fix(lint): migrate golangci-lint config to v2 (required by Go 1.25 bump)

.golangci.yml

@@ -1,97 +1,61 @@
-run:
-    timeout: 4m
-
-linters-settings:
+version: "2"
+linters:
+  default: none
+  enable:
+    - depguard
+    - dogsled
+    - exhaustive
+    - gochecknoinits
+    - gocritic
+    - goprintffuncname
+    - govet
+    - ineffassign
+    - misspell
+    - nakedret
+    - nolintlint
+    - prealloc
+    - staticcheck
+    - unconvert
+    - unused
+    - whitespace
+  settings:
     depguard:
-        rules:
-            deprecated:
-                deny:
-                    - pkg: "io/ioutil"
-                      desc: "The 'io/ioutil' package is deprecated. Use corresponding 'os' or 'io' functions instead."
+      rules:
+        deprecated:
+          deny:
+            - pkg: io/ioutil
+              desc: The 'io/ioutil' package is deprecated. Use corresponding 'os' or 'io' functions instead.
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - storage/ent/db
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gci
+    - gofmt
+    - gofumpt
+    - goimports
+  settings:
     gci:
-        sections:
-            - standard
-            - default
-            - prefix(github.com/dexidp/dex)
+      sections:
+        - standard
+        - default
+        - prefix(github.com/dexidp/dex)
     goimports:
-        local-prefixes: github.com/dexidp/dex
-
-linters:
-    disable-all: true
-    enable:
-        - depguard
-        - dogsled
-        - exhaustive
-        - gci
-        - gochecknoinits
-        - gocritic
-        - gofmt
-        - gofumpt
-        - goimports
-        - goprintffuncname
-        - gosimple
-        - govet
-        - ineffassign
-        - misspell
-        - nakedret
-        - nolintlint
-        - prealloc
-        # - revive
-        # - sqlclosecheck
-        - staticcheck
-        - stylecheck
-        - unconvert
-        - unused
-        - whitespace
-
-        # Disable temporarily until everything works with Go 1.20
-        # - bodyclose
-        # - rowserrcheck
-        # - tparallel
-        # - unparam
-
-        # Disable temporarily until everything works with Go 1.18
-        - typecheck
-
-        # Disable temporarily until the following issue is resolved: https://github.com/golangci/golangci-lint/issues/3086
-        # - sqlclosecheck
-
-        # TODO: fix linter errors before enabling
-        # - exhaustivestruct
-        # - gochecknoglobals
-        # - errorlint
-        # - gocognit
-        # - godot
-        # - nlreturn
-        # - noctx
-        # - revive
-        # - wrapcheck
-
-        # TODO: fix linter errors before enabling (from original config)
-        # - dupl
-        # - errcheck
-        # - goconst
-        # - gocyclo
-        # - gosec
-        # - lll
-        # - scopelint
-
-        # unused
-        # - goheader
-        # - gomodguard
-
-        # don't enable:
-        # - asciicheck
-        # - funlen
-        # - godox
-        # - goerr113
-        # - gomnd
-        # - interfacer
-        # - maligned
-        # - nestif
-        # - testpackage
-        # - wsl
-
-issues:
-    exclude-dirs:
-        - storage/ent/db # generated ent code
+      local-prefixes:
+        - github.com/dexidp/dex
+  exclusions:
+    generated: lax
+    paths:
+      - storage/ent/db
+      - third_party$
+      - builtin$
+      - examples$

Makefile

@@ -17,7 +17,7 @@ export GOBIN=$(PWD)/bin
 LD_FLAGS="-w -X main.version=$(VERSION)"
 
 # Dependency versions
-GOLANGCI_VERSION   = 1.64.5
+GOLANGCI_VERSION   = 2.11.0
 GOTESTSUM_VERSION ?= 1.12.0
 
 PROTOC_VERSION             = 29.3

connector/atlassiancrowd/atlassiancrowd_test.go

@@ -124,19 +124,19 @@ func TestIdentityFromCrowdUser(t *testing.T) {
 	// unset
 	expectEquals(t, i.PreferredUsername, "")
 
-	c.Config.PreferredUsernameField = "key"
+	c.PreferredUsernameField = "key"
 	i = c.identityFromCrowdUser(user)
 	expectEquals(t, i.PreferredUsername, "12345")
 
-	c.Config.PreferredUsernameField = "name"
+	c.PreferredUsernameField = "name"
 	i = c.identityFromCrowdUser(user)
 	expectEquals(t, i.PreferredUsername, "testuser")
 
