ci(lint): resolve golangci-lint v2 findings on existing main

Lint v2 has stricter defaults than the v1.51 the repo used previously,
surfacing pre-existing issues that v1 silently ignored. None of these
are bugs introduced by the security bump; they're cleanups so the
upgraded linter runs clean.

- .golangci.yml: depguard v2 no longer auto-allows the project's own
  third-party deps — list them explicitly so legitimate imports of
  go-retryablehttp, oauth2, thrift, jwt/v5, etc. don't trip the rule.
  Drop the v2-invalid `gosec.exclude-generated` key (the linter now
  config-verifies and would refuse to start with it present).
- Makefile: bump local install target from golangci-lint@v1.51.0 to
  v2.12.2 (matches the version the v9.2.1 GitHub Action installs).
- parameters.go: reflect.Ptr -> reflect.Pointer (Ptr is the legacy
  alias kept for backwards compat; govet's `inline` check flags it).
- internal/rows/rows.go: complete the //nolint:gosec annotation block
  the original PR author added on the very next line — the int32
  conversion on line 183 is in the same telemetry counter scope.
- telemetry/aggregator_test.go: //nolint:gosec on test-only counter.
- connection_test.go: //nolint:gosec on os.ReadFile(localFile) — the
  filename comes from a deterministic httptest fixture path.
- internal/client/client.go: //nolint:staticcheck on the deprecated
  thrift.StdLogger sentinel — it's a no-op since thrift v0.13 but
  remains the documented argument type for NewTDebugProtocolFactoryWithLogger.

Local lint run after these changes: 0 issues.

Co-authored-by: Isaac
Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>

Author: vikrantpuppala

.golangci.yml

@@ -24,8 +24,20 @@ linters:
           allow:
             - $gostd
             - github.com/databricks/databricks-sql-go
+            - github.com/apache/arrow/go/v12
+            - github.com/apache/thrift/lib/go/thrift
+            - github.com/coreos/go-oidc/v3/oidc
+            - github.com/golang-jwt/jwt/v5
+            - github.com/hashicorp/go-retryablehttp
+            - github.com/joho/godotenv
+            - github.com/mattn/go-isatty
+            - github.com/pierrec/lz4/v4
+            - github.com/pkg/browser
+            - github.com/pkg/errors
+            - github.com/rs/zerolog
+            - github.com/stretchr/testify
+            - golang.org/x/oauth2
     gosec:
-      exclude-generated: true
       severity: low
       confidence: low
     nolintlint:

Makefile

@@ -35,7 +35,7 @@ help:  ## Show this help.
 all: gen fmt lint test coverage  ## format and test everything
 
 bin/golangci-lint: go.mod go.sum
-	GOBIN=$(pwd)/bin go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.51.0
+	GOBIN=$(pwd)/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
 
 bin/gotestsum: go.mod go.sum
 	@mkdir -p bin/

connection_test.go

@@ -2116,7 +2116,7 @@ func TestConn_handleStagingRetry(t *testing.T) {
 		assert.Nil(t, err)
 		assert.Equal(t, int32(2), atomic.LoadInt32(&attempts))
 
-		got, readErr := os.ReadFile(localFile)
+		got, readErr := os.ReadFile(localFile) //nolint:gosec
 		assert.Nil(t, readErr)
 		assert.Equal(t, body, got, "GET should write the final-attempt body to local file")
 	})

internal/client/client.go

@@ -300,7 +300,9 @@ func InitThriftClient(cfg *config.Config, httpclient *http.Client) (*ThriftServi
 		return nil, dbsqlerrint.NewRequestError(context.TODO(), fmt.Sprintf("invalid protocol specified %s", cfg.ThriftProtocol), nil)
 	}
 	if cfg.ThriftDebugClientProtocol {
-		protocolFactory = thrift.NewTDebugProtocolFactoryWithLogger(protocolFactory, "client:", thrift.StdLogger(nil))
+		// thrift.StdLogger is deprecated as of v0.13 (no-op since), but is still the documented
+		// argument type for NewTDebugProtocolFactoryWithLogger; passing nil is the upstream pattern.
+		protocolFactory = thrift.NewTDebugProtocolFactoryWithLogger(protocolFactory, "client:", thrift.StdLogger(nil)) //nolint:staticcheck
 	}
 
 	var tTrans thrift.TTransport

internal/rows/rows.go

@@ -180,7 +180,7 @@ func NewRows(
 			// For CloudFetch direct results, use the number of result links.
 			var totalPresent int32
 			if directResults.CloseOperation != nil {
-				totalPresent = int32(r.chunkCount)
+				totalPresent = int32(r.chunkCount) //nolint:gosec
 			} else if directResults.ResultSet != nil && directResults.ResultSet.Results != nil &&
 				directResults.ResultSet.Results.ResultLinks != nil {
 				totalPresent = int32(len(directResults.ResultSet.Results.ResultLinks)) //nolint:gosec

parameters.go

@@ -102,7 +102,7 @@ func inferTypes(params []Parameter) {
 }
 
 func inferType(param *Parameter) {
-	if param.Value != nil && reflect.ValueOf(param.Value).Kind() == reflect.Ptr {
+	if param.Value != nil && reflect.ValueOf(param.Value).Kind() == reflect.Pointer {
 		param.Value = reflect.ValueOf(param.Value).Elem().Interface()
 		inferType(param)
 		return

telemetry/aggregator_test.go

@@ -27,7 +27,7 @@ func TestAggregatorClose_WaitsForInFlightWorkerExports(t *testing.T) {
 		body, _ := io.ReadAll(r.Body)
 		var req TelemetryRequest
 		if err := json.Unmarshal(body, &req); err == nil {
-			atomic.AddInt32(&receivedCount, int32(len(req.ProtoLogs)))
+			atomic.AddInt32(&receivedCount, int32(len(req.ProtoLogs))) //nolint:gosec
 		}
 		// Simulate slow server — forces the worker to be mid-HTTP-export when close() runs
 		time.Sleep(exportDelay)
@@ -138,7 +138,7 @@ func TestAggregatorFlushUnlocked_InFlightAddBeforeSend(t *testing.T) {
 		body, _ := io.ReadAll(r.Body)
 		var req TelemetryRequest
 		if err := json.Unmarshal(body, &req); err == nil {
-			atomic.AddInt32(&receivedCount, int32(len(req.ProtoLogs)))
+			atomic.AddInt32(&receivedCount, int32(len(req.ProtoLogs))) //nolint:gosec
 		}
 		time.Sleep(20 * time.Millisecond)
 		w.WriteHeader(http.StatusOK)