ci: upgrade golangci-lint for Go 1.26 and fix all findings

The Go 1.26 toolchain bump requires a newer golangci-lint (the pinned v2.1.6,
built with Go 1.24, refuses a 1.26 target). Bump to v2.12.2 in lint.yml and the
Makefile, set lint.yml's Go to 1.26, and resolve every finding the newer linter
surfaces so full `golangci-lint run ./...` passes.

Fixes:
- staticcheck (deprecations): migrate webhook validators/defaulters from the
  deprecated CustomValidator/CustomDefaulter to the typed admission.Validator[T]
  / Defaulter[T] API; migrate api/* and internal/config scheme.Builder to
  runtime.NewSchemeBuilder; SchemeGroupVersion -> GroupVersion; drop the
  deprecated rateLimit.Type check (the Global guard already forbids global rate
  limiting); client.Apply left with a justified nolint (the typed Client.Apply
  needs a generated ApplyConfiguration — tracked for follow-up).
- goconst: extract package-level consts for repeated literals in production code.
- prealloc / unconvert: preallocate flagged slices; drop a redundant conversion.

Lint-policy tuning (idiomatic-pattern noise, not code smells):
- exclude goconst in *_test.go (fixture/table data hurts readability as consts)
- exclude prealloc in internal/validation (field.ErrorList accumulators)

Verified: golangci-lint run ./... = 0 issues; go build/vet/test ./... all pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: scotwells

.github/workflows/lint.yml

@@ -15,9 +15,9 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '~1.24'
+          go-version: '~1.26'
 
       - name: Run linter
         uses: golangci/golangci-lint-action@v7
         with:
-          version: v2.1.6
+          version: v2.12.2

.golangci.yml

@@ -37,6 +37,17 @@ linters:
           - dupl
           - lll
         path: internal/*
+      # Repeated string literals in tests are usually fixture/table data;
+      # extracting them to constants hurts readability more than it helps.
+      - linters:
+          - goconst
+        path: _test\.go
+      # The validation packages are built almost entirely from field.ErrorList
+      # accumulators that hold a handful of errors; preallocating them adds noise
+      # without meaningful benefit.
+      - linters:
+          - prealloc
+        path: internal/validation
     paths:
       - third_party$
       - builtin$

Makefile

@@ -241,7 +241,7 @@ KUSTOMIZE_VERSION ?= v5.5.0
 CONTROLLER_TOOLS_VERSION ?= v0.16.4
 DEFAULTER_GEN_VERSION ?= v0.32.3
 ENVTEST_VERSION ?= release-0.19
-GOLANGCI_LINT_VERSION ?= v2.1.6
+GOLANGCI_LINT_VERSION ?= v2.12.2
 
 # renovate: datasource=go depName=github.com/cert-manager/cert-manager
 CERTMANAGER_VERSION ?= 1.17.1

api/v1alpha/domain_types.go

@@ -229,7 +229,3 @@ type DomainList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []Domain `json:"items"`
 }
-
-func init() {
-	SchemeBuilder.Register(&Domain{}, &DomainList{})
-}

api/v1alpha/groupversion_info.go

@@ -6,17 +6,47 @@
 package v1alpha
 
 import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
-	"sigs.k8s.io/controller-runtime/pkg/scheme"
 )
 
 var (
 	// GroupVersion is group version used to register these objects.
 	GroupVersion = schema.GroupVersion{Group: "networking.datumapis.com", Version: "v1alpha"}
 
 	// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
-	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
 
 	// AddToScheme adds the types in this group-version to the given scheme.
 	AddToScheme = SchemeBuilder.AddToScheme
 )
+
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(GroupVersion,
+		&Domain{},
+		&DomainList{},
+		&HTTPProxy{},
+		&HTTPProxyList{},
+		&Location{},
+		&LocationList{},
+		&LocationBinding{},
+		&LocationBindingList{},
+		&Network{},
+		&NetworkList{},
+		&NetworkBinding{},
+		&NetworkBindingList{},
+		&NetworkContext{},
+		&NetworkContextList{},
+		&NetworkPolicy{},
+		&NetworkPolicyList{},
+		&Subnet{},
+		&SubnetList{},
+		&SubnetClaim{},
+		&SubnetClaimList{},
+		&TrafficProtectionPolicy{},
+		&TrafficProtectionPolicyList{},
+	)
+	metav1.AddToGroupVersion(scheme, GroupVersion)
+	return nil
+}

api/v1alpha/httpproxy_types.go

@@ -459,7 +459,3 @@ type HTTPProxyList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []HTTPProxy `json:"items"`
 }
-
-func init() {
-	SchemeBuilder.Register(&HTTPProxy{}, &HTTPProxyList{})
-}

api/v1alpha/httpproxy_types_test.go

@@ -14,15 +14,19 @@ import (
 	networkingv1alpha "go.datum.net/network-services-operator/api/v1alpha"
 )
 
-const testMutatedHostname = "mutated.example.com"
+const (
+	testMutatedHostname          = "mutated.example.com"
+	testAPIHostname              = "api.example.com"
+	testCanonicalGatewayHostname = "abc123.gateways.test.local"
+)
 
 // TestHostnameStatus_DeepCopy verifies that DeepCopy produces an independent
 // copy of a HostnameStatus value with all nested slices properly duplicated.
 func TestHostnameStatus_DeepCopy(t *testing.T) {
 	t.Parallel()
 
 	original := networkingv1alpha.HostnameStatus{
-		Hostname: "api.example.com",
+		Hostname: testAPIHostname,
 		Conditions: []metav1.Condition{
 			{
 				Type:               networkingv1alpha.HostnameConditionDNSRecordProgrammed,
@@ -52,7 +56,7 @@ func TestHostnameStatus_DeepCopy(t *testing.T) {
 	copied.Conditions[0].Message = "mutated message"
 	copied.Conditions = append(copied.Conditions, metav1.Condition{Type: "Extra"})
 
-	assert.Equal(t, "api.example.com", original.Hostname)
+	assert.Equal(t, testAPIHostname, original.Hostname)
 	assert.Equal(t, "cname record created in DNSZone \"example-com\"", original.Conditions[0].Message)
 	assert.Len(t, original.Conditions, 2, "original conditions should not gain extra element")
 }
@@ -87,11 +91,11 @@ func TestHTTPProxyStatus_DeepCopy(t *testing.T) {
 	t.Parallel()
 
 	original := networkingv1alpha.HTTPProxyStatus{
-		CanonicalHostname: "abc123.gateways.test.local",
+		CanonicalHostname: testCanonicalGatewayHostname,
 		Addresses: []gatewayv1.GatewayStatusAddress{
 			{
 				Type:  ptr.To(gatewayv1.HostnameAddressType),
-				Value: "abc123.gateways.test.local",
+				Value: testCanonicalGatewayHostname,
 			},
 			{
 				Type:  ptr.To(gatewayv1.IPAddressType),
@@ -100,7 +104,7 @@ func TestHTTPProxyStatus_DeepCopy(t *testing.T) {
 		},
 		HostnameStatuses: []networkingv1alpha.HostnameStatus{
 			{
-				Hostname: "api.example.com",
+				Hostname: testAPIHostname,
 				Conditions: []metav1.Condition{
 					{
 						Type:   networkingv1alpha.HostnameConditionDNSRecordProgrammed,
@@ -130,11 +134,11 @@ func TestHTTPProxyStatus_DeepCopy(t *testing.T) {
 
 	// Mutation independence – addresses.
 	copied.Addresses[0].Value = "mutated"
-	assert.Equal(t, "abc123.gateways.test.local", original.Addresses[0].Value)
+	assert.Equal(t, testCanonicalGatewayHostname, original.Addresses[0].Value)
 
 	// Mutation independence – hostname statuses.
 	copied.HostnameStatuses[0].Hostname = testMutatedHostname
-	assert.Equal(t, "api.example.com", original.HostnameStatuses[0].Hostname)
+	assert.Equal(t, testAPIHostname, original.HostnameStatuses[0].Hostname)
 
 	// Mutation independence – conditions.
 	copied.Conditions[0].Reason = "Mutated"
@@ -161,13 +165,13 @@ func TestHTTPProxy_DeepCopy(t *testing.T) {
 			Namespace: "default",
 		},
 		Spec: networkingv1alpha.HTTPProxySpec{
-			Hostnames: []gatewayv1.Hostname{"api.example.com", "example.com"},
+			Hostnames: []gatewayv1.Hostname{testAPIHostname, "example.com"},
 		},
 		Status: networkingv1alpha.HTTPProxyStatus{
-			CanonicalHostname: "abc123.gateways.test.local",
+			CanonicalHostname: testCanonicalGatewayHostname,
 			HostnameStatuses: []networkingv1alpha.HostnameStatus{
 				{
-					Hostname: "api.example.com",
+					Hostname: testAPIHostname,
 					Conditions: []metav1.Condition{
 						{
 							Type:   networkingv1alpha.HostnameConditionDNSRecordProgrammed,
@@ -192,13 +196,13 @@ func TestHTTPProxy_DeepCopy(t *testing.T) {
 
 	// Mutation independence.
 	copied.Status.CanonicalHostname = "mutated"
-	assert.Equal(t, "abc123.gateways.test.local", original.Status.CanonicalHostname)
+	assert.Equal(t, testCanonicalGatewayHostname, original.Status.CanonicalHostname)
 
 	copied.Status.HostnameStatuses[0].Hostname = testMutatedHostname
-	assert.Equal(t, "api.example.com", original.Status.HostnameStatuses[0].Hostname)
+	assert.Equal(t, testAPIHostname, original.Status.HostnameStatuses[0].Hostname)
 
 	copied.Spec.Hostnames[0] = testMutatedHostname
-	assert.Equal(t, gatewayv1.Hostname("api.example.com"), original.Spec.Hostnames[0])
+	assert.Equal(t, gatewayv1.Hostname(testAPIHostname), original.Spec.Hostnames[0])
 }
 
 // TestConditionConstants verifies that the expected condition constant strings

api/v1alpha/location_types.go

@@ -106,7 +106,3 @@ type LocationReference struct {
 	// +kubebuilder:validation:Required
 	Namespace string `json:"namespace"`
 }
-
-func init() {
-	SchemeBuilder.Register(&Location{}, &LocationList{})
-}

api/v1alpha/locationbinding_types.go

@@ -63,7 +63,3 @@ type LocationBindingList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []LocationBinding `json:"items"`
 }
-
-func init() {
-	SchemeBuilder.Register(&LocationBinding{}, &LocationBindingList{})
-}

api/v1alpha/network_types.go

@@ -120,7 +120,3 @@ type LocalNetworkRef struct {
 	// +kubebuilder:validation:Required
 	Name string `json:"name,omitempty"`
 }
-
-func init() {
-	SchemeBuilder.Register(&Network{}, &NetworkList{})
-}