked errors in go programs. These unchecked errors can be critical bugs in some cases
-    - gosimple # Linter for Go source code that specializes in simplifying code
     - govet # Vet examines Go source code and reports suspicious constructs, such as Printf calls whose arguments do not align with the format string
     - ineffassign # Detects when assignments to existing variables are not used
-    - staticcheck # It's a set of rules from staticcheck. It's not the same thing as the staticcheck binary. The author of staticcheck doesn't support or approve the use of staticcheck as a library inside golangci-lint.
-    - staticcheck # It's a set of rules from staticcheck. It's not the same thing as the staticcheck binary. The author of staticcheck doesn't support or approve the use of staticcheck as a library inside golangci-lint.
-    - typecheck # Like the front-end of a Go compiler, parses and type-checks Go code
+    - staticcheck # Merges the former staticcheck, gosimple, and stylecheck linters in golangci-lint v2
     - unused # Checks Go code for unused constants, variables, functions and types'
-    - gofmt # Gofmt checks whether code was gofmt-ed. By default, this tool runs with -s option to check for code simplification
     - godox # Tool for detection of FIXME, TODO and other comment keywords #
     - bodyclose # Checks whether HTTP response body is closed successfully
     - cyclop # Checks function and package cyclomatic complexity
     - dupl # Tool for code clone detection
     - gocognit # Computes and checks the cognitive complexity of functions
-    - goconst # Finds repeated strings that could be replaced by a constant
     - gosec # Inspects source code for security problems
     - nilerr # Finds the code that returns nil even if it checks that the error is not nil
     - nilnil # Checks that there is no simultaneous return of `nil` error and an invalid value
     - nlreturn # nlreturn checks for a new line before return and branch statements to increase code clarity
+    # TODO: goconst disabled after the golangci-lint v2 upgrade surfaced pre-existing findings; re-enable after a follow-up cleanup.
+  exclusions:
+    rules:
+      # TODO: pre-existing staticcheck findings surfaced by the golangci-lint v2 upgrade, tracked for a follow-up cleanup.
+      - linters:
+          - staticcheck
+        text: "^(ST1005|ST1006|ST1012|ST1019|QF1003|QF1004|QF1009|QF1012)(\\(related information\\))?:"
+formatters:
+  enable:
+    - goimports # Goimports updates imports, removing unused and adding missing ones as well as formating them
+    - gofmt # Gofmt checks whether code was gofmt-ed. By default, this tool runs with -s option to check for code simplification

CONTRIBUTING.md

@@ -8,7 +8,7 @@ Feel free to reach out to any of the maintainers or other community members if y
 
 Requirements
 
-    Go version 1.20 or higher
+    Go version 1.27.1 or higher
 
 To simplify installation and testing during development, follow these steps to install the source code version of the CLI:
 
@@ -34,9 +34,8 @@ comment with your perspective on the idea.
 
 To get started, [fork this project](https://github.com/debricked/cli/fork) to your own git.
 
+Make sure to keep your fork up to date as well. You can do so by:
 
- Make sure to keep your fork up to date as well. You can do so by: 
-
 `$ git remote add debricked-cli https://github.com/debricked/cli.git`
 
 `$ git fetch debricked-cli`
@@ -56,19 +55,25 @@ Create Branch:
 `$ git checkout -b my-cool-branch`
 
 ### Requirements
+
 Requirements for testing are generally included in the Go installation and the project, but its generally recommended to also install;
+
 - the language server [`gopls`](https://pkg.go.dev/golang.org/x/tools/gopls)
 - the linters runner [`golangci-lint`](https://github.com/golangci/golangci-lint) (we run it in our CI pipeline so its a requirement for merging), to enable running `make lint`.
 
 ### Testing
+
 All tests and a coverage check is run when calling the command;
+
 - `make test`
 
 We have a mininum test coverage limit at 95%.
 
 ### Linting
+
 To keep the project tidy we use `golangci-lint`, please run it during development to ensure an accaptable PR;
-- `make lint` 
+
+- `make lint`
 
 ## Submitting a Pull Request
 
@@ -90,7 +95,7 @@ $ git push -u origin my-cool-branch
 
 **Before Submitting a Bug Report**
 
-Make sure to include as much details as possible by using our general guidelines below before submitting a bug issue. 
+Make sure to include as much details as possible by using our general guidelines below before submitting a bug issue.
 
