fix(build): pin betteralign to v0.13.0, restore struct-alignment build

Revert removing betteralign. Instead pin it to v0.13.0. v0.14.0 regressed
-fix (GoReleaser v2 migration + "honor -fix in shipped binary") and
intermittently corrupts multi-struct files that carry per-field doc
comments (duplicated/dropped Scanner fields), which broke the release
build. Reproduced at 1/50 on linux/amd64 under GOMAXPROCS=4; v0.13.0 is
clean at 0/150 and v0.12.0 at 0/50.

prod again runs betteralign -fix on a throwaway copy; setup-prod installs
the pinned version; the Dockerfile restores the setup-prod step.

Also drop the only-new-issues escape hatch from the lint check so the
full golangci-lint ruleset gates every PR.

Author: wolveix

.github/workflows/lint.yml

@@ -62,10 +62,6 @@ jobs:
       - name: Run golangci-lint (check)
         uses: golangci/golangci-lint-action@v9
         with:
-          # only-new-issues gates newly changed code without failing on the ~37 pre-existing
-          # findings in code that predates linting here. Drop this once the backlog is cleared
-          # to enforce the full ruleset repo-wide.
           args: --timeout=5m
-          only-new-issues: true
           install-mode: goinstall
           version: latest

Dockerfile

@@ -5,6 +5,12 @@ RUN apk add git make \
 
 WORKDIR /src
 
+# Install the pinned build tool (betteralign) via the Makefile so its version lives in one
+# place. setup-prod skips the lint/format tools `make setup` installs — those run in CI, not
+# the image build. Copied alone so this layer caches until the Makefile changes.
+COPY Makefile ./
+RUN make setup-prod
+
 # Cache Go modules separately so this layer is reused until go.mod/go.sum change.
 COPY go.mod go.sum ./
 RUN go mod download

Makefile

@@ -7,6 +7,13 @@ GOPRIVATE := github.com/globalcyberalliance
 LDFLAGS   := -s -w
 GOBUILD    = GOPRIVATE=$(GOPRIVATE) CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)"
 
+# betteralign is PINNED. v0.14.0 regressed -fix (GoReleaser v2 migration + "honor -fix in
+# shipped binary") and intermittently corrupts multi-struct files with per-field doc comments,
+# which broke the release build. v0.13.0 is the last release carrying all the correctness fixes
+# (v0.9.0 multi-struct rewrite loss + data race, v0.12.0 comment-handling hardening) before that
+# regression. Do NOT bump to @latest without re-validating against pkg/scanner.
+BETTERALIGN_VERSION := v0.13.0
+
 # VERSION is optional. The binary carries a default version baked into the source
 # (cmd/dss/main.go). Passing VERSION= (e.g. a release tag from CI) overrides it via
 # -ldflags -X. A passed-but-empty VERSION= is stripped and ignored so we never embed
@@ -20,28 +27,28 @@ endif
 need = command -v $(1) >/dev/null 2>&1 || { echo "$(1) not found — run 'make setup'"; exit 1; }
 
 .DEFAULT_GOAL := dev
-.PHONY: dev prod optimize clean clean-all format lint lint-fix nil test benchmark tidy setup help
+.PHONY: dev prod clean clean-all format lint lint-fix nil test benchmark tidy setup-prod setup help
 
-dev: ## Default: fast local build, compiles in-place
+dev: ## Default: fast local build, no struct alignment, compiles in-place
 	@$(call need,$(GO))
 	@echo "Building $(BIN)..."
 	@mkdir -p bin
 	@$(GOBUILD) -o $(BIN) $(CMD)
 
-prod: ## Production release build (stripped, trimmed, reproducible)
+prod: ## Production binary: struct-aligned, optimized (working tree untouched)
 	@$(call need,$(GO))
-	@echo "Building $(BIN)..."
-	@mkdir -p bin
-	@$(GOBUILD) -o $(BIN) $(CMD)
-
-optimize: ## Rewrite structs for optimal field alignment — run manually, review the diff, commit
-# Struct alignment is deliberately kept OFF the build path. betteralign -fix mutates source
-# and can intermittently corrupt files, so it must never gate a build; run it by hand and let
-# `go build`/review catch any bad rewrite. `|| true` because betteralign exits non-zero simply
-# when it has findings, even after a successful fix.
 	@$(call need,betteralign)
+	@echo "Preparing build directory..."
+	@rm -rf bin build && mkdir -p bin build
+	@cp -r cmd go.mod go.sum pkg build/
 	@echo "Optimizing struct field alignment..."
-	@betteralign -fix ./... || true
+# betteralign exits non-zero whenever it has findings (even after -fix succeeds, and when
+# already aligned), so `|| true` is required — alignment is best-effort here, not a gate.
+# The version is pinned (see BETTERALIGN_VERSION) because @latest corrupts source.
+	@cd build && betteralign -fix ./... >/dev/null 2>&1 || true
+	@echo "Building $(BIN)..."
+	@cd build && $(GOBUILD) -o ../$(BIN) $(CMD)
+	@rm -rf build
 
 clean: ## Remove build artifacts
 	@echo "Cleaning..."
@@ -80,12 +87,15 @@ benchmark: ## Run benchmarks
 tidy: ## Tidy go.mod / go.sum
 	@$(GO) mod tidy
 
-setup: ## Install dev tools (gofumpt, nilaway, golangci-lint, betteralign)
+setup-prod: ## Install build-time tools only (pinned betteralign — needed by `make prod`)
+	@echo "Installing build tools..."
+	@$(GO) install github.com/dkorunic/betteralign/cmd/betteralign@$(BETTERALIGN_VERSION)
+
+setup: setup-prod ## Install all dev tools (build + gofumpt, nilaway, golangci-lint)
 	@echo "Installing dev tools..."
 	@$(GO) install mvdan.cc/gofumpt@latest
 	@$(GO) install go.uber.org/nilaway/cmd/nilaway@latest
 	@$(GO) install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
-	@$(GO) install github.com/dkorunic/betteralign/cmd/betteralign@latest
 
 help: ## Show this help
 	@grep -hE '^[a-zA-Z_-]+:.*## ' $(MAKEFILE_LIST) | awk -F':.*## ' '{printf "  \033[36m%-12s\033[0m %s\n", $$1, $$2}'