feat(ci): add dedicated staticcheck run

As we've noted that a standlone run of staticcheck can find different
issues compared with running it from golangci-lint, add a standalone run
to github actions and remove it from the golangci-lint config

Signed-off-by: Dominic Evans <[email protected]>

.github/actions/staticcheck-matchers.json

@@ -0,0 +1,16 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "staticcheck",
+      "pattern": [
+        {
+          "regexp": "^\\s*(.+\\.go):(?:(\\d+):(\\d+):)? (.*)",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4
+        }
+      ]
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -34,6 +34,15 @@ jobs:
       uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
       with:
         go-version: ${{ matrix.go-version }}
+    - name: Staticcheck
+      shell: bash
+      env:
+        BUILDTAGS: "functional"
+        VERSION: "v0.5.1"
+      run: |
+        go install "honnef.co/go/tools/cmd/staticcheck@${VERSION}"
+        echo "::add-matcher::./.github/actions/staticcheck-matchers.json"
+        $(go env GOPATH)/bin/staticcheck -tags "${BUILDTAGS}" ./...
     - name: golangci-lint
       env:
         GOFLAGS: -tags=functional

.pre-commit-config.yaml

@@ -32,10 +32,10 @@ repos:
         files: \.go$
         args: []
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.21.2
+    rev: v8.23.3
     hooks:
       - id: gitleaks
   - repo: https://github.com/golangci/golangci-lint
-    rev: v1.61.0
+    rev: v1.63.4
     hooks:
       - id: golangci-lint