Migrate golangci-lint to v2.9.0 for Go 1.26 CI support

- Bump go-version 1.23 -> 1.26 in golangci-lint.yml and build-test.yml,
  and golangci-lint version to v2.9.0 (v1.62 can't lint a module with
  a go 1.26 directive).
- Migrate .golangci.yml from the v1 to v2 config schema, preserving the
  original lint policy (gosimple+staticcheck -> staticcheck with SA*/S*
  checks only, gofmt/goimports -> formatters section).
- Exclude a handful of revive rules (exported, package-comments,
  unexported-return, var-naming) that golangci-lint v2.9.0's newer
  bundled revive now enables by default but weren't part of this
  branch's original lint policy under v1.62.

Author: baijum

.github/workflows/build-test.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # pin@5.1.0
         with:
-          go-version: '1.23'
+          go-version: '1.26'
           check-latest: true
       - name: Test source headers are present
         run: make test-source-headers

.github/workflows/golangci-lint.yml

@@ -18,9 +18,9 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # pin@5.1.0
         with:
-          go-version: '1.23'
+          go-version: '1.26'
           check-latest: true
       - name: golangci-lint
         uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 #pin@6.1.1
         with:
-          version: v1.62
+          version: v2.9.0

.golangci.yml

@@ -1,45 +1,70 @@
-run:
-  timeout: 10m
-
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
     - dupl
-    - gofmt
-    - goimports
-    - gosimple
     - govet
     - ineffassign
     - misspell
     - nakedret
     - revive
-    - unused
     - staticcheck
-
-linters-settings:
-  gofmt:
-    simplify: true
-  goimports:
-    local-prefixes: helm.sh/helm/v3
-  dupl:
-    threshold: 400
-issues:
-  exclude-rules:
-    # Helm, and the Go source code itself, sometimes uses these names outside their built-in
-    # functions. As the Go source code has re-used these names it's ok for Helm to do the same.
-    # Linting will look for redefinition of built-in id's but we opt-in to the ones we choose to use.
-    - linters:
-        - revive
-      text: "redefines-builtin-id: redefinition of the built-in function append"
-    - linters:
-        - revive
-      text: "redefines-builtin-id: redefinition of the built-in function clear"
-    - linters:
-        - revive
-      text: "redefines-builtin-id: redefinition of the built-in function max"
-    - linters:
-        - revive
-      text: "redefines-builtin-id: redefinition of the built-in function min"
-    - linters:
-        - revive
-      text: "redefines-builtin-id: redefinition of the built-in function new"
+    - unused
+  settings:
+    dupl:
+      threshold: 400
+    staticcheck:
+      # v1 config here separately enabled `gosimple` (S* checks) and `staticcheck` (SA*
+      # checks) only — no `stylecheck` (ST*) or quickfix (QF*) groups. v2 merges all of
+      # these into one `staticcheck` linter, so pin `checks` to just S*/SA* to preserve
+      # the original lint policy instead of picking up ST*/QF* findings on old code.
+      checks:
+        - "SA*"
+        - "S*"
+  exclusions:
+    rules:
+      # Helm, and the Go source code itself, sometimes uses these names outside their built-in
+      # functions. As the Go source code has re-used these names it's ok for Helm to do the same.
+      # Linting will look for redefinition of built-in id's but we opt-in to the ones we choose to use.
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function append'
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function clear'
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function max'
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function min'
+      - linters:
+          - revive
+        text: 'redefines-builtin-id: redefinition of the built-in function new'
+      # golangci-lint v2.9.0 bundles a newer revive with a broader default rule set than
+      # this branch's original v1.62 setup, which now also enables `exported`,
+      # `package-comments`, `unexported-return`, and additional `var-naming` checks
+      # (see the identical migration on HELM-813/820/821). Not part of this CVE fix's
+      # scope — exclude rather than retrofitting doc comments/API changes onto unrelated code.
+      - linters:
+          - revive
+        text: '^exported:'
+      - linters:
+          - revive
+        text: '^package-comments:'
+      - linters:
+          - revive
+        text: '^unexported-return:'
+      - linters:
+          - revive
+        text: '^var-naming:'
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    gofmt:
+      simplify: true
+    goimports:
+      local-prefixes:
+        - helm.sh/helm/v3