Upgrade deps, fix CI toolchain, and clear all lint/security findings

.gitattributes

@@ -0,0 +1,16 @@
+# gcrypt builds on Windows and its CI lints on a Windows runner. gofmt requires
+# LF line endings, but Git's autocrlf would otherwise check files out as CRLF on
+# Windows, making every file fail the gofmt check. Force LF for source and text
+# config files so checkouts are consistent on every platform.
+*.go    text eol=lf
+go.mod  text eol=lf
+go.sum  text eol=lf
+*.yml   text eol=lf
+*.yaml  text eol=lf
+*.json  text eol=lf
+*.md    text eol=lf
+
+# Binary assets must never be line-ending normalised.
+*.png   binary
+*.ico   binary
+*.icns  binary

.github/workflows/ci.yml

@@ -9,98 +9,80 @@ on:
 jobs:
   lint-and-test:
     name: Lint and Test
-    runs-on: ubuntu-latest
+    # gcrypt is a Windows-only application: several packages import
+    # golang.org/x/sys/windows and the GUI uses cgo (Fyne/GLFW). It therefore
+    # only compiles on Windows, so linting, vetting, security scanning and tests
+    # all run on a Windows runner (which ships a cgo-capable gcc).
+    runs-on: windows-latest
+    env:
+      CGO_ENABLED: "1"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Verify dependencies
         run: go mod verify
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v9
         with:
           version: latest
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@master
-        with:
-          args: ./...
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@latest
+          gosec ./...
 
       - name: Run Govulncheck
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...
 
+      - name: Run Tests
+        run: go test -v ./...
+
+  secret-scan:
+    name: Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
       - name: Gitleaks Scan
         uses: gitleaks/gitleaks-action@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Run Tests
-        run: go test -v ./...
-
   build-windows:
     name: Build Windows Binary
     runs-on: windows-latest
     needs: lint-and-test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version-file: 'go.mod'
           cache: true
 
       - name: Build
-        run: go build -o gcrypt.exe ./cmd/gcrypt/main.go
+        # Build the whole package, not just main.go — the package is split across
+        # several files (console/opengl/single-instance helpers) that main.go needs.
+        run: go build -o gcrypt.exe ./cmd/gcrypt
+        env:
+          CGO_ENABLED: "1"
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: gcrypt-windows
           path: gcrypt.exe
-
-  publish-docker:
-    name: Build and Push Docker Image
-    runs-on: ubuntu-latest
-    needs: lint-and-test
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tags: |
-            type=sha
-            type=ref,event=branch
-            latest
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/codeql.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3

.golangci.yml

@@ -1,21 +1,23 @@
+# golangci-lint v2 configuration.
+# `default: standard` enables errcheck, govet, ineffassign, staticcheck and
+# unused (staticcheck now subsumes the old gosimple). gofmt moved to the
+# separate `formatters` section in v2.
+version: "2"
+
 linters:
+  # gosec is intentionally NOT enabled here: it runs as its own dedicated CI step
+  # (securego/gosec), which honours gosec's native `//nosec` audit comments —
+  # golangci-lint's embedded gosec ignores those, so running it here too would
+  # double-report every audited line. golangci-lint covers everything else.
+  default: standard
   enable:
-    - gofmt
-    - govet
-    - errcheck
-    - staticcheck
-    - unused
-    - gosimple
-    - ineffassign
-    - typecheck
     - bodyclose
     - noctx
-    - gosec
 
 issues:
-  exclude-use-default: false
   max-issues-per-linter: 0
   max-same-issues: 0
 
-run:
-  timeout: 5m
+formatters:
+  enable:
+    - gofmt

cmd/gcrypt/console_windows.go

@@ -32,7 +32,7 @@ func hideConsoleIfOwned() {
 	// If only one process is attached to this console, it's ours alone and safe
 	// to hide. More than one means we share a parent terminal — leave it.
 	var pids [2]uint32
-	n, _, _ := getConsoleProcessList.Call(uintptr(unsafe.Pointer(&pids[0])), uintptr(len(pids)))
+	n, _, _ := getConsoleProcessList.Call(uintptr(unsafe.Pointer(&pids[0])), uintptr(len(pids))) // #nosec G103 -- required Win32 syscall pointer marshalling
 	if int(n) == 1 {
 		const swHide = 0
 		_, _, _ = showWindow.Call(hwnd, swHide)