Migrate golangci-lint to v2.9.0 for Go 1.26 CI support

- Bump go-version 1.22 -> 1.26 in golangci-lint.yml and build-test.yml,
  and golangci-lint-action pin + version to v2.9.0 (golangci-lint v1.58
  can't lint a module with a go 1.26 directive).
- Migrate .golangci.yml from the v1 to v2 config schema, preserving the
  original lint policy (gosimple+staticcheck -> staticcheck with SA*/S*
  checks only, gofmt/goimports -> formatters section).
- Exclude a handful of revive rules (exported, package-comments,
  unexported-return, var-naming) that golangci-lint v2.9.0's newer
  bundled revive now enables by default but weren't part of this
  branch's original lint policy under v1.58, plus the standard
  redefines-builtin-id exclusions already used on the other streams.

Author: baijum

.github/workflows/build-test.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # pin@5.0.0
         with:
-          go-version: '1.22'
+          go-version: '1.26'
       - name: Test source headers are present
         run: make test-source-headers
       - name: Run unit tests

.github/workflows/golangci-lint.yml

@@ -15,8 +15,9 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # pin@5.0.0
         with:
-          go-version: "1.22"
+          go-version: "1.26"
+          check-latest: true
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 #pin@4.0.0
+        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 #pin@6.1.1
         with:
-          version: v1.58
+          version: v2.9.0

.golangci.yml

@@ -1,25 +1,70 @@
-run:
-  timeout: 10m
-
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
     - dupl
-    - gofmt
-    - goimports
-    - gosimple
     - govet
     - ineffassign
     - misspell
     - nakedret
     - revive
-    - unused
     - staticcheck
-
-linters-settings:
-  gofmt:
-    simplify: true
-  goimports:
-    local-prefixes: helm.sh/helm/v3
-  dupl:
-    threshold: 400
+    - unused
+  settings:
+    dupl:
+      threshold: 400
+    staticcheck:
+      # v1 config here separately enabled `gosimple` (S* checks) and `staticcheck` (SA*
+      # checks) only — no `stylecheck` (ST*) or quickfix (QF*) groups. v2 merges all of
+      # these into one `staticcheck` linter, so pin `checks` to just S*/SA* to preserve
+      # the original lint policy instead of picking up ST*/QF* findings on old code.
+      checks:
+        - "SA*"
+        - "S*"
+  exclusions:
+    rules:
+      # golangci-lint v2.9.0 bundles a newer revive with a broader default rule set than
+      # this branch's original v1.58 setup, which now also enables `exported`,
+      # `package-comments`, `unexported-return`, and additional `var-naming` checks
+      # (see the identical migration on HELM-820/821). Not part of this CVE fix's scope —
+      # exclude rather than retrofitting doc comments/API changes onto unrelated code.
+      - linters:
+          - revive
+        text: '^exported:'
+      - linters:
+          - revive
+        text: '^package-comments:'
+      - linters:
+          - revive
+        text: '^unexported-return:'
+      - linters:
+          - revive
+        text: '^var-naming:'
+      # Helm, and the Go source code itself, sometimes uses these names outside their built-in
+      # functions. As the Go source code has re-used these names it's ok for Helm to do the same.
+      # Linting will look for redefinition of built-in id's but we opt-in to the ones we choose to use.
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function append'
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function clear'
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function max'
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function min'
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function new'
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    gofmt:
+      simplify: true
+    goimports:
+      local-prefixes:
+        - helm.sh/helm/v3