build: bump of Go version to 1.27 along with CI tooling

[sbcrvl]

Hi @kinbiko,

I saw that a PR for this already exists (#50), but for learning purposes I still wanted to give it a try myself 😄

This PR bumps Go to 1.27 and golangci-lint to v2.13.2, and updates the GitHub Actions build job.

Details

Makefile install fix for golangci-lint. While running make lint, the install step failed with a checksum error. The old install script identifies the release file with a loose filename match, so the extra .sbom.json files that newer releases ship break the comparison. Pointing the URL to the recommended install script fixes this, with no other changes to the Makefile.

Reference: #6539. The v2.12.1 changelog also documents this:

if you still use the install URL based on the master branch, please update to https://golangci-lint.run/install.sh.

Lint config. The v1 to v2 config migration expanded the old presets key into a long explicit list of enabled linters, so we ended up with many linters enabled that were never chosen individually:

The migrate command automatically migrates linters.presets in individual linters to linters.enable.
https://golangci-lint.run/docs/product/migration-guide/#linterspresets

Since presets no longer exists in v2, this PR uses the default standard set and keeps only the linters that we explicitly configure. The old disable: list is kept as a safeguard, and two lint warnings are suppressed on purpose:

• goconst ignores test files, because the repeated JSON strings in the table tests are intentional test fixtures
• staticcheck QF1008 is turned off, because it suggests rewriting a.tt.Errorf(...) as a.Errorf(...), and we prefer to keep the style the codebase already uses

Note

Everything else in the config and in the library itself is unchanged, and make check passes.

Closes #49

Checklist

• I have done a self-review of this PR.

[sbcrvl]

One small note: the linter quickfix flagged a.tt.Errorf(...) calls across the repo, since the tt. prefix is technically redundant (see QF1008) in theory it is safe to remove these calls. I chose to keep the style as-is and turn off that single quickfix instead. It felt like a change that deserves its own consideration and PR, separate from a version bump.

[kinbiko]

I've reviewed this code before reviewing the other PR's most recent changes. There's a good chance I'll merge the other PR (don't know yet). If I do, we can discuss other things you can contribute.

[kinbiko]

I think this is leftover copy+pasta, and can be removed.

[kinbiko]

I do actually like the idea of having new linters being introduced as the language and best practices evolve causing build failures, instead of having to manually keep track of linters being introduced in golangci-lint.

As an exercise there's value in learning about the judgments in the linter violations that'll (presumably) appear if we keep the configs/disabled list the same (up to renames).

[kinbiko]

Can simplify here I think.

Suggested change

	- linters:
	- dupl
	- errcheck
	- errchkjson
	- forbidigo
	- funlen
	- gocognit
	- gocyclo
	- lll
	- mnd
	- staticcheck
	- testpackage
	path: _test\.go
	paths:
	- third_party$
	- builtin$
	- examples$
	- linters:
	- gocognit
	- funlen
	- lll
	path: _test\.go

[kinbiko]

Nah, I think it should be included. I do expect changes to .go files as part of this change, as the code is updated to adopt to the new language idioms.

[kinbiko]

I don't think these exist.

[kinbiko]

This solutions is alright, but since 1.24, Go has added the idea of a dev-dependency.
I'd like to use this to maintain the golangci-lint version in a more idiomatic way, that tools like dependabot understand.

A requirement that's likely going to make the naive and obvious solution insufficient: The github.com/kinbiko/jsonassert module MUST have 0 transitive dependencies, i.e. any users of this library should not implicitly download linter-related code.