-	c.Config.PreferredUsernameField = "email"
+	c.PreferredUsernameField = "email"
 	i = c.identityFromCrowdUser(user)
 	expectEquals(t, i.PreferredUsername, "testuser@example.com")
 
-	c.Config.PreferredUsernameField = "invalidstring"
+	c.PreferredUsernameField = "invalidstring"
 	i = c.identityFromCrowdUser(user)
 	expectEquals(t, i.PreferredUsername, "")
 }

connector/keystone/keystone.go

@@ -491,8 +491,8 @@ func getUser(ctx context.Context, client *http.Client, baseURL, userID, token st
 
 // getAllGroupsForUser returns all groups for a user (local groups + SSO groups + role groups)
 func getAllGroupsForUser(ctx context.Context, client *http.Client, baseURL, token, customerName, domainID string, tokenInfo *tokenInfo, logger *slog.Logger) ([]string, error) {
-	var userGroups []string   //nolint:prealloc
-	var userGroupIDs []string //nolint:prealloc
+	var userGroups []string
+	var userGroupIDs []string
 
 	allGroups, err := getAllKeystoneGroups(ctx, client, baseURL, token)
 	if err != nil {

server/oauth2.go

@@ -402,16 +402,16 @@ func (s *Server) newIDToken(ctx context.Context, clientID string, claims storage
 	}
 
 	for _, scope := range scopes {
-		switch {
-		case scope == scopeEmail:
+		switch scope {
+		case scopeEmail:
 			tok.Email = claims.Email
 			tok.EmailVerified = &claims.EmailVerified
-		case scope == scopeGroups:
+		case scopeGroups:
 			tok.Groups = claims.Groups
-		case scope == scopeProfile:
+		case scopeProfile:
 			tok.Name = claims.Username
 			tok.PreferredUsername = claims.PreferredUsername
-		case scope == scopeFederatedID:
+		case scopeFederatedID:
 			tok.FederatedIDClaims = &federatedIDClaims{
 				ConnectorID: connID,
 				UserID:      claims.UserID,
@@ -720,7 +720,7 @@ func (s *storageKeySet) VerifySignature(ctx context.Context, jwt string) (payloa
 		break
 	}
 
-	skeys, err := s.Storage.GetKeys(ctx)
+	skeys, err := s.GetKeys(ctx)
 	if err != nil {
 		return nil, err
 	}

server/rotation.go

@@ -128,7 +128,7 @@ func (k keyRotator) rotate() error {
 	}
 
 	var nextRotation time.Time
-	err = k.Storage.UpdateKeys(context.Background(), func(keys storage.Keys) (storage.Keys, error) {
+	err = k.UpdateKeys(context.Background(), func(keys storage.Keys) (storage.Keys, error) {
 		tNow := k.now()
 
 		// if you are running multiple instances of dex, another instance

storage/conformance/conformance.go

@@ -508,7 +508,7 @@ func testPasswordCRUD(t *testing.T, s storage.Storage) {
 	password1.Username = "jane doe"
 	getAndCompare("jane@example.com", password1)
 
-	var passwordList []storage.Password
+	passwordList := make([]storage.Password, 0, 2)
 	passwordList = append(passwordList, password1, password2)
 
 	listAndCompare := func(want []storage.Password) {

storage/kubernetes/lock.go

@@ -58,7 +58,7 @@ func (l *refreshTokenLock) Unlock(id string) {
 	}
 
 	r.Annotations = nil
-	err = l.cli.put(resourceRefreshToken, r.ObjectMeta.Name, r)
+	err = l.cli.put(resourceRefreshToken, r.Name, r)
 	if err != nil {
 		l.cli.logger.Debug("failed to release lock for refresh token", "token_id", id, "err", err)
 	}
@@ -82,7 +82,7 @@ func (l *refreshTokenLock) setLockAnnotation(id string) (bool, error) {
 		}
 
 		r.Annotations = lockData
-		err := l.cli.put(resourceRefreshToken, r.ObjectMeta.Name, r)
+		err := l.cli.put(resourceRefreshToken, r.Name, r)
 		if err == nil {
 			return false, nil
 		}
@@ -108,7 +108,7 @@ func (l *refreshTokenLock) setLockAnnotation(id string) (bool, error) {
 	// Lock time is out, lets break the lock and take the advantage
 	r.Annotations = lockData
 
-	err = l.cli.put(resourceRefreshToken, r.ObjectMeta.Name, r)
+	err = l.cli.put(resourceRefreshToken, r.Name, r)
 	if err == nil {
 		// break lock annotation
 		return false, nil