Test against Go stable/oldstable, upgrade staticcheck to 2026.2.2, let Renovate keep it current (#234)

* Test against Go stable and oldstable

The CI matrix pinned explicit Go versions that had to be bumped by hand
and regularly fell behind the Go release policy. setup-go's `stable`
and `oldstable` aliases always resolve to the current and previous Go
release (today 1.27.x and 1.26.x), so CI keeps testing both supported
versions without manual or Renovate-driven bumps. Patch releases are
picked up automatically too.

go.mod is left untouched on purpose: it states the minimum version we
require from users, not the versions CI tests against.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Upgrade staticcheck to 2026.2.2

2026.2 is the first staticcheck release that supports Go 1.27; older
releases abort on a Go 1.27 toolchain. 2026.2.2 is the latest patch
release.

The Makefile now installs exactly the version CI runs, via a single
STATICCHECK_VERSION variable. Before, `make staticcheck` ran an unpinned
`go get -u` (which no longer installs binaries), `@latest`, or a stale
pin, so local results could differ from CI.

Both pins carry a `# renovate:` annotation so Renovate can bump them
together.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Let Renovate keep the Makefile's staticcheck in sync with CI

The staticcheck release in testing.yml was already managed by a regex
custom manager, but the Makefile pin added in the previous commit was
not, so the two could drift apart again.

A second regex custom manager reads the annotated STATICCHECK_VERSION in
the Makefile. It uses the same depName (dominikh/go-tools) and the same
`regex:` versioning as the workflow rule, so Renovate treats both pins
as one dependency and bumps CI and the Makefile in the same pull
request.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/testing.yml

diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index 7a5b87c..b5c59b4 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -15,7 +15,7 @@
     runs-on: ubuntu-26.04
     strategy:
       matrix:
-        go: ["1.27", "1.26"]
+        go: [stable, oldstable]
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -32,7 +32,7 @@
     runs-on: ubuntu-26.04
     strategy:
       matrix:
-        go: ["1.27", "1.26"]
+        go: [stable, oldstable]
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -48,7 +48,7 @@
     runs-on: ubuntu-26.04
     strategy:
       matrix:
-        go: ["1.27", "1.26"]
+        go: [stable, oldstable]
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -60,7 +60,7 @@
         uses: dominikh/staticcheck-action@9716614d4101e79b4340dd97b10e54d68234e431 # v1.4.1
         with:
           # renovate: datasource=github-releases depName=dominikh/go-tools
-          version: "2026.2.1"
+          version: "2026.2.2"
           install-go: false
           cache-key: ${{ matrix.go }}
 
@@ -69,7 +69,7 @@
     runs-on: ubuntu-26.04
     strategy:
       matrix:
-        go: ["1.27", "1.26"]
+        go: [stable, oldstable]
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -87,7 +87,7 @@
     runs-on: ubuntu-26.04
     strategy:
       matrix:
-        go: ["1.27", "1.26"]
+        go: [stable, oldstable]
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

Makefile

diff --git a/Makefile b/Makefile
index e77bc13..a37d344 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,8 @@
 .DEFAULT_GOAL := help
 
+# renovate: datasource=github-releases depName=dominikh/go-tools
+STATICCHECK_VERSION := 2026.2.2
+
 .PHONY: help
 help: ## Outputs the help
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
@@ -14,5 +17,5 @@
 
 .PHONY: staticcheck
 staticcheck: ## Runs static code analyzer staticcheck
-	go get -u honnef.co/go/tools/cmd/staticcheck
+	go install honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION)
 	staticcheck ./...
\ No newline at end of file

renovate.json

diff --git a/renovate.json b/renovate.json
index 9b64002..4402ed4 100644
--- a/renovate.json
+++ b/renovate.json
@@ -22,6 +22,17 @@
         "# renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>[^\\s]+?)\\s+version: \"(?<currentValue>[^\"]+)\""
       ],
       "versioningTemplate": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)(\\.(?<patch>\\d+))?$"
+    },
+    {
+      "customType": "regex",
+      "description": "Update the staticcheck release installed by the Makefile, so local runs always match CI",
+      "managerFilePatterns": [
+        "/^Makefile$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>[a-z-]+?) depName=(?<depName>[^\\s]+?)\\s+STATICCHECK_VERSION := (?<currentValue>\\S+)"
+      ],
+      "versioningTemplate": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)(\\.(?<patch>\\d+))?$"
     }
   ],
   "packageRules": [