build: bump Go to 1.27

go.mod

@@ -1,6 +1,6 @@
 module github.com/qubesome/cli
 
-go 1.25.0
+go 1.27.0
 
 require (
 	github.com/cyphar/filepath-securejoin v0.7.0

hack/base.mk

@@ -1,5 +1,5 @@
 # renovate: datasource=github-tags depName=golangci/golangci-lint
-GOLANGCI_VERSION ?= v2.12.2
+GOLANGCI_VERSION ?= v2.13.0
 # renovate: datasource=github-tags depName=protocolbuffers/protobuf
 PROTOC_VERSION ?= v35.1
 TOOLS_BIN := $(shell mkdir -p build/tools && realpath build/tools)

internal/command/command.go

@@ -26,5 +26,5 @@ type App interface {
 
 	Usage(format string)
 	Exit(code int)
-	Printf(format string, a ...interface{}) (n int, err error)
+	Printf(format string, a ...any) (n int, err error)
 }

internal/files/binaries_test.go

@@ -8,6 +8,8 @@ import (
 )
 
 func TestContainerRunnerBinary(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+
 	tests := []struct {
 		in   string
 		want string

internal/flatpak/flatpak.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"slices"
 
 	"github.com/qubesome/cli/internal/command"
 	"github.com/qubesome/cli/internal/files"
@@ -39,13 +40,7 @@ func Run(opts ...command.Option[Options]) error {
 		return fmt.Errorf("profile has no flatpaks")
 	}
 
-	allowed := false
-	for _, name := range prof.Flatpaks {
-		if name == o.Name {
-			allowed = true
-			break
-		}
-	}
+	allowed := slices.Contains(prof.Flatpaks, o.Name)
 
 	if !allowed {
 		return fmt.Errorf("flatpak %q is not allowed for profile %q", o.Name, o.Profile)

internal/images/images.go

@@ -29,16 +29,14 @@ func Run(opts ...command.Option[Options]) error {
 func Pull(bin string, cfg *types.Config, wg *sync.WaitGroup) error {
 	switch cfg.WorkloadPullMode {
 	case types.Background:
-		wg.Add(1)
-		go func() {
+		wg.Go(func() {
 			if exp, _ := pullExpired(); exp {
 				err := PullAll(bin, cfg)
 				if err != nil {
 					slog.Error("error pulling images", "error", err)
 				}
 			}
-			wg.Done()
-		}()
+		})
 	case types.OnDemand:
 		// no-op as images will be pull when needed.
 	}

internal/runners/util/container/redact_test.go

@@ -46,7 +46,6 @@ func TestRedactEnvArgs(t *testing.T) {
 	}
 
 	for _, tc := range tests {
-		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 

internal/types/workload.go

@@ -77,9 +77,8 @@ func (w Workload) ApplyProfile(p *Profile) EffectiveWorkload {
 	e := EffectiveWorkload{
 		Profile:  p,
 		Workload: w,
-	}
 
-	e.Name = fmt.Sprintf("%s-%s", w.Name, p.Name)
+		Name: fmt.Sprintf("%s-%s", w.Name, p.Name)}
 
 	e.Workload.HostAccess.Camera = w.HostAccess.Camera && p.Camera
 	e.Workload.HostAccess.Microphone = w.HostAccess.Microphone && p.Microphone
@@ -111,7 +110,7 @@ func (w Workload) ApplyProfile(p *Profile) EffectiveWorkload {
 		paths := make([]string, 0, len(w.HostAccess.Paths))
 
 		for _, path := range w.HostAccess.Paths {
-			src := strings.Split(path, ":")[0]
+			src, _, _ := strings.Cut(path, ":")
 			if pathAllowed(src, p.HostAccess.Paths) {
 				paths = append(paths, path)
 			}