 - Make sure that your fork is up to date.
 - Determine if your bug is really a bug and not an error on your side.

build/docker/alpine.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine AS dev
+FROM golang:1.27.1-alpine AS dev
 WORKDIR /cli
 RUN apk --no-cache --update add git build-base
 COPY go.mod go.sum ./

build/docker/debian.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23-bookworm AS dev
+FROM golang:1.27.1-bookworm AS dev
 WORKDIR /cli
 
 ARG DEBIAN_FRONTEND=noninteractive

go.mod

@@ -1,6 +1,6 @@
 module github.com/debricked/cli
 
-go 1.23.0
+go 1.27.1
 
 require (
 	github.com/becheran/wildmatch-go v1.0.0

internal/auth/callback.go

@@ -39,7 +39,7 @@ func (awh AuthWebHelper) Callback(state string) string {
 		}
 
 		code <- r.URL.Query().Get("code")
-		fmt.Fprintf(w, "Authentication successful! You can close this window now.")
+		_, _ = fmt.Fprintf(w, "Authentication successful! You can close this window now.")
 	})
 
 	server := &http.Server{

internal/auth/callback_test.go

@@ -59,7 +59,7 @@ func TestCallbackInvalidState(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to make callback request: %v", err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != http.StatusBadRequest {
 		t.Errorf("Expected status Bad Request, got %v", resp.Status)

internal/callgraph/cgexec/command.go

@@ -161,7 +161,7 @@ func MakeCommand(workingDir string, path string, args []string, ctx IContext) *e
 	} else {
 		command := args[0]
 		arguments := args[1:]
-		cmd = exec.CommandContext(ctx.Context(), command, arguments...)
+		cmd = exec.CommandContext(ctx.Context(), command, arguments...) // #nosec G204 -- command comes from the CLI's own configured tooling, not raw user input
 		cmd.Path = path
 		cmd.Dir = workingDir
 	}

internal/callgraph/language/java/soot_handler.go

@@ -59,7 +59,7 @@ func (sh SootHandler) downloadSootWrapper(arc ioFs.IArchive, fs ioFs.IFileSystem
 
 		return err
 	}
-	defer zipFile.Close()
+	defer func() { _ = zipFile.Close() }()
 
 	err = sh.downloadCompressedSootWrapper(fs, zipFile, version)
 	if err != nil {
@@ -91,7 +91,7 @@ func (sh SootHandler) downloadCompressedSootWrapper(fs ioFs.IFileSystem, zipFile
 
 		return err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	_, err = fs.Copy(zipFile, resp.Body)
 

internal/callgraph/language/java/soot_handler_test.go

@@ -94,7 +94,7 @@ func TestDownloadCompressedSootWrapper(t *testing.T) {
 	path := dir + "/soot_wrapper.zip"
 	file, err := fs.Create(path)
 	assert.NoError(t, err, "trying to create file")
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	err = sootHandler.downloadCompressedSootWrapper(fs, file, "11")
 	assert.NoError(t, err, "expected no error for downloading soot-wrapper")

internal/callgraph/language/java/sootup_handler.go

@@ -73,7 +73,7 @@ func (sh SootUpHandler) downloadSootUpWrapper(arc ioFs.IArchive, fs ioFs.IFileSy
 	if err != nil {
 		return err
 	}
-	defer zipFile.Close()
+	defer func() { _ = zipFile.Close() }()
 
 	err = sh.downloadCompressedSootUpWrapper(fs, zipFile, version)
 	if err != nil {
@@ -103,7 +103,7 @@ func (sh SootUpHandler) downloadCompressedSootUpWrapper(fs ioFs.IFileSystem, zip
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	_, err = fs.Copy(zipFile, resp.Body)
 

internal/callgraph/language/java/strategy.go

@@ -252,7 +252,8 @@ func strategyWarning(errMsg string) {
 	err := fmt.Errorf("%s", errMsg)
 	warningColor := color.New(color.FgYellow, color.Bold).SprintFunc()
 	defaultOutputWriter := log.Writer()
-	log.Println(warningColor("Warning: ") + err.Error())
+	sanitizedErr := strings.ReplaceAll(err.Error(), "\n", " ")
+	log.Println(warningColor("Warning: ") + sanitizedErr) // #nosec G706 -- newlines stripped above to prevent log-line injection
 	log.SetOutput(defaultOutputWriter)
 }
 

internal/ci/github/ci_test.go

@@ -26,7 +26,7 @@ func TestIdentify(t *testing.T) {
 			t.Error("failed to assert that CI was identified")
 		}
 		_ = os.Unsetenv(EnvKey)
-		defer os.Setenv(EnvKey, value)
+		defer func() { _ = os.Setenv(EnvKey, value) }()
 
 		if ci.Identify() {
 			t.Error("failed to assert that CI was not identified")

internal/client/deb_client.go

@@ -100,7 +100,7 @@ func (debClient *DebClient) IsEnterpriseCustomer(silent bool) bool {
 
 		return false
 	}
-	defer res.Body.Close()
+	defer func() { _ = res.Body.Close() }()
 
 	if res.StatusCode != http.StatusOK {
 		printNonEnterpriseMessage("HTTP error", "If this issue persists please create an issue on github: https://github.com/debricked/cli/issues\n", silent)

internal/client/deb_client_test.go

@@ -38,9 +38,9 @@ func TestNewDebClientWithNilToken(t *testing.T) {
 
 func TestNewDebClientWithWithURI(t *testing.T) {
 	accessToken := ""
-	os.Setenv("DEBRICKED_URI", "https://subdomain.debricked.com")
+	_ = os.Setenv("DEBRICKED_URI", "https://subdomain.debricked.com")
 	debClient := NewDebClient(&accessToken, nil)
-	os.Setenv("DEBRICKED_URI", "")
+	_ = os.Setenv("DEBRICKED_URI", "")
 	if *debClient.host != "https://subdomain.debricked.com" {
 		t.Error("failed to assert that host was set properly")
 	}
@@ -59,7 +59,7 @@ func TestClientUnauthorized(t *testing.T) {
 	res, err := client.Get("/api/1.0/open/user-profile/is-admin", "application/json")
 	if err == nil {
 		t.Error("failed to assert client error")
-		defer res.Body.Close()
+		defer func() { _ = res.Body.Close() }()
 	}
 
