From 0e4518899b69e400d504a7aec691b3aab38f43ac Mon Sep 17 00:00:00 2001
From: Brandon Stoll <bstoll@users.noreply.github.com>
Date: Thu, 9 Jul 2026 18:57:27 +0000
Subject: [PATCH] chore(ci): update linter and dependabot rules (1/5)

This is part 1/5 of an overall cleanup effort to fix linter issues and format files across the repository.
In this step:
- Update checkov, golangci-lint, protolint, and trivy configs.
- Add dependabot cooldown period.
---
 .github/dependabot.yml           |  3 ++
 .github/linters/.checkov.yaml    |  1 +
 .github/linters/.golangci.yml    | 47 ++++++++++++++++++++++++++++++++
 .github/linters/.protolintrc.yml |  1 +
 .github/linters/trivy.yaml       |  1 +
 5 files changed, 53 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 90e05c40d..0f95de250 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,9 +3,12 @@
 # Please see the documentation for all configuration options:
 # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
+---
 version: 2
 updates:
   - package-ecosystem: "github-actions" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/linters/.checkov.yaml b/.github/linters/.checkov.yaml
index 937b2a0b6..55e40987c 100644
--- a/.github/linters/.checkov.yaml
+++ b/.github/linters/.checkov.yaml
@@ -1,3 +1,4 @@
+---
 skip-framework:
   - cloudformation
 skip-path:
diff --git a/.github/linters/.golangci.yml b/.github/linters/.golangci.yml
index 5e10a88a4..3739535f7 100644
--- a/.github/linters/.golangci.yml
+++ b/.github/linters/.golangci.yml
@@ -1,4 +1,51 @@
+---
 version: "2"
 
 issues:
   new-from-rev: origin/main
+linters:
+  enable:
+    - gocritic
+    - gosec
+    - revive
+    - unconvert
+    - unparam
+    - wastedassign
+    - whitespace
+  settings:
+    errcheck:
+      check-blank: true
+    gocritic:
+      disabled-checks:
+        - singleCaseSwitch
+        - appendAssign
+    