chore: harden linting, add golangci-lint, bump to v0.4.13

- Promote ESLint no-explicit-any and no-unused-vars from warn to error
- Add no-console rule (allow warn/error)
- Remove dead no-require-imports override
- Fix all ESLint violations (type-safe casts, useMemo stabilization,
  ref cleanup pattern, proper component prop types)
- Add .golangci.yml (v2) with bug detection, style, and test linters
- Fix errcheck (fmt.Fprintln) and capitalized error strings
- Run gofmt on all Go files
- Add go vet, gofmt check, and golangci-lint to CI pipeline
- Expand Go test scope to ./...
- Add lint/lint-fix recipes to Justfile, update check recipe
- Bump version to 0.4.13

Author: diyor28

.github/workflows/ci.yml

@@ -44,9 +44,23 @@ jobs:
         working-directory: applets
         run: go mod download
 
+      - name: Go vet
+        working-directory: applets
+        run: go vet ./...
+
+      - name: Go format check
+        working-directory: applets
+        run: gofmt -l . | tee /tmp/gofmt.out && test ! -s /tmp/gofmt.out
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2.8.0
+          working-directory: applets
+
       - name: Run Go tests
         working-directory: applets
-        run: go test ./internal/... ./cmd/... -count=1
+        run: go test ./... -count=1
 
       - name: Install JS dependencies
         working-directory: applets

.golangci.yml

@@ -0,0 +1,37 @@
+version: "2"
+
+linters:
+  enable:
+    # Bug detection
+    - errcheck
+    - govet
+    - staticcheck
+    - ineffassign
+    - unused
+    - bodyclose
+    - nilerr
+    - noctx
+    - durationcheck
+    - errchkjson
+    - makezero
+    # Style (library-appropriate)
+    - asciicheck
+    - bidichk
+    - copyloopvar
+    - errname
+    - misspell
+    - nakedret
+    - nolintlint
+    - unconvert
+    - usestdlibvars
+    - wastedassign
+    - whitespace
+    # Testing
+    - testifylint
+    - thelper
+
+run:
+  exclude-dirs:
+    - tmp
+    - node_modules
+    - dist

Justfile

@@ -14,6 +14,14 @@ vet:
 fmt:
     go fmt ./...
 
+# Run golangci-lint
+lint:
+    golangci-lint run ./...
+
+# Run golangci-lint with auto-fix
+lint-fix:
+    golangci-lint run --fix ./...
+
 # Build the npm package
 build-npm:
     cd ui && pnpm build
@@ -30,8 +38,8 @@ watch-npm:
 lint-npm:
     cd ui && pnpm lint
 
-# Run all checks (vet + test)
-check: vet test
+# Run all checks (vet + lint + test)
+check: vet lint test
 
 # Clean build artifacts
 clean:

constructors.go

@@ -6,8 +6,8 @@ import (
 	"github.com/iota-uz/applets/internal/context"
 	"github.com/iota-uz/applets/internal/controller"
 	"github.com/iota-uz/applets/internal/registry"
-	"github.com/iota-uz/applets/internal/rpc"
 	"github.com/iota-uz/applets/internal/router"
+	"github.com/iota-uz/applets/internal/rpc"
 	"github.com/iota-uz/applets/internal/stream"
 	"github.com/iota-uz/go-i18n/v2/i18n"
 	"github.com/sirupsen/logrus"

eslint.config.js

@@ -42,9 +42,15 @@ export default [
       'react/react-in-jsx-scope': 'off',
       'react/prop-types': 'off',
       'react/no-unescaped-entities': ['error', { forbid: ['>', '}'] }],
-      '@typescript-eslint/no-unused-vars': ['warn', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
-      '@typescript-eslint/no-explicit-any': 'warn',
-      '@typescript-eslint/no-require-imports': 'off',
+      '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
+      '@typescript-eslint/no-explicit-any': 'error',
+      'no-console': ['error', { allow: ['warn', 'error'] }],
+    },
+  },
+  {
+    files: ['ui/.storybook/**/*.ts', 'ui/.storybook/**/*.tsx'],
+    rules: {
+      'no-console': 'off',
     },
   },
   {
@@ -63,7 +69,9 @@ export default [
       ...reactHooks.configs.recommended.rules,
       'react/react-in-jsx-scope': 'off',
       'react/prop-types': 'off',
-      '@typescript-eslint/no-unused-vars': ['warn', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
+      '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_', varsIgnorePattern: '^_' }],
+      '@typescript-eslint/no-explicit-any': 'error',
+      'no-console': ['error', { allow: ['warn', 'error'] }],
     },
   },
 ];

