[DTLP]

• .golangci.yml: v2 format (gas → gosec, gofmt as a formatter, check-shadowing → govet.enable: [shadow]).
  • Same linters, settings and exclusions as before, each exclusion now scoped to its linter. contract and .pb.go
    path skips kept.
  • govet and ineffassign listed explicitly (implicit v1 defaults).
  • staticcheck pinned to the SA checks (all, -S*, -ST*). v2 merges gosimple and stylecheck into it, and
    v1 had both off.
  • Dropped only options v2 no longer supports, and settings for linters that are off.
• Dockerfile / Makefile: version pinned to v2.15.0 and the install script fetched from the tag, not master.
  The Makefile reads the version from the Dockerfile, fails if it's missing, and reinstalls on version mismatch.
• Dockerfile: GOTOOLCHAIN is now exported. It was a plain shell variable, so the pinned toolchain was never
  applied.
• cli.go: removed dead exec.LookPath/exec.Command (dumpCmd was always reassigned, so no behaviour
  change). Use errBuff.String(). Scoped //nolint:errcheck on the two <-doneCh receives, which v2 flags.
• cmd_test.go: ioutil.TempFile → os.CreateTemp.
• golangci-lint run on v2.15.0: 0 issues.
• go test ./... passes.
• docker build .: to confirm before merge. CI only runs the Docker lint step on push to master.

[hectorhuertas]

Reviewed at 35c285d. I ran the tooling locally and reproduced the PR's claims: golangci-lint v2.15.0 run → 0 issues, make lint → 0 issues, go test ./... passes. And answering the open question in the description: docker build . succeeds end-to-end (tests + lint + build, ~154s; no toolchain download needed because golang:1.27-alpine currently ships exactly go1.27.3).

Migration is sound overall: version: "2", gas→gosec, gofmt→formatters, default: none with govet/ineffassign listed explicitly, and correctly not copying migrate's "disable staticcheck/unused" artefact (that's what golangci-lint migrate emits because of the legacy megacheck entry — good call ignoring it; note migrate can't run on this file at all since it rejects run.skip-*/output.format, so the hand migration was necessary).

Should fix

1. .golangci.yml:30-33 — checks: ["all", "-S*", "-ST*"] also enables the QF checks, contrary to the comment

v2 folds gosimple (S), stylecheck (ST) and quickfix (QF) into staticcheck, and all includes QF — which v1 never ran. Verified with a probe file:

p/a.go:13:5: QF1001: could apply De Morgan's law (staticcheck)

The stated intent ("keep only the SA checks") is exactly checks: ["SA*"]. I patched that in and the repo is still 0 issues, so it's a safe drop-in.

2. Makefile:35-37 — a failed wget is masked by the pipe, so make lint fails later with a confusing message

wget … | sh -s … returns sh's exit status, so a failed download "succeeds", and lint then dies with make: ./bin/golangci-lint: No such file or directory (I reproduced this by making wget fail). Given this PR is about deterministic installs, worth hardening:

@if ! ./bin/$(LINTER) version 2>/dev/null | grep -qwF "$(LINTER_VERSION:v%=%)"; then \
	wget -O $(LINTER).install.sh -q https://raw.githubusercontent.com/golangci/golangci-lint/$(LINTER_VERSION)/install.sh && \
	sh $(LINTER).install.sh -s $(LINTER_VERSION) && test -x ./bin/$(LINTER); \
fi

(or set -o pipefail via SHELL := /bin/bash). The same wget | sh pattern is in the Dockerfile:14; there the next command at least fails, but with a misleading error.

Nits / suggestions

3. run.timeout is unset. In v2 the default is disabled (--timeout: "Disabled by default"). v1's deadline: 20s is gone and the Dockerfile runs golangci-lint run with no --timeout (only the Makefile passes --timeout=10m), so the build-stage lint can now hang indefinitely. Consider run.timeout: 10m in the config.
4. cmd_test.go, while you're in there: TestDumperFromFlags_Timeout (L120) still uses the prefix "TestDumperFromFlags_ValidBinaryPath" (copy-paste), and neither temp file is Close()d before os.Remove — defer f.Close() avoids leaking an fd for the test process.
5. Dockerfile:8-11, GOTOOLCHAIN pin — worth one more line in the comment. It's an exact pin: today's base image already has 1.27.3 so nothing downloads, but once golang:1.27-alpine floats to 1.27.4+, every build will download the 1.27.3 toolchain (~100 MB) from the proxy. That's the intended trade-off, it just isn't obvious from the comment as written.
6. Pre-existing, now more visible: the deleted line was the only reader of CliDumper.Flags, so --dbcli-flags is accepted and silently ignored (the pg_dump branch builds its args without it). Follow-up: wire it into the args or drop the flag + field.
7. .golangci.yml:37-40 paths: [contract, '\.pb\.go'] — a bare contract also matches e.g. internal/contracts/; ^contract/ is tighter. Also the v1 implicit default dir exclusions are gone entirely (vendor$, testdata$, …). FYI I tested the third_party$/builtin$/examples$ set that migrate emits: it does not actually exclude files inside those dirs (only a bare examples regex does), and no such dirs exist here — so no practical impact, just don't be surprised.
8. bin/ isn't in .gitignore, so make lint leaves an untracked bin/ behind (pre-existing, one-line fix).

Verified as correct

• The two //nolint:errcheck additions are genuinely required: v2's errcheck added channel-receive checking — removing them yields exactly those 2 errors. Correctly scoped and documented.
• Makefile version detection: parses ENV GOLANGCI_LINT_VERSION="…" from the Dockerfile, strips the v, grep -qwFs the installed binary's version, and reinstalls on mismatch (verified by faking a 1.0.0 binary). Fails loudly when the Dockerfile line is absent.
• errBuff.String(), os.CreateTemp and the dead-dumpCmd removal are behaviour-preserving (exec.Command does its own LookPath; the switch's default: returns before dumpCmd is dereferenced, so no nil-pointer risk).

Nothing here is a blocker IMO — items 1 and 2 are the only ones I'd want in before merge.