ci: bump go toolchain to 1.25 and migrate golangci-lint to v2

nuclei/v3 v3.8.0 (PR #97) requires go >= 1.25.7 in go.mod.
this breaks the existing CI pinned to go 1.24:

  - build: "go.mod requires go >= 1.25.7 (running go 1.24.13;
    GOTOOLCHAIN=local)"
  - lint:  "the Go language version (go1.24) used to build
    golangci-lint is lower than the targeted Go version (1.25.7)"

bumps setup-go to 1.25 across all workflows and moves the lint
job to golangci-lint-action v8 with golangci-lint v2.11.4 (built
with go 1.25). migrates .golangci.yml to the v2 schema:

  - version: "2"
  - linters-settings -> linters.settings
  - issues.exclude-rules -> linters.exclusions.rules
  - drop gosimple (merged into staticcheck in v2)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/code_quality.yml

@@ -26,7 +26,7 @@ jobs:
       - name: set up go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.25"
       - name: initialize codeql
         uses: github/codeql-action/init@v4
         with:

.github/workflows/go.yml

@@ -21,17 +21,17 @@ jobs:
       - name: set up go
         uses: actions/setup-go@v6
         with:
-          go-version: "1.24"
+          go-version: "1.25"
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v8
         with:
-          version: latest
+          version: v2.11.4
 
   build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: ["1.24"]
+        go-version: ["1.25"]
     steps:
       - uses: actions/checkout@v6
       - name: set up go

.github/workflows/govulncheck.yml

@@ -19,7 +19,7 @@ jobs:
       - name: set up go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.25"
       - name: install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
       - name: run govulncheck

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
       - name: set up go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.25"
 
       - name: extract version
         run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV

.github/workflows/runtest.yml

@@ -18,7 +18,7 @@ jobs:
       - name: set up go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.25"
       - name: build sif
         run: make
       - name: run sif with features

.golangci.yml

@@ -1,10 +1,15 @@
+version: "2"
+
+run:
+  timeout: 5m
+  issues-exit-code: 1
+
 linters:
   enable:
     - errcheck      # check error returns
     - govet         # suspicious constructs
-    - staticcheck   # advanced static analysis
+    - staticcheck   # advanced static analysis (absorbs gosimple in v2)
     - unused        # unused code
-    - gosimple      # simplifications
     - ineffassign   # useless assignments
     - misspell      # spelling mistakes
     - gocritic      # opinionated lints
@@ -18,7 +23,7 @@ linters:
     - wastedassign  # assignments to variables never read
     - usetesting    # os.Setenv in tests instead of t.Setenv, etc.
 
-linters-settings:
+  settings:
     govet:
       enable-all: true
       disable:
@@ -51,16 +56,14 @@ linters-settings:
         - G110  # nuclei template decompression, acceptable context
         - G304  # sif reads user-supplied wordlist paths -- intentional
 
-run:
-  timeout: 5m
-  issues-exit-code: 1
-
-issues:
-  max-issues-per-linter: 50
-  max-same-issues: 50
-  exclude-rules:
+  exclusions:
+    rules:
       # test files get some slack
       - path: _test\.go
         linters:
           - errcheck
           - noctx
+
+issues:
+  max-issues-per-linter: 50
+  max-same-issues: 50