ci: local↔CI test parity — make verify + pinned golangci-lint + .golangci.yml

[bdchatham]

Closes the gap that let staticcheck violations slip to CI on #46/#48: our local loop ran build+test+vet (no golangci-lint), and CI's linter was unpinned (latest).

What (parity + determinism, not a CI rewrite)

• make verify = lint + test + check-bindings — runs exactly what CI gates, in one command. Run it before pushing.
• Pinned golangci-lint v2.12.2 across all three surfaces: the build-and-test.yml action (latest→v2.12.2), a Makefile GOLANGCI_VERSION + make install-lint, and a new .golangci.yml that freezes the enabled linter set (v2.12.2 defaults: errcheck, govet, ineffassign, staticcheck, unused). make lint warns if your PATH binary drifts.
• README "Before you push" section documenting the flow.

Why

go vet doesn't run staticcheck; CI's golangci-lint does — and version: latest drifts (local 2.12.1 vs CI 2.12.2). Pinning + a single verify target makes local results match CI deterministically.

Review

Idiom: clean (mirrors the existing SOLC_VERSION/GETH_VERSION pinning convention). Security: net supply-chain improvement (pinning narrows drift; go install @v2.12.2 is checksum-DB-backed) — no token/permission/trigger changes.

Tracked: PLT-474. (Deferred, noted in review: SHA-pinning the @v7 action major — pre-existing repo convention, repo-wide pass.)

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Tooling and documentation only; no runtime, auth, or application logic changes. Pinning improves supply-chain determinism versus latest.

Overview
Closes the gap where local dev could pass while CI failed on staticcheck and drifting golangci-lint versions.

make verify runs lint + test + check-bindings, matching the gating build-and-test and bindings-check workflows in one command.

golangci-lint v2.12.2 is pinned in three places (workflow action, Makefile GOLANGCI_VERSION, new .golangci.yml) with an explicit enabled linter set (errcheck, govet, ineffassign, staticcheck, unused). make install-lint installs that version; make lint warns if PATH differs. install-tools now includes the linter.

README adds a Before you push section documenting make verify and the pinning rationale.

^{Reviewed by Cursor Bugbot for commit 58e0dfc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 58e0dfc. Configure here.}

[cursor]

Verify omits build job steps

Medium Severity

make verify runs only lint, test, and check-bindings, but the README and Makefile say a green run means the build-and-test job will pass. That workflow also runs make build, --help, and a dry-run smoke test, and the root main package has no tests so go test ./... may not compile it.

Additional Locations (2)

• Makefile#L246-L250
• Makefile#L64-L65

 

^{Reviewed by Cursor Bugbot for commit 58e0dfc. Configure here.}