chore: adopt shared lint hooks

.github/workflows/ci.yml

@@ -52,6 +52,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -96,9 +98,12 @@ jobs:
         run: $(go env GOPATH)/bin/staticcheck ./...
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.10.1
+          version: v2.14.0
+          # The merge base works for every event, unlike only-new-issues. On main and on
+          # tags it is HEAD itself, so compare with the parent commit there.
+          args: ${{ (github.ref_type == 'tag' || github.ref_name == 'main') && '--new-from-rev=HEAD~1' || '--new-from-merge-base=origin/main' }}
 
       - name: Run JSON tags camelCase check
         run: make check-json-tags
@@ -127,19 +132,17 @@ jobs:
 
       - name: Install detect-secrets
         run: |
-          pip install detect-secrets
+          pip install detect-secrets==1.5.0
 
       - name: Detect secrets
         run: |
-          echo "🔍 Scanning for secrets..."
-          if command -v detect-secrets >/dev/null 2>&1; then
-            detect-secrets scan --baseline .secrets.baseline --all-files || echo "Secret detection completed with findings"
-            if [ -f ".secrets.baseline" ]; then
-              detect-secrets audit .secrets.baseline --statistics || echo "Baseline audit completed"
-            fi
-          else
-            echo "detect-secrets not available, skipping secret scan (basic validation will still run)"
-          fi
+          set -euo pipefail
+          mapfile -d '' files < <(git ls-files -z)
+          [ "${#files[@]}" -gt 0 ] || { echo "::error::git ls-files returned no files"; exit 1; }
+          # Exit 1 means new secrets. Exit 3 only means baselined line numbers moved.
+          rc=0
+          detect-secrets-hook --baseline .secrets.baseline "${files[@]}" || rc=$?
+          [ "$rc" -eq 0 ] || [ "$rc" -eq 3 ]
 
   test:
     name: Test (matrix)

.golangci.yaml

@@ -0,0 +1,29 @@
+version: "2"
+linters:
+  enable: [exhaustive, errorlint, noctx, forbidigo, gocritic]
+  settings:
+    errorlint: {errorf: true, asserts: true, comparison: true}
+    exhaustive: {check: [switch, map]}
+    forbidigo:
+      analyze-types: true
+      forbid:
+        - {pattern: '^os\.Exit$', msg: "return an error; exit only from main.go, or add //nolint:forbidigo // <reason>"}
+        - {pattern: '^log\.Fatal(f|ln)?$', msg: "return an error; exit only from main.go, or add //nolint:forbidigo // <reason>"}
+        - {pattern: '^zap\.(Logger|SugaredLogger)\.Fatal(f|w|ln)?$', pkg: '^go\.uber\.org/zap$', msg: "Fatal calls os.Exit and skips shutdown; return an error"}
+        - {pattern: '^uuid\.MustParse$', pkg: '^github\.com/google/uuid$', msg: "MustParse panics on bad input; use uuid.Parse and return InvalidArgument"}
+        - {pattern: '^otlp\w+\.WithInsecure$', msg: "plaintext OTLP exporter; make it a config opt-in or add //nolint:forbidigo // <reason>"}
+        - {pattern: '^http\.DefaultClient$', pkg: '^net/http$', msg: "DefaultClient has no timeout; use a client with Timeout"}
+    gocritic:
+      disable-all: true
+      enabled-checks: [ruleguard]
+      settings:
+        ruleguard:
+          rules: '${base-path}/lint/rules.go'
+          failOn: dsl,import
+  exclusions:
+    generated: lax
+    paths: ['api/oas_.*', 'gen/']
+    rules:
+      - {path: '_test\.go$', linters: [forbidigo, gocritic, errorlint, noctx]}
+      - {path: '(^|/)main\.go$', linters: [forbidigo], text: 'os\.Exit|Fatal'}
+      - {path: '(^|/)(seed|test)/', linters: [forbidigo], text: 'MustParse'}

.pre-commit-config.yaml

@@ -17,9 +17,19 @@ repos:
       - id: go-fmt
       - id: go-imports
       - id: no-go-testing
-      - id: golangci-lint
       # - id: go-unit-tests
 
+  - repo: https://github.com/golangci/golangci-lint
+    rev: v2.14.0
+    hooks:
+      - id: golangci-lint-config-verify
+      - id: golangci-lint
+
+  - repo: https://github.com/truvami/ci-templates
+    rev: c1d25f499c933042579e1fc01dee3d74f7f4b89c  # pragma: allowlist secret
+    hooks:
+      - id: detect-secrets-fail-closed
+
   - repo: https://github.com/adrienverge/yamllint
     rev: v1.35.1
     hooks: