fix: upgrade golangci-lint to v2.8.0 and resolve all linting issues

- Upgrade golangci-lint from v1.64.8 to v2.8.0 for Go 1.24 support
- Migrate .golangci.yml to v2 format with version declaration
- Use official golangci-lint-action@v9 in CI for better performance
- Fix linting issues in check-plugin-counts.go (unchecked error, formatting)
- Fix error message capitalization in config.go (ST1005)
- Apply De Morgan's law in cache.go for cleaner validation (QF1001)
- Add pre-push checklist to CLAUDE.md with linting requirements

All linting now passes with 0 issues. CI will no longer fail on lint step.

Author: itsdevcoffee

.github/workflows/ci.yml

@@ -43,19 +43,11 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Check formatting
-        run: |
-          if [ -n "$(gofmt -l .)" ]; then
-            echo "Go files are not formatted. Run 'gofmt -w .'"
-            gofmt -l .
-            exit 1
-          fi
-
-      - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8
-
       - name: Run golangci-lint
-        run: golangci-lint run --timeout=5m --out-format=colored-line-number
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.8.0
+          args: --timeout=5m
 
   vuln-check:
     name: Vulnerability Check

.golangci.yml

@@ -1,73 +1,60 @@
+version: "2"
 run:
-  timeout: 5m
-  tests: true
   modules-download-mode: readonly
-
+  tests: true
 linters:
   enable:
-    - errcheck      # Check for unchecked errors
-    - gosimple      # Simplify code
-    - govet         # Reports suspicious constructs
-    - ineffassign   # Detect ineffectual assignments
-    - staticcheck   # Static analysis
-    - unused        # Check for unused constants, variables, functions
-    - gofmt         # Check code formatting
-    - goimports     # Check import formatting
-    - misspell      # Check for misspelled English words
-    - gosec         # Security-focused linter
-    - revive        # Drop-in replacement for golint (style issues)
-    - unconvert     # Unnecessary type conversions
-    # Disable unparam and prealloc - too strict for existing code
-    # - unparam       # Unused function parameters
-    # - prealloc      # Slice preallocation opportunities
-    - gocyclo       # Cyclomatic complexity
-    - gocritic      # Comprehensive Go linter (with disabled checks)
-
-linters-settings:
-  gosec:
-    excludes:
-      - G104  # We handle unhandled errors contextually
-      - G304  # Allow file inclusion in tests with variables
-    confidence: medium
-
-  errcheck:
-    check-blank: false
-    check-type-assertions: false
-
-  gocyclo:
-    # We have known high-complexity functions (handleDetailKeys: 35, handleListKeys: 31)
-    # Set threshold to 40 to catch regressions without failing on existing code
-    # TODO: Refactor to <15 in Phase 4
-    min-complexity: 40
-
-  revive:
-    severity: warning
-    rules:
-      - name: exported
-        severity: warning
-        disabled: true  # Disable to allow existing patterns
-      - name: error-return
-      - name: error-naming
-      - name: if-return
-      - name: var-naming
-      - name: indent-error-flow
-        disabled: true  # Disable to allow existing else-after-return patterns
-
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      # Disable style and performance for now - too strict for existing code
-    disabled-checks:
-      - unnecessaryBlock  # Sometimes explicit blocks improve readability
-      - octalLiteral      # Allow old octal syntax (0750 vs 0o750)
-      - rangeValCopy      # Allow range value copies for readability
-      - hugeParam         # Allow passing structs by value (existing pattern)
-      - httpNoBody        # Allow nil request bodies (existing pattern)
-      - ifElseChain       # Allow if-else chains (existing pattern)
-      - emptyStringTest   # Allow len(s) > 0 pattern (existing code)
-      - singleCaseSwitch  # Allow single-case switch statements
-
+    - gocritic
+    - gocyclo
+    - gosec
+    - misspell
+    - revive
+    - unconvert
+  settings:
+    errcheck:
+      check-type-assertions: false
+      check-blank: false
+    gocritic:
+      enabled-tags:
+        - diagnostic
+      disabled-checks:
+        - ifElseChain
+        - singleCaseSwitch
+    gocyclo:
+      min-complexity: 40
+    gosec:
+      excludes:
+        - G104
+        - G304
+      confidence: medium
+    revive:
+      severity: warning
+      rules:
+        - name: exported
+          severity: warning
+          disabled: true
+        - name: error-return
+        - name: error-naming
+        - name: if-return
+        - name: var-naming
+        - name: indent-error-flow
+          disabled: true
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

