From 4d4bc09b8618bce96fcc820fa1fed7f55948cef1 Mon Sep 17 00:00:00 2001
From: Hein <hein.puth@gmail.com>
Date: Thu, 3 Sep 2026 21:25:27 +0200
Subject: [PATCH] fix(ci): run lint tools via 'go run' to match the toolchain

Installed staticcheck/govulncheck binaries can fail when built with an
older Go than the module targets, and GOPATH/bin is not always on PATH.
Compile them on demand with 'go run <tool>@latest' in both the workflow
and the Makefile.
---
 .gitea/workflows/release.yml | 11 +++--------
 Makefile                     | 19 ++++++++-----------
 2 files changed, 11 insertions(+), 19 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index c7de846..c92a21a 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -25,8 +25,7 @@ jobs:
 
       - name: gofumpt (golangci-lint fmt)
         run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
-          diff=$(golangci-lint fmt --diff 2>&1)
+          diff=$(go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest fmt --diff 2>&1)
           if [ -n "$diff" ]; then
             echo "$diff"
             echo "Formatting issues found. Run: make fmt"
@@ -34,14 +33,10 @@ jobs:
           fi
 
       - name: staticcheck
-        run: |
-          go install honnef.co/go/tools/cmd/staticcheck@latest
-          staticcheck ./...
+        run: go run honnef.co/go/tools/cmd/staticcheck@latest ./...
 
       - name: govulncheck
-        run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck ./...
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
 
       - name: Test
         run: go test ./...
diff --git a/Makefile b/Makefile
index 75ad4cf..3336756 100644
--- a/Makefile
+++ b/Makefile
@@ -14,9 +14,10 @@ GOGET=$(GOCMD) get
 GOMOD=$(GOCMD) mod
 GOCLEAN=$(GOCMD) clean
 
-# Resolve Go tool binaries (GOPATH/bin may not be on PATH in CI)
-GOBIN_DIR := $(shell $(GOCMD) env GOPATH)/bin
-TOOL = $(if $(shell command -v $(1) 2>/dev/null),$(1),$(GOBIN_DIR)/$(1))
+# Tool versions (compiled on demand via `go run` so they match the local toolchain)
+GOLANGCI_LINT = go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
+STATICCHECK   = go run honnef.co/go/tools/cmd/staticcheck@latest
+GOVULNCHECK   = go run golang.org/x/vuln/cmd/govulncheck@latest
 
 # Version information
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
@@ -53,24 +54,20 @@ vet: ## Run go vet
 
 fmt: ## Format code (gofumpt + goimports via golangci-lint)
 	@echo "Formatting..."
-	@command -v golangci-lint > /dev/null || test -x $(GOBIN_DIR)/golangci-lint || $(GOCMD) install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
-	$(call TOOL,golangci-lint) fmt --config=.golangci.json
+	$(GOLANGCI_LINT) fmt --config=.golangci.json
 
 fmt-check: ## Check formatting (gofumpt + goimports via golangci-lint)
 	@echo "Checking formatting..."
-	@command -v golangci-lint > /dev/null || test -x $(GOBIN_DIR)/golangci-lint || $(GOCMD) install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
-	@diff=$$($(call TOOL,golangci-lint) fmt --diff --config=.golangci.json 2>&1); \
+	@diff=$$($(GOLANGCI_LINT) fmt --diff --config=.golangci.json 2>&1); \
 	if [ -n "$$diff" ]; then echo "$$diff"; echo "Run: make fmt"; exit 1; fi
 
 staticcheck: ## Run staticcheck
 	@echo "Running staticcheck..."
-	@command -v staticcheck > /dev/null || test -x $(GOBIN_DIR)/staticcheck || $(GOCMD) install honnef.co/go/tools/cmd/staticcheck@latest
-	$(call TOOL,staticcheck) ./...
+	$(STATICCHECK) ./...
 
 govulncheck: ## Run govulncheck
 	@echo "Running govulncheck..."
-	@command -v govulncheck > /dev/null || test -x $(GOBIN_DIR)/govulncheck || $(GOCMD) install golang.org/x/vuln/cmd/govulncheck@latest
-	$(call TOOL,govulncheck) ./...
+	$(GOVULNCHECK) ./...
 
 build: deps ## Build the binary
 	@echo "Building $(BINARY_NAME) $(VERSION)..."