* Cache staticcheck analysis in CI to reduce lint job runtime

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Cache Go tool binaries in CI to avoid reinstalling on every run

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Skip tool install if binaries already exist on PATH

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Convert linting from staticcheck to golangci-lint

Replaces the standalone staticcheck + go vet setup with golangci-lint,
which bundles both and adds ineffassign and unused detection.

- Add .golangci.yml (v2 config) with exact-file exclusions for all
  current violations; any new file triggering a suppressed check will
  still fail CI
- Update justfile: lint recipe now runs golangci-lint, install recipe
  fetches golangci-lint v2.11.4 instead of staticcheck
- Replace CI staticcheck cache/install steps with golangci-lint-action@v6
- Fix three pre-existing lint issues caught by the new linters:
  ineffassign in v2/core/eventdestination/client_test.go, and unused
  consts/vars in file/client_test.go and example/deserialization_test.go

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Use golangci-lint-action@v9 (latest)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Downgrade golangci-lint-action to v8 (node24 not yet supported)

v9 switched the action runtime from node20 to node24, which GitHub
Actions runners don't support yet, causing startup_failure on every run.
v8 is the latest version still using node20.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Pin checkout@v4 and setup-go@v5 to avoid node24 breakage

actions/checkout@v6 and actions/setup-go@v6 both updated their floating
tags to node24 builds today. GitHub Actions runners don't support node24
yet, causing startup_failure on every run. Pin to the latest node20
versions: checkout@v4 and setup-go@v5.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Revert to last known good workflow state (cb615fd) for diagnostics

Testing whether startup_failure is in workflow content or external.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Test: replace golangci-lint-action with direct install

Diagnosing startup_failure — testing whether removing the golangci-lint-action
step resolves it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Upgrade to node24-compatible actions (cache@v5, golangci-lint-action@v9)

golangci-lint-action@v6 (node20) caused workflow startup_failure — cause
unclear, but upgrading to v9 (node24) fixes it. Also upgrade actions/cache
to v5 (node24) to clear the remaining node20 deprecation warning.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Trigger CI after adding golangci-lint-action to allowed actions list

golangci/golangci-lint-action was blocked by repo's action allowlist,
causing startup_failure. Now that it's allowlisted, testing v9 (node24).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Add cache-busting prefix

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* Re-enable ST1000: add missing package comments

Removes the ST1000 suppressions from .golangci.yml and adds a package
doc comment to each of the four affected packages: form, mock, testing,
and webhook.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Re-enable ST1001: remove dot import in mock package

Replaces the dot import of the Stripe testing package with an explicit
alias (stripetest) and qualifies the two TestAPIKey references.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Re-enable ST1003: rename Api → API in webhook identifiers

Renames sdkApiVersion → sdkAPIVersion and eventApiVersion →
eventAPIVersion in isCompatibleAPIVersion and its test table to
comply with Go's initialisms convention (ST1003).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Re-enable QF: apply staticcheck quickfix suggestions

- strings.ReplaceAll instead of strings.Replace(..., -1) in form/form.go and stripe.go
- De Morgan's law on double-negation in stripe.go
- fmt.Fprintf instead of Write([]byte(fmt.Sprintf(...))) in webhook/client.go and webhooks.go
- time.Time.IsZero() instead of == time.Time{} in webhook/client.go and webhooks.go
- Tagged switch on r.URL.RawQuery in search_iter_test.go (two tests)
- Remove redundant embedded-field qualifier in v2_events.go (regenerated via codegen fix)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Re-enable errcheck: fix all error-handling violations

Replace _ = / _, _ = workarounds with proper patterns:

- Test files: use assert.NoError(t, err) instead of blank identifiers
- hmac.Hash.Write (webhook/webhooks): annotate that Write never errors
  per the hash.Hash interface contract
- LeveledLogger methods (log.go): annotate that error returns would be
  a breaking API change; discard is intentional
- res.Body.Close() (stripe.go): log at warn level rather than silently
  discard — body is already buffered so the close error doesn't affect
  API semantics, but should be visible in logs if it occurs
- json.Unmarshal in setNestedNull: annotate that failure leaves arr nil,
  meaning the null is silently not written (latent inconsistency with
  the object case, but pre-existing)
- scripts/test_with_stripe_mock: annotate signal/wait as best-effort
- example code: capture and handle errors from void-return API methods

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* fix: always install pinned tool versions in just install

Drop the `which ... ||` guards so go install always runs with the pinned
version. The guards silently reused stale binaries when the pinned version
was bumped. Also fix the golangci-lint v2 module path (missing /v2).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Re-enable ST1005: fix capitalized error strings

Staticcheck ST1005 requires error strings not start with a capital
letter or end with punctuation. Fixed all 54 violations:

- Generated files (bankaccount, card, paymentsource, source,
  sourcetransaction, loginlink): regenerated from updated codegen templates
- Hand-written files (stripe.go, webhooks.go, webhook/client.go,
  v2_events.go, example/, scripts/): lowercased first letter and removed
  trailing periods where present
- Updated test assertions in stripe_test.go, webhooks_test.go, and
  webhook/client_test.go to match new lowercase strings
- Removed "-ST1005" suppression from .golangci.yml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

* Re-enable SA1019: fix or remove suppression for non-client.API violations

- oauth/client_test.go: replace deprecated ioutil.NopCloser with io.NopCloser
- mock/mock.go: migrate from client.New / *client.API to stripe.NewClient / *stripe.Client
- v2/core/eventdestination/client_test.go: migrate to stripe.Client API
  (New→Create, Get→Retrieve, Del→Delete, All→List+All, per-method params, context.Background())
- webhook/client_test.go: was already clean, suppression removed

Remaining SA1019 suppressions cover intentional backward-compat tests that
exercise the deprecated client.API surface directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

# Conflicts:
#	CHANGELOG.md
#	CODEGEN_VERSION
#	VERSION
#	api_version.go
#	checkout_session.go
#	issuing_dispute.go
#	setupattempt.go
#	stripe.go
#	stripe_client.go
#	subscription.go
#	subscription/client.go
#	subscription_service.go
#	terminal_configuration.go
#	v2_events.go
#	v2core_account.go
#	v2core_account_params.go