ci: enforce the CLI's documented pre-commit gate

[FrameAutomata]

CLAUDE.md calls cd cli && just check the pre-commit gate. Nothing ran it, and it was red on main: 19 lint issues plus a govulncheck failure.

Lint policy

All 19 were unactionable-error noise rather than defects, so most of this is a policy file. The exclusions are kept deliberately narrow: where the module already checks a function's error somewhere, the unactionable call sites get an explicit _ = (the idiom already used at ~40 sites) instead of a module-wide exclusion, so the linter keeps guarding the sites that matter.

That distinction turned out to be load-bearing. Two broader exclusions I first wrote were silently disarming real guards:

• fmt.Fprintf/Fprintln covered 9 sites, but only 5 were the stderr diagnostics the rationale described. setup_apply.go:302-327 writes the "Next steps (deployment credentials)" block to stdout — the text telling the user which secret to add where. Unchecked, it can truncate silently while the command exits 0.
• (*os.File).Close covered the 6 abandonment closes in the atomic-write paths, but being module-wide it also disarmed the three closes whose error decides whether the write reached disk before os.Rename publishes it (config.go:152, state.go:96, envfile.go:112).

Also closed two scope gaps: test/smoke (13 files behind //go:build smoke) was invisible to the linter and had an unchecked write of its own, and golangci-lint's default max-same-issues: 3 was hiding real hits — not what a gate should do.

The staticcheck list is spelled out rather than all minus one, because bare all is wider than the default: it enables ST1003, which wanted to rename Id → ID across the client's wire structs.

One thing worth recording, because it looks like a bug and isn't. defer enc.Close() in RenderYAML discards an error — the textbook shape of "returns nil while emitting truncated output". It isn't: yaml.v3's Encode flushes each document in full (measured at 0 extra bytes and 0 extra writes at Close for a 32KB document and a multi-document stream). The call site says so now.

Go toolchain

govulncheck failed on 4 stdlib CVEs — net/url, crypto/tls, encoding/asn1, net/http — all fixed in go1.26.6, against go 1.26.2.

Fixed with a toolchain directive, not by raising the go line. pkg/client is documented as importable by other Go programs, and since Go 1.21 the go line is a hard floor propagated to consumers — forcing every importer up over a CVE in the build toolchain is the wrong lever. toolchain go1.26.6 pins what builds the binary and leaves the consumer floor at 1.26.2.

This mattered beyond local tooling: release-cli.yml builds published binaries from this same go-version-file.

CI

Own workflow rather than more jobs in cli.yml, because the triggers genuinely differ — cli.yml runs on backend/** so its contract tests can catch backend drift, but nothing in backend/ can change the result of linting the CLI module. Over the last 300 commits, 42% touched backend/ against 6% touching cli/.

• A daily schedule + workflow_dispatch. Without it the vulncheck job was structurally unable to do its job: both triggers were path-filtered, and a CVE landing in the database produces neither a push nor a PR, so a new advisory could sit unreported for weeks on a module that changes 6% of the time.
• Both tools pinned. My first version left govulncheck at @latest reasoning that freshness required it — that was wrong about the mechanism. govulncheck -version prints DB: https://vuln.go.dev; the advisory database is fetched at run time regardless of binary version, so the schedule provides freshness and the pin removes an unreviewed upstream fetch on every PR.
• golangci-lint-action in its default prebuilt-binary mode, rather than go install. Compiling it from source pulled 320 modules and ~950MB of sources plus build objects on every run (26-32s measured on an 8-core box, slower on a 2-4 vCPU runner), and wrote those artifacts into the cache setup-go saves under a cli/go.sum key.

Verification

• just check green end to end (lint, 322 tests, vulncheck, skill drift, contract tests), exit 0
• Both pinned tools installed and run for real at the exact versions CI uses
• The toolchain directive confirmed to build with 1.26.6 while leaving the module floor at 1.26.2
• gofmt gating confirmed by reverting the one unformatted file, watching it fail, then pass

Known gap, deliberately not in this PR

backend/go.mod is still go 1.26.2, and release-traceway.yml:167 builds the shipped traceway-runner binaries from it — so those still carry the same 4 stdlib CVEs, two of which (crypto/tls, net/http) are directly on the runner's outbound long-poll path. There is no govulncheck anywhere outside cli/.

Left out because the backend has three build-tag combinations and CGO/DuckDB, so it deserves its own change with its own verification rather than riding along here. Tracked as #308.

🤖 Generated with Claude Code