Use release environment in release workflow

.github/workflows/release.yml

@@ -1,17 +1,50 @@
 name: Release
 
 on:
+  workflow_dispatch:
+  pull_request:
   push:
-    tags:
-      - 'v*'
-
-permissions:
-  contents: write
+    branches:
+      - main
+  release:
+    types:
+      - published
 
 jobs:
+  goreleaser-check:
+    name: Check GoReleaser
+    if: github.event_name != 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          submodules: recursive
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version: '1.25'
+          cache: false
+
+      - name: Check GoReleaser
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --snapshot --clean --skip=publish
+
   goreleaser:
     name: Release with GoReleaser
+    if: github.event_name == 'release' && github.event.action == 'published'
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.golangci.yml

@@ -53,6 +53,9 @@ linters:
 
     - gocognit
 
+    # Replaced by gomodguard_v2.
+    - gomodguard
+
     # We don't want to forbid TODO, FIXME, etc.
     - godox
 
@@ -309,92 +312,90 @@ linters:
       toolchain-forbidden: true
       go-version-pattern: \d\.\d+(\.0)?
 
-    # IMPORTANT: gomodguard blocks _modules_, not arbitrary packages. Be
+    # IMPORTANT: gomodguard_v2 blocks _modules_, not arbitrary packages. Be
     # sure to use the module path from the go.mod file for these.
     # See https://github.com/ryancurrah/gomodguard/issues/12
-    gomodguard:
+    gomodguard_v2:
       blocked:
-        modules:
-          - github.com/avct/uasurfer:
-              recommendations:
-                - github.com/xavivars/uasurfer
-              reason: The original avct module appears abandoned.
-          - github.com/BurntSushi/toml:
-              recommendations:
-                - github.com/pelletier/go-toml/v2
-              reason: This library panics frequently on invalid input.
-          - github.com/pelletier/go-toml:
-              recommendations:
-                - github.com/pelletier/go-toml/v2
-              reason: This is an outdated version.
-          - github.com/gofrs/uuid:
-              recommendations:
-                - github.com/google/uuid
-          - github.com/gofrs/uuid/v5:
-              recommendations:
-                - github.com/google/uuid
-          - github.com/satori/go.uuid:
-              recommendations:
-                - github.com/google/uuid
-          - github.com/google/uuid:
-              recommendations:
-                - github.com/google/uuid
-          - github.com/lib/pq:
-              recommendations:
-                - github.com/jackc/pgx
-              reason: This library is no longer actively maintained.
-          - github.com/neilotoole/errgroup:
-              recommendations:
-                - golang.org/x/sync/errgroup
-              reason: This library can lead to subtle deadlocks in certain use cases.
-          - github.com/pariz/gountries:
-              reason: This library's data is not actively maintained. Use GeoInfo data.
-            github.com/pkg/errors:
-              recommendations:
-                - errors
-              reason: pkg/errors is no longer maintained.
-          - github.com/RackSec/srslog:
-              recommendations:
-                - log/syslog
-              reason: This library's data is not actively maintained.
-          - github.com/ua-parser/uap-go:
-              recommendations:
-                - github.com/xavivars/uasurfer
-              reason: The performance of this library is absolutely abysmal.
-          - github.com/ugorji/go:
-              recommendations:
-                - encoding/json
-                - github.com/mailru/easyjson
-              reason: This library is poorly maintained. We should default to using encoding/json and use easyjson where performance really matters.
-          - github.com/zeebo/assert:
-              recommendations:
-                - github.com/stretchr/testify/assert
-              reason: Use github.com/stretchr/testify/assert
-          - gopkg.in/yaml.v2:
-              recommendations:
-                - github.com/goccy/go-yaml
-              reason: Not actively maintained.
-          - gopkg.in/yaml.v3:
-              recommendations:
-                - github.com/goccy/go-yaml
-              reason: Not actively maintained.
-          - gotest.tools/v3:
-              recommendations:
-                - github.com/stretchr/testify/assert
-              reason: Use github.com/stretchr/testify/assert
-          - inet.af/netaddr:
-              recommendations:
-                - net/netip
-                - go4.org/netipx
-              reason: inet.af/netaddr has been deprecated.
-        versions:
-          - github.com/jackc/pgconn:
-              reason: Use github.com/jackc/pgx/v5
-          - github.com/jackc/pgtype:
-              reason: Use github.com/jackc/pgx/v5
-          - github.com/jackc/pgx:
-              version: < 5.0.0
-              reason: Use github.com/jackc/pgx/v5
+        - module: github.com/avct/uasurfer
+          recommendations:
+            - github.com/xavivars/uasurfer
+          reason: The original avct module appears abandoned.
+        - module: github.com/BurntSushi/toml
+          recommendations:
+            - github.com/pelletier/go-toml/v2
+          reason: This library panics frequently on invalid input.
+        - module: github.com/pelletier/go-toml
+          recommendations:
+            - github.com/pelletier/go-toml/v2
+          reason: This is an outdated version.
+        - module: github.com/gofrs/uuid
+          recommendations:
+            - github.com/google/uuid
+        - module: github.com/gofrs/uuid/v5
+          recommendations:
+            - github.com/google/uuid
+        - module: github.com/satori/go.uuid
+          recommendations:
+            - github.com/google/uuid
+        - module: github.com/google/uuid
+          recommendations:
+            - github.com/google/uuid
+        - module: github.com/lib/pq
+          recommendations:
+            - github.com/jackc/pgx
+          reason: This library is no longer actively maintained.
+        - module: github.com/neilotoole/errgroup
+          recommendations:
+            - golang.org/x/sync/errgroup
+          reason: This library can lead to subtle deadlocks in certain use cases.
+        - module: github.com/pariz/gountries
+          reason: This library's data is not actively maintained. Use GeoInfo data.
+        - module: github.com/pkg/errors
+          recommendations:
+            - errors
+          reason: pkg/errors is no longer maintained.
+        - module: github.com/RackSec/srslog
+          recommendations:
+            - log/syslog
+          reason: This library's data is not actively maintained.
+        - module: github.com/ua-parser/uap-go
+          recommendations:
+            - github.com/xavivars/uasurfer
+          reason: The performance of this library is absolutely abysmal.
+        - module: github.com/ugorji/go
+          recommendations:
+            - encoding/json
+            - github.com/mailru/easyjson
+          reason: This library is poorly maintained. We should default to using encoding/json and use easyjson where performance really matters.
+        - module: github.com/zeebo/assert
+          recommendations:
+            - github.com/stretchr/testify/assert
+          reason: Use github.com/stretchr/testify/assert
+        - module: gopkg.in/yaml.v2
+          recommendations:
+            - github.com/goccy/go-yaml
+          reason: Not actively maintained.
+        - module: gopkg.in/yaml.v3
+          recommendations:
+            - github.com/goccy/go-yaml
+          reason: Not actively maintained.
+        - module: gotest.tools/v3
+          recommendations:
+            - github.com/stretchr/testify/assert
+          reason: Use github.com/stretchr/testify/assert
+        - module: inet.af/netaddr
+          recommendations:
+            - net/netip
+            - go4.org/netipx
+          reason: inet.af/netaddr has been deprecated.
+        - module: github.com/jackc/pgconn
+          reason: Use github.com/jackc/pgx/v5
+        - module: github.com/jackc/pgtype
+          reason: Use github.com/jackc/pgx/v5
+        - module: github.com/jackc/pgx
+          version: < 5.0.0
+          reason: Use github.com/jackc/pgx/v5
 
     gosec:
       excludes: