Update linter setup in CI and locally (#757)

Author: philippschulte

.github/workflows/pr_test.yml

@@ -1,3 +1,5 @@
+name: Test
+
 on:
   pull_request:
     types:
@@ -8,7 +10,6 @@ on:
       - unlabeled
     branches:
       - main
-name: Test
 jobs:
   changelog:
     if: github.actor != 'dependabot[bot]'
@@ -27,6 +28,30 @@ jobs:
         uses: golangci/golangci-lint-action@v8
         with:
           version: v2.4.0
+  golangci-latest:
+    name: lint-latest (informational)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: 1.24.x
+      - name: Run golangci-lint@latest
+        id: lint
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: latest
+        continue-on-error: true
+      - name: Report lint summary
+        run: |
+          if [ "${{ steps.lint.outcome }}" == "success" ]; then
+            echo "✅ golangci-lint@latest passed." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "⚠️ golangci-lint@latest failed (informational only)." >> $GITHUB_STEP_SUMMARY
+          fi
   test:
     strategy:
       matrix:

Makefile

@@ -23,10 +23,15 @@ DEFAULT_FASTLY_TEST_COMPUTE_SERVICE_ID = XsjdElScZGjmfCcTwsYRC1
 FASTLY_TEST_NGWAF_WORKSPACE_ID ?=
 DEFAULT_FASTLY_TEST_NGWAF_WORKSPACE_ID = Am2qjXkgamuYp3u54rQkLD
 FASTLY_API_KEY ?=
-#
+
 # Enables support for tools such as https://github.com/rakyll/gotest
 TEST_COMMAND ?= $(GO) test
 
+# Tooling versions
+GOLANGCI_LINT_VERSION = v2.4.0
+BIN_DIR := $(CURDIR)/bin
+GOLANGCI_LINT := $(BIN_DIR)/golangci-lint
+
 all: mod-download tidy fmt lint test semgrep ## Runs all of the required cleaning and verification targets.
 .PHONY: all
 
@@ -40,26 +45,53 @@ tidy: ## Cleans the Go module.
 	@$(GO) mod tidy
 .PHONY: tidy
 
-fmt: ## Properly formats Go files and orders dependencies.
+install-linter: ## Installs golangci-lint v2.4.0 into ./bin (cross-platform)
+	@echo "==> Installing golangci-lint $(GOLANGCI_LINT_VERSION)"
+	@mkdir -p $(BIN_DIR)
+	@if [ ! -x "$(GOLANGCI_LINT)" ]; then \
+		OS=$$(uname | tr '[:upper:]' '[:lower:]'); \
+		ARCH=$$(uname -m); \
+		case "$$ARCH" in \
+			x86_64) ARCH="amd64" ;; \
+			arm64|aarch64) ARCH="arm64" ;; \
+			*) echo "Unsupported architecture: $$ARCH" && exit 1 ;; \
+		esac; \
+		URL="https://github.com/golangci/golangci-lint/releases/download/$(GOLANGCI_LINT_VERSION)/golangci-lint-$(GOLANGCI_LINT_VERSION)-$$OS-$$ARCH.tar.gz"; \
+		echo "Downloading: $$URL"; \
+		curl -sSfL "$$URL" | tar -xz -C $(BIN_DIR) --strip-components=1; \
+	fi
+.PHONY: install-linter
+
+check-linter-version: ## Verifies installed golangci-lint version matches expected
+	@echo "==> Checking golangci-lint version"
+	@EXPECTED="$(GOLANGCI_LINT_VERSION)"; \
+	INSTALLED=$$($(GOLANGCI_LINT) version --format short | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+'); \
+	if [ "$$INSTALLED" != "$$EXPECTED" ]; then \
+		echo "Expected golangci-lint $$EXPECTED but found $$INSTALLED"; \
+		exit 1; \
+	fi
+.PHONY: check-linter-version
+
+fmt: install-linter ## Properly formats Go files and orders dependencies.
 	@echo "==> Running golangci-lint fmt"
-	@golangci-lint fmt
+	@$(GOLANGCI_LINT) fmt
 .PHONY: fmt
 
-test: ## Runs the test suite with VCR mocks enabled.
-	@echo "==> Testing ${NAME}"
-	@$(TEST_COMMAND) -timeout=30s -parallel=20 -tags="${GOTAGS}" ${GOPKGS} ${TESTARGS}
-.PHONY: test
-
-lint: ## Runs golangci lint
+lint: install-linter check-linter-version ## Runs golangci lint
 	@echo "==> Running golangci-lint"
-	@golangci-lint run
+	@$(GOLANGCI_LINT) run
 .PHONY: lint
 
 semgrep: ## Run semgrep checker.
 	@if [[ "$$(uname)" == 'Darwin' ]]; then brew install semgrep; fi
 	@if command -v semgrep &> /dev/null; then semgrep ci --config auto --exclude-rule generic.secrets.security.detected-private-key.detected-private-key $(SEMGREP_ARGS); fi
 .PHONY: semgrep
 
+test: ## Runs the test suite with VCR mocks enabled.
+	@echo "==> Testing ${NAME}"
+	@$(TEST_COMMAND) -timeout=30s -parallel=20 -tags="${GOTAGS}" ${GOPKGS} ${TESTARGS}
+.PHONY: test
+
 test-race: ## Runs the test suite with the -race flag to identify race conditions, if they exist.
 	@echo "==> Testing ${NAME} (race)"
 	@$(TEST_COMMAND) -timeout=60s -race -tags="${GOTAGS}" ${GOPKGS} ${TESTARGS}
@@ -89,9 +121,13 @@ fix-ngwaf-fixtures: ## Updates test fixtures with a specified default Next-Gen W
 
 nilaway: ## Run nilaway
 	@nilaway ./...
+.PHONY: nilaway
+
+clean-bin: ## Removes locally installed binaries
+	@echo "==> Cleaning ./bin directory"
+	@rm -rf $(BIN_DIR)
+.PHONY: clean-bin
 
-.PHONY: help
 help: ## Prints this help menu.
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
-
-.PHONY: clean
+.PHONY: help