CLAUDE.md

@@ -1,5 +1,25 @@
 # Plum Project Guide
 
+## Pre-Push Checklist
+
+**ALWAYS run before pushing to main:**
+
+```bash
+# 1. Run linter (must pass)
+golangci-lint run --timeout=5m
+
+# 2. Run tests (must pass)
+go test ./...
+
+# 3. Verify build succeeds
+go build -o ./plum ./cmd/plum
+```
+
+**If linter is not installed:**
+```bash
+go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.8.0
+```
+
 ## Routine Maintenance
 
 **At the start of each session**, check marketplace data freshness:
@@ -16,8 +36,9 @@ go run scripts/check-plugin-counts.go
 - Update `internal/marketplace/discovery.go` with new stats and plugin counts
 - Update `README.md` marketplace table with accurate counts
 - Update total plugin count in README intro and features section
-- Run: `go test ./internal/marketplace && go build -o ./plum ./cmd/plum`
+- Run pre-push checklist above
 
 ## Why This Matters
 
-The README is users' first impression - accurate plugin counts and GitHub stats help them make informed decisions about installation.
+- **Linting** - CI will fail if linting doesn't pass locally. Always lint before pushing.
+- **Accurate Data** - The README is users' first impression. Accurate plugin counts and GitHub stats help them make informed decisions about installation.

internal/config/config.go

@@ -55,7 +55,7 @@ func LoadKnownMarketplaces() (KnownMarketplaces, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
-			return nil, fmt.Errorf("Claude Code marketplaces not found at %s.\n\nPlease run Claude Code and configure at least one marketplace using the /plugin command.", path)
+			return nil, fmt.Errorf("claude Code marketplaces not found at %s - please run Claude Code and configure at least one marketplace using the /plugin command", path)
 		}
 		return nil, err
 	}

internal/marketplace/cache.go

@@ -43,8 +43,8 @@ func validateMarketplaceName(name string) error {
 
 	// Only allow safe characters: alphanumeric, dash, underscore, dot
 	for _, r := range name {
-		if !((r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') ||
-			(r >= '0' && r <= '9') || r == '-' || r == '_' || r == '.') {
+		if (r < 'a' || r > 'z') && (r < 'A' || r > 'Z') &&
+			(r < '0' || r > '9') && r != '-' && r != '_' && r != '.' {
 			return fmt.Errorf("marketplace name contains invalid character %q", r)
 		}
 	}

scripts/check-plugin-counts.go

@@ -9,23 +9,23 @@ import (
 )
 
 type MarketplaceManifest struct {
-	Name    string                 `json:"name"`
+	Name    string                   `json:"name"`
 	Plugins []map[string]interface{} `json:"plugins"`
 }
 
 var marketplaces = map[string]string{
-	"claude-code-plugins-plus":   "jeremylongshore/claude-code-plugins-plus-skills",
-	"claude-code-marketplace":    "ananddtyagi/cc-marketplace",
-	"claude-code-plugins":        "anthropics/claude-code",
-	"mag-claude-plugins":         "MadAppGang/claude-code",
-	"dev-gom-plugins":            "Dev-GOM/claude-code-marketplace",
-	"feedmob-claude-plugins":     "feed-mob/claude-code-marketplace",
-	"claude-plugins-official":    "anthropics/claude-plugins-official",
-	"anthropic-agent-skills":     "anthropics/skills",
-	"wshobson-agents":            "wshobson/agents",
-	"docker-plugins":             "docker/claude-plugins",
-	"ccplugins-marketplace":      "ccplugins/marketplace",
-	"claude-mem":                 "thedotmack/claude-mem",
+	"claude-code-plugins-plus": "jeremylongshore/claude-code-plugins-plus-skills",
+	"claude-code-marketplace":  "ananddtyagi/cc-marketplace",
+	"claude-code-plugins":      "anthropics/claude-code",
+	"mag-claude-plugins":       "MadAppGang/claude-code",
+	"dev-gom-plugins":          "Dev-GOM/claude-code-marketplace",
+	"feedmob-claude-plugins":   "feed-mob/claude-code-marketplace",
+	"claude-plugins-official":  "anthropics/claude-plugins-official",
+	"anthropic-agent-skills":   "anthropics/skills",
+	"wshobson-agents":          "wshobson/agents",
+	"docker-plugins":           "docker/claude-plugins",
+	"ccplugins-marketplace":    "ccplugins/marketplace",
+	"claude-mem":               "thedotmack/claude-mem",
 }
 
 func fetchPluginCount(repo string) (int, error) {
@@ -36,7 +36,9 @@ func fetchPluginCount(repo string) (int, error) {
 	if err != nil {
 		return 0, err
 	}
-	defer resp.Body.Close()
+	defer func() {
+		_ = resp.Body.Close()
+	}()
 
 	if resp.StatusCode != 200 {
 		return 0, fmt.Errorf("HTTP %d", resp.StatusCode)