internal/api/context_types.go

@@ -7,13 +7,13 @@ import (
 
 // InitialContext is serialized and injected into the frontend (e.g. window.__APPLET_CONTEXT__).
 type InitialContext struct {
-	User       UserContext             `json:"user"`
-	Tenant     TenantContext           `json:"tenant"`
-	Locale     LocaleContext           `json:"locale"`
-	Config     AppConfig               `json:"config"`
-	Route      RouteContext            `json:"route"`
-	Session    SessionContext          `json:"session"`
-	Error      *ErrorContext           `json:"error,omitempty"`
+	User       UserContext            `json:"user"`
+	Tenant     TenantContext          `json:"tenant"`
+	Locale     LocaleContext          `json:"locale"`
+	Config     AppConfig              `json:"config"`
+	Route      RouteContext           `json:"route"`
+	Session    SessionContext         `json:"session"`
+	Error      *ErrorContext          `json:"error,omitempty"`
 	Extensions map[string]interface{} `json:"extensions,omitempty"`
 }
 

internal/api/types.go

@@ -52,16 +52,16 @@ type I18nConfig struct {
 // Config holds all configuration for integrating an applet with the host.
 type Config struct {
 	WindowGlobal  string
-	Endpoints    EndpointConfig
-	Assets       AssetConfig
-	Shell        ShellConfig
-	Router       AppletRouter
-	I18n         I18nConfig
+	Endpoints     EndpointConfig
+	Assets        AssetConfig
+	Shell         ShellConfig
+	Router        AppletRouter
+	I18n          I18nConfig
 	RoutePatterns []string
 	CustomContext ContextExtender
-	Middleware   []mux.MiddlewareFunc
-	Mount        MountConfig
-	RPC          *RPCConfig
+	Middleware    []mux.MiddlewareFunc
+	Mount         MountConfig
+	RPC           *RPCConfig
 }
 
 // LayoutFactory produces a layout component for an applet request.

internal/cli/check.go

@@ -40,7 +40,7 @@ func runCheck(cmd *cobra.Command, _ []string) error {
 	if found && len(violations) > 0 {
 		stderr := cmd.ErrOrStderr()
 		for _, v := range violations {
-			fmt.Fprintln(stderr, v)
+			_, _ = fmt.Fprintln(stderr, v)
 		}
 		failed = true
 	}

internal/cli/deps.go

@@ -12,18 +12,18 @@ import (
 // NewDepsCommand returns the deps command with check subcommand.
 func NewDepsCommand() *cobra.Command {
 	depsCmd := &cobra.Command{
-		Use:   "deps",
-		Short: "Applet dependency checks",
-		Long:  `Validate applet SDK dependency policy (e.g. exact version pinning, no local links).`,
+		Use:     "deps",
+		Short:   "Applet dependency checks",
+		Long:    `Validate applet SDK dependency policy (e.g. exact version pinning, no local links).`,
 		Example: `  applet deps check`,
 	}
 
 	checkCmd := &cobra.Command{
-		Use:   "check",
-		Short: "Check applet SDK dependency policy",
-		Long:  `Scans modules/*/presentation/web/package.json for @iota-uz/sdk and ensures exact version pinning with no file/link/workspace specifiers.`,
+		Use:     "check",
+		Short:   "Check applet SDK dependency policy",
+		Long:    `Scans modules/*/presentation/web/package.json for @iota-uz/sdk and ensures exact version pinning with no file/link/workspace specifiers.`,
 		Example: `  applet deps check`,
-		RunE:  runDepsCheck,
+		RunE:    runDepsCheck,
 	}
 	depsCmd.AddCommand(checkCmd)
 

internal/cli/rpc.go

@@ -6,8 +6,8 @@ import (
 
 	"github.com/spf13/cobra"
 
-	"github.com/iota-uz/applets/internal/config"
 	"github.com/iota-uz/applets/internal/applet/rpccodegen"
+	"github.com/iota-uz/applets/internal/config"
 )
 
 // NewRPCCommand returns the `applet rpc` subcommand (gen, check, etc.).
@@ -25,9 +25,9 @@ func NewRPCCommand() *cobra.Command {
 func NewRPCCheckCommand() *cobra.Command {
 	var name string
 	cmd := &cobra.Command{
-		Use:   "check",
-		Short: "Verify RPC contract is up to date for an applet",
-		Long:  `Exits with an error if the on-disk rpc.generated.ts does not match what would be generated from the Go router. Use "applet rpc gen --name <name>" to fix.`,
+		Use:     "check",
+		Short:   "Verify RPC contract is up to date for an applet",
+		Long:    `Exits with an error if the on-disk rpc.generated.ts does not match what would be generated from the Go router. Use "applet rpc gen --name <name>" to fix.`,
 		Example: `  applet rpc check --name bichat`,
 		Args:    cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
@@ -63,9 +63,9 @@ func NewRPCCheckCommand() *cobra.Command {
 func NewRPCGenCommand() *cobra.Command {
 	var name string
 	cmd := &cobra.Command{
-		Use:   "gen",
-		Short: "Generate RPC contract TypeScript from Go router",
-		Long:  `Generates rpc.generated.ts for the given applet. Requires --name.`,
+		Use:     "gen",
+		Short:   "Generate RPC contract TypeScript from Go router",
+		Long:    `Generates rpc.generated.ts for the given applet. Requires --name.`,
 		Example: `  applet rpc gen --name bichat`,
 		Args:    cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {