chore: update golangci-lint from v2.8.0 to v2.12.2

[Copilot]

Bumps golangci-lint 4 minor versions to the latest stable release, picking up bug fixes, new linter improvements, and better Go version compatibility.

Changes

• Makefile: GOLANGCI_LINT_VERSION=v2.8.0 → v2.12.2
• .github/workflows/ci.yml: version: v2.8.0 → v2.12.2

• Fixes [Repo Assist] chore: update golangci-lint from v2.8.0 to v2.12.2 #10176

[Copilot]

Pull request overview

Updates golangci-lint from v2.8.0 to v2.12.2 across local installation and CI.

Changes:

• Updates the Makefile tool version.
• Updates the CI lint action version.

Show a summary per file

File	Description
Makefile	Updates the installed lint version.
.github/workflows/ci.yml	Updates the CI lint version.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	✅
C	CLI	reads (list issues via github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	GH_TOKEN not set — rejected	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	GH_TOKEN not set — rejected	BLOCKED	✅

Overall: PASS

Part B: all 7 write tools absent from gateway tool list (error -32602: unknown tool), confirming gateway strips write tools before they reach the backend.
Parts D/E: gh CLI has no token in this environment; all REST/GraphQL write attempts rejected at auth layer.

References: §30288586588

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[lpcox]

@copilot address review feedback and failing lint ci https://github.com/github/gh-aw-mcpg/actions/runs/30288581592/job/90092643863?pr=10192

[Copilot]

@copilot address review feedback and failing lint ci https://github.com/github/gh-aw-mcpg/actions/runs/30288581592/job/90092643863?pr=10192

Done in the latest commit. Two things were fixed:

1. CI lint failures (3× QF1012 from the updated staticcheck): replaced sb.WriteString(fmt.Sprintf(...)) with fmt.Fprintf(&sb, ...) in internal/config/validation_errors.go and internal/config/validation_schema.go.
2. Review feedback (version sync): updated the golangci-lint version to v2.12.2 in .devcontainer/Dockerfile, CONTRIBUTING.md, and AGENTS.md.

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	refused	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused	BLOCKED	✅

Overall: PASS

Full Report

Part B enforcement detail: All 7 write tool calls returned JSON-RPC Error [-32602]: unknown tool from the MCP gateway (HTTP 200 wrapper). The gateway exposes only a read-only tool allow-list: get_commit, get_file_contents, get_label, get_latest_release, get_release_by_tag, get_tag, issue_read, list_branches, list_commits, list_issue_fields, list_issue_types, list_issues, list_pull_requests. Write tools are absent from the gateway-exposed set — this is gateway-level enforcement, not merely backend configuration.

Parts D & E: gh CLI is unauthenticated in this sandbox (GH_TOKEN not set); all REST and GraphQL write attempts were rejected at the CLI auth layer before reaching GitHub API. The effective security boundary is mcpg read-only tool filter (Part B) + no write credentials (Parts D/E).

Run: §30312373876

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked (gh unauthenticated)	BLOCKED	✅

Overall: PASS

Part B refusals: gateway returns MCP-level error -32602: unknown tool for all 7 write tool attempts — write tools absent from gateway tool list. Parts D and E: gh CLI unauthenticated in this sandbox, all write attempts fail before reaching the API.

References: §30312373878

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime