ci: add golangci-lint and fix existing lint failures

.github/workflows/golangci-lint.yml

@@ -0,0 +1,24 @@
+name: golangci-lint
+on:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: stable
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: v2.1

.golangci.yml

@@ -0,0 +1,213 @@
+version: "2"
+linters:
+  default: none
+  enable:
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - dogsled
+    - dupl
+    - errcheck
+    - errname
+    - errorlint
+    - exhaustruct
+    - forcetypeassert
+    - gocognit
+    - gocritic
+    - godot
+    - gomodguard
+    - gosec
+    - govet
+    - importas
+    - ineffassign
+    - makezero
+    - misspell
+    - nestif
+    - nilnil
+    # - noctx
+    # - paralleltest
+    - revive
+    - staticcheck
+    # - tparallel
+    - unconvert
+    - unused
+  settings:
+    dupl:
+      threshold: 412
+    godot:
+      scope: all
+      capital: true
+    exhaustruct:
+      include:
+        - httpmw\.\w+
+        - github.com/coder/coder/v2/coderd/database\.[^G][^e][^t]\w+Params
+    gocognit:
+      min-complexity: 300
+    goconst:
+      min-len: 4
+      min-occurrences: 3
+    gocritic:
+      enabled-checks:
+        - badLock
+        - badRegexp
+        - boolExprSimplify
+        - builtinShadow
+        - builtinShadowDecl
+        - commentedOutImport
+        - deferUnlambda
+        - dupImport
+        - dynamicFmtString
+        - emptyDecl
+        - emptyFallthrough
+        - emptyStringTest
+        - evalOrder
+        - externalErrorReassign
+        - filepathJoin
+        - hexLiteral
+        - httpNoBody
+        - importShadow
+        - indexAlloc
+        - initClause
+        - methodExprCall
+        - nestingReduce
+        - nilValReturn
+        - preferFilepathJoin
+        - rangeAppendAll
+        - regexpPattern
+        - redundantSprint
+        - regexpSimplify
+        - ruleguard
+        - sliceClear
+        - sortSlice
+        - sprintfQuotedString
+        - sqlQuery
+        - stringConcatSimplify
+        - stringXbytes
+        - todoCommentWithoutDetail
+        - tooManyResultsChecker
+        - truncateCmp
+        - typeAssertChain
+        - typeDefFirst
+        - unlabelStmt
+        - weakCond
+        - whyNoLint
+      settings:
+        ruleguard:
+          failOn: all
+          rules: ${base-path}/scripts/rules.go
+    gosec:
+      excludes:
+        - G601
+    govet:
+      disable:
+        - loopclosure
+    importas:
+      no-unaliased: true
+    misspell:
+      locale: US
+      ignore-rules:
+        - trialer
+    nestif:
+      min-complexity: 20
+    revive:
+      severity: warning
+      rules:
+        - name: atomic
+        - name: bare-return
+        - name: blank-imports
+        - name: bool-literal-in-expr
+        - name: call-to-gc
+        - name: confusing-results
+        - name: constant-logical-expr
+        - name: context-as-argument
+        - name: context-keys-type
+        # - name: deep-exit
+        - name: defer
+        - name: dot-imports
+        - name: duplicated-imports
+        - name: early-return
+        - name: empty-block
+        - name: empty-lines
+        - name: error-naming
+        - name: error-return
+        - name: error-strings
+        - name: errorf
+        - name: exported
+        - name: flag-parameter
+        - name: get-return
+        - name: identical-branches
+        - name: if-return
+        - name: import-shadowing
+        - name: increment-decrement
+        - name: indent-error-flow
+        - name: modifies-value-receiver
+        - name: package-comments
+        - name: range
+        - name: receiver-naming
+        - name: redefines-builtin-id
+        - name: string-of-int
+        - name: struct-tag
+        - name: superfluous-else
+        - name: time-naming
+        - name: unconditional-recursion
+        - name: unexported-naming
+        - name: unexported-return
+        - name: unhandled-error
+        - name: unnecessary-stmt
+        - name: unreachable-code
+        - name: unused-parameter
+        - name: unused-receiver
+        - name: var-declaration
+        - name: var-naming
+        - name: waitgroup-by-value
+    staticcheck:
+      checks:
+        - all
+        - SA4006  # Detects redundant assignments
+        - SA4009  # Detects redundant variable declarations
+        - SA1019
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - errcheck
+          - exhaustruct
+          - forcetypeassert
+        path: _test\.go
+      - linters:
+          - exhaustruct
+        path: scripts/*
+      - linters:
+          - ALL
+        path: scripts/rules.go
+    paths:
+      - scripts/rules.go
+      - coderd/database/dbmem
+      - node_modules
+      - .git
+      - third_party$
+      - builtin$
+      - examples$
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+  fix: true
+formatters:
+  enable:
+    - goimports
+    - gofmt
+  exclusions:
+    generated: lax
+    paths:
+      - scripts/rules.go
+      - coderd/database/dbmem
+      - node_modules
+      - .git
+      - third_party$
+      - builtin$
+      - examples$