ci: run go vet and staticcheck separately

dominickh, the author of staticcheck, doesn't recommend running
staticcheck as a part of golangci-lint. Run the real, official
staticcheck separately.

Run go vet separately as well. This way we know we're using the latest
official go vet tool.

Also, use autobuild to set up Go in the CodeQL analysis workflow.

.github/workflows/codeql-analysis.yml

@@ -15,20 +15,17 @@ jobs:
       security-events: write
 
     steps:
-      - name: Checkout repository
+      - name: checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
       # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
+      - name: initialize codeql
         uses: github/codeql-action/init@v3
         with:
           languages: go
+          build-mode: autobuild
 
-      # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
-
-      - name: Perform CodeQL Analysis
+      - name: perform codeql analysis
         uses: github/codeql-action/analyze@v3

.github/workflows/pr.yml

@@ -6,33 +6,52 @@ on:
 
 jobs:
   lint:
-    name: GolangCI Lint
+    name: golangci-lint
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
+      - name: checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - name: Set up go
-        uses: actions/setup-go@v5
+      - name: set up go
+        uses: WillAbides/setup-go-faster@v1
         with:
           go-version-file: go.mod
-      - name: Run linter
+      - name: lint
         uses: golangci/golangci-lint-action@v6
         with:
           version: latest
 
+  check:
+    name: go vet
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - name: set up go
+        uses: WillAbides/setup-go-faster@v1
+        with:
+          go-version-file: go.mod
+      - name: run go vet
+        run: go vet ./...
+      - name: run staticcheck
+        uses: dominikh/staticcheck-action@v1
+        with:
+          version: latest
+
   tests:
-    name: Run unit tests with the race detector enabled
+    name: run unit tests with the race detector enabled
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository
+      - name: checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
-      - name: Set up go
-        uses: actions/setup-go@v5
+      - name: set up go
+        uses: WillAbides/setup-go-faster@v1
         with:
           go-version-file: go.mod
-      - name: Run unit tests
+      - name: run unit tests
         run: go test -v -race ./...

.golangci.yml

@@ -9,11 +9,14 @@ linters:
     - depguard # enforces that only deps on a whitelist can be used (meant for orgs, not small projects)
     - execinquery # deprecated
     - exhaustruct
+    - exportloopref # deprecated
     - forbidigo # we need to use fmt.Print*()
     - gomnd
-    - nolintlint
-    - nonamedreturns
+    - govet # we run the official go vet separately
+    - nolintlint # we do occasionally need to suppress linter false positives
+    - nonamedreturns # named returns often help readability
     - paralleltest # tests only take 2.5s to run. no need to parallelize
+    - staticcheck # dominickh doesn't recommend running staticcheck as part of golangci-lint, so we run Real Staticcheck™ separately
     - testpackage
     - varnamelen # makes bad suggestions
     - wsl