chore: enable more linter (#688)

Author: jkroepke

.github/workflows/ci.yaml

@@ -19,6 +19,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: 'false'
 
       - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
         with:
@@ -56,6 +58,7 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
+          persist-credentials: 'false'
           fetch-depth: 0
 
       - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
@@ -93,6 +96,9 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: 'false'
+
       - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
         with:
           go-version-file: 'go.mod'
@@ -116,6 +122,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
+          persist-credentials: 'false'
           fetch-depth: 0
 
       - name: Lint Code Base
@@ -124,13 +131,15 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           MULTI_STATUS: false
           LINTER_RULES_PATH: .
+          GITHUB_ACTIONS_ZIZMOR_CONFIG_FILE: ./.github/zizmor.yml
           VALIDATE_ALL_CODEBASE: true
           VALIDATE_BASH: true
           VALIDATE_BASH_EXEC: true
           VALIDATE_EDITORCONFIG: true
           VALIDATE_ENV: true
-          # VALIDATE_GO_RELEASER: true
+          VALIDATE_GO_RELEASER: true
           VALIDATE_GITHUB_ACTIONS: true
+          VALIDATE_GITHUB_ACTIONS_ZIZMOR: true
           VALIDATE_HTML: true
           VALIDATE_JSON: true
           VALIDATE_NATURAL_LANGUAGE: true
@@ -158,6 +167,7 @@ jobs:
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
+          persist-credentials: 'false'
           fetch-depth: 0
 
       - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0

.github/workflows/pr-check.yaml

@@ -8,10 +8,14 @@ on:
       - labeled
       - unlabeled
 
+permissions: {}
+
 jobs:
   required-labels-missing:
     name: required labels missing
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: check
         if: >-

.github/workflows/tag.yaml

@@ -28,12 +28,16 @@ jobs:
 
       - name: Create Tag
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          TAG: ${{ inputs.tag }}
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
+            const tag = process.env.TAG;
+
             github.rest.git.createRef({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              ref: 'refs/tags/${{ inputs.tag }}',
+              ref: 'refs/tags/' + tag,
               sha: context.sha,
             });

.github/workflows/wiki.yaml

@@ -18,8 +18,12 @@ jobs:
 
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: 'false'
+
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
+          persist-credentials: 'true'
           repository: ${{ github.repository }}.wiki
           path: wiki.git
 

.github/zizmor.yml

@@ -0,0 +1,3 @@
+rules:
+  cache-poisoning:
+    disable: true

.golangci.yaml

@@ -71,12 +71,14 @@ linters:
         - name: error-return
         - name: error-strings
         - name: errorf
+        - name: forbidden-call-in-wg-go
         - name: get-return
         - name: identical-branches
         - name: if-return
         - name: import-alias-naming
         - name: import-shadowing
         - name: increment-decrement
+        - name: inefficient-map-lookup
         - name: indent-error-flow
         - name: modifies-parameter
         - name: modifies-value-receiver
@@ -106,6 +108,7 @@ linters:
         - name: time-naming
         - name: unconditional-recursion
         - name: unexported-naming
+        - name: unnecessary-if
         - name: unnecessary-stmt
         - name: unreachable-code
         - name: unused-parameter