chore(veans): add veans-local golangci config

veans/.golangci.yml

@@ -0,0 +1,106 @@
+version: "2"
+run:
+  tests: true
+  build-tags:
+    - mage
+linters:
+  enable:
+    - asasalint
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - contextcheck
+    - err113
+    - errchkjson
+    - errorlint
+    - exhaustive
+    - gocheckcompilerdirectives
+    - gochecksumtype
+    - gocritic
+    - gocyclo
+    - goheader
+    - gosec
+    - gosmopolitan
+    - loggercheck
+    - makezero
+    - misspell
+    - nilerr
+    - nilnesserr
+    - noctx
+    - protogetter
+    - reassign
+    - recvcheck
+    - revive
+    - rowserrcheck
+    - testifylint
+    - unparam
+  disable:
+    - durationcheck
+    - goconst
+    - musttag
+  settings:
+    goheader:
+      template-path: code-header-template.txt
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      # Tests compose dynamic error messages and exercise edge cases — let
+      # them. Mirrors the parent repo's _test.go carve-outs.
+      - linters:
+          - err113
+          - errorlint
+          - gocyclo
+        path: _test\.go
+      - linters:
+          - gocritic
+        text: 'commentFormatting: put a space between `//` and comment text'
+      # The veans CLI uses fmt.Errorf and output.New/Wrap intentionally —
+      # err113's "no dynamic errors" rule isn't a fit for user-facing CLI
+      # errors that are routinely templated with parameters.
+      - linters:
+          - err113
+        path: ".*"
+        text: 'do not define dynamic errors, use wrapped static errors instead:'
+      # mage build tooling is internal — gosec subprocess flags don't apply.
+      - linters:
+          - err113
+          - gosec
+        path: magefile.go
+      # term.ReadPassword takes int(*os.File.Fd()) — canonical Go idiom.
+      - linters:
+          - gosec
+        text: 'G115: integer overflow conversion uintptr -> int'
+      # Password / AccessToken / RefreshToken are intentional API model
+      # fields, mirroring the parent repo's exclusion.
+      - linters:
+          - gosec
+        text: 'G117:'
+      # veans is an HTTP CLI: G704 (SSRF) and G705 (XSS via Fprintf to a
+      # terminal) are categorically false positives for this codebase.
+      - linters:
+          - gosec
+        text: 'G70[45]:'
+      # E2E helpers run subprocesses with controlled inputs (git, the
+      # built veans binary). G204 (subprocess) and G703 (path traversal)
+      # don't apply to test infrastructure.
+      - linters:
+          - gosec
+        path: e2e/
+        text: 'G(204|306|703):'
+      # .veans.yml is committed to the repo and intentionally world-
+      # readable; 0o644 is correct.
+      - linters:
+          - gosec
+        path: internal/config/config\.go
+        text: 'G306:'
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax

veans/code-header-template.txt

@@ -0,0 +1,15 @@
+Vikunja is a to-do list application to facilitate your life.
+Copyright 2018-present Vikunja and contributors. All rights reserved.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.