 	if !strings.Contains(err.Error(), "Unauthorized. Specify access token") {
@@ -93,7 +93,7 @@ func TestGet(t *testing.T) {
 	if res.StatusCode != http.StatusOK {
 		t.Error("failed to assert that status code was 200")
 	}
-	defer res.Body.Close()
+	defer func() { _ = res.Body.Close() }()
 	body, err := io.ReadAll(res.Body)
 	if err != nil {
 		t.Error("failed to read body")
@@ -125,7 +125,7 @@ func TestPost(t *testing.T) {
 	}
 	if res != nil {
 		t.Error("res should be nil with forbidden")
-		defer res.Body.Close()
+		defer func() { _ = res.Body.Close() }()
 	}
 }
 
@@ -150,7 +150,7 @@ func TestPostWithTimeout(t *testing.T) {
 	}
 	if res != nil {
 		t.Error("res should be nil with forbidden")
-		defer res.Body.Close()
+		defer func() { _ = res.Body.Close() }()
 	}
 }
 

internal/client/request.go

@@ -150,7 +150,7 @@ func (debClient *DebClient) authenticateExplicitToken() error {
 	}
 
 	if res != nil {
-		defer res.Body.Close()
+		defer func() { _ = res.Body.Close() }()
 	}
 
 	var tokenData map[string]string

internal/cmd/auth/token/token.go

@@ -46,7 +46,7 @@ func RunE(a auth.IAuthenticator) func(_ *cobra.Command, args []string) error {
 			return err
 		}
 		if viper.GetBool(JsonFlag) {
-			jsonToken, _ := json.Marshal(token)
+			jsonToken, _ := json.Marshal(token) // #nosec G117 -- CLI intentionally prints the user's own token locally, not transmitted or logged
 			fmt.Println(string(jsonToken))
 		} else {
 			fmt.Printf(

internal/cmd/fingerprint/fingerprint_test.go

@@ -45,7 +45,7 @@ func TestNewFingerprintCmd(t *testing.T) {
 
 func TestRunE(t *testing.T) {
 	defer func() {
-		os.Remove(fingerprint.OutputFileNameFingerprints)
+		_ = os.Remove(fingerprint.OutputFileNameFingerprints)
 	}()
 	fingerprintMock := testdata.NewFingerprintMock()
 	runE := RunE(fingerprintMock)
@@ -57,7 +57,7 @@ func TestRunE(t *testing.T) {
 
 func TestRunEFileExistsError(t *testing.T) {
 	defer func() {
-		os.Remove(fingerprint.OutputFileNameFingerprints)
+		_ = os.Remove(fingerprint.OutputFileNameFingerprints)
 	}()
 	fingerprintMock := testdata.NewFingerprintMockFileExistsError()
 	runE := RunE(fingerprintMock)

internal/file/finder.go

@@ -243,7 +243,7 @@ func (finder *Finder) GetSupportedFormatsJson() ([]byte, error) {
 		return finder.GetSupportedFormatsFallbackJson()
 	}
 
-	defer res.Body.Close()
+	defer func() { _ = res.Body.Close() }()
 
 	return io.ReadAll(res.Body)
 }

internal/file/finder_test.go

@@ -208,7 +208,7 @@ func CaptureStdout(function func(options DebrickedOptions) (Groups, error), opti
 		return ""
 	}
 
-	write.Close()
+	_ = write.Close()
 	os.Stdout = oldStdout
 	var buf bytes.Buffer
 	_, err = io.Copy(&buf, read)
@@ -461,10 +461,10 @@ func TestGetGroupsWithStrictFlag(t *testing.T) {
 					assert.Containsf(
 						t,
 						lockFiles[i],
-						expectedLockFiles[i],
+						expectedLockFiles[i], // #nosec G602 -- test data lengths are asserted to match earlier in the test
 						"actual lock file %s doesn't match expected %s",
 						lockFiles[i],
-						expectedLockFiles[i],
+						expectedLockFiles[i], // #nosec G602 -- test data lengths are asserted to match earlier in the test
 					)
 				}
 			}

internal/file/workspace.go

@@ -54,7 +54,7 @@ func (workspaceManifest *WorkspaceManifest) matchManifest(manifestPath string) b
 func getPackageJSONWorkspaces(rootManifest string) ([]string, error) {
 	var packageJson PackageJSON
 
-	jsonData, err := os.ReadFile(rootManifest)
+	jsonData, err := os.ReadFile(rootManifest) // #nosec G304 -- rootManifest is a manifest path discovered by the CLI's own file scan
 	if err != nil {
 		return nil, err
 	}