feat: add .golangci.yml configuration with a curated set of linters

.github/workflows/core-lint.yml

@@ -23,8 +23,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.25.0'
-      - name: golangci-lint
-        run: go run github.com/golangci/golangci-lint/cmd/golangci-lint@latest run
+          go-version-file: go.mod
+          cache: true
+
+      - uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2.11.4

.golangci.yml

@@ -0,0 +1,67 @@
+# .golangci.yml
+version: "2"
+
+run:
+  tests: true
+
+linters:
+  default: none
+  enable:
+    # correctness
+    - staticcheck
+    - govet
+    - errcheck
+    - unused
+    - ineffassign
+    - makezero
+    - nilerr
+    - errorlint
+    - contextcheck
+
+    # performance
+    - prealloc
+    - perfsprint
+    - usestdlibvars
+
+    # resource safety
+    - bodyclose
+    - noctx
+    - sqlclosecheck
+    - rowserrcheck
+    - gosec
+
+    # style / quality
+    - gocritic
+    - unparam
+    # - nestif
+    - dupword
+    - dupl
+
+  settings:
+    govet:
+      enable:
+        - shadow
+        - copylocks
+        - unusedresult
+
+    gosec:
+      excludes:
+        - G304
+
+    gocritic:
+      enabled-tags:
+        - performance
+        - diagnostic
+        - style
+
+    errorlint:
+      asserts: true
+
+  exclusions:
+    rules:
+      # Disable specific linters just for test files
+      - path: _test\.go
+        linters:
+          - gosec     # Tests often have hardcoded credentials or weak rand sources
+          - errcheck  # (Optional) If you don't care about unhandled errors in test setup
+          - dupl      # If you enable the dupl linter later, table-driven tests often trigger it

cmd/add.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/SurgeDM/Surge/internal/utils"
@@ -13,7 +14,7 @@ var addCmd = &cobra.Command{
 	Short:   "Add a new download to the running Surge instance",
 	Long:    `Add one or more URLs to the download queue of a running Surge instance.`,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		//initializeGlobally is required to ensure that the config and logger are set up before we attempt to resolve the API connection or read the batch file.
+		// initializeGlobally is required to ensure that the config and logger are set up before we attempt to resolve the API connection or read the batch file.
 		if err := initializeGlobalState(); err != nil {
 			return err
 		}
@@ -53,7 +54,7 @@ var addCmd = &cobra.Command{
 				continue
 			}
 			attempted++
-			if err := sendToServer(url, mirrors, resolvedOutput, baseURL, token); err != nil {
+			if err := sendToServer(cmd.Context(), url, mirrors, resolvedOutput, baseURL, token); err != nil {
 				fmt.Printf("Error adding %s: %v\n", url, err)
 				continue
 			}
@@ -66,10 +67,10 @@ var addCmd = &cobra.Command{
 		}
 
 		if attempted > 0 {
-			return fmt.Errorf("failed to add any downloads")
+			return errors.New("failed to add any downloads")
 		}
 
-		return fmt.Errorf("no valid URLs to add")
+		return errors.New("no valid URLs to add")
 	},
 }
 

cmd/autoresume_test.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"context"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -34,7 +35,7 @@ func TestCmd_AutoResume_Execution(t *testing.T) {
 	}()
 
 	surgeDir := config.GetSurgeDir()
-	if err := os.MkdirAll(surgeDir, 0o755); err != nil {
+	if err := os.MkdirAll(surgeDir, 0o750); err != nil {
 		t.Fatal(err)
 	}
 
@@ -45,14 +46,14 @@ func TestCmd_AutoResume_Execution(t *testing.T) {
 	settings.General.DefaultDownloadDir = tmpDir
 
 	data, _ := json.Marshal(settings)
-	if err := os.WriteFile(settingsPath, data, 0o644); err != nil {
+	if err := os.WriteFile(settingsPath, data, 0o600); err != nil {
 		t.Fatal(err)
 	}
 
 	// 3. Configure State DB
 	state.CloseDB() // Ensure clean state
 	dbPath := filepath.Join(surgeDir, "state", "surge.db")
-	if err := os.MkdirAll(filepath.Dir(dbPath), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(dbPath), 0o750); err != nil {
 		t.Fatal(err)
 	}
 	state.Configure(dbPath)
@@ -72,7 +73,7 @@ func TestCmd_AutoResume_Execution(t *testing.T) {
 		PausedAt:   time.Now().Unix(),
 		CreatedAt:  time.Now().Unix(),
 	}
-	if err := state.SaveState(testURL, testDest, manualState); err != nil {
+	if err := state.SaveState(context.Background(), testURL, testDest, manualState); err != nil {
 		t.Fatal(err)
 	}