chore: bump Go toolchain to 1.26

.github/workflows/tests.yml

@@ -46,9 +46,13 @@ jobs:
             exit 1
           fi
 
-      - uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
+      - uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
           version: latest
+          # No released golangci-lint is built with Go 1.26 yet, and it refuses
+          # to lint a module targeting a newer Go than it was built with. Compile
+          # it from source with this job's Go 1.26 toolchain so the check passes.
+          install-mode: goinstall
 
   build:
     name: Build (${{ matrix.goos }}/${{ matrix.goarch }})

.golangci.yml

@@ -0,0 +1,23 @@
+# golangci-lint configuration.
+#
+# Historically this project ran golangci-lint v1 with no config file, relying on
+# its built-in default exclusions. Building the linter with Go 1.26 requires
+# golangci-lint v2 (see the lint job in .github/workflows/tests.yml), and v2
+# dropped those default exclusions. This config restores the previous effective
+# lint policy so the Go toolchain bump stays scoped and does not churn unrelated
+# code.
+version: "2"
+linters:
+  exclusions:
+    presets:
+      # Restores v1's default errcheck excludes for the standard
+      # error-returning calls that are conventionally ignored
+      # (Close/Flush/os.Remove/os.Setenv/os.Unsetenv/print*). This was the old
+      # built-in EXC0001 rule.
+      - std-error-handling
+    rules:
+      # QF (quickfix) style suggestions were not enforced under v1; keep them
+      # off to preserve the prior policy.
+      - linters:
+          - staticcheck
+        text: "QF1001|QF1002"

.tool-versions

@@ -1 +1 @@
-golang 1.24.13
+golang 1.26.4

README.md

@@ -108,7 +108,7 @@ make build
 ./stepsecurity-dev-machine-guard
 ```
 
-Requires Go 1.24+. The binary has zero external dependencies.
+Requires Go 1.26+. The binary has zero external dependencies.
 
 ## Usage
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/step-security/dev-machine-guard
 
-go 1.24
+go 1.26
 
 require golang.org/x/sys v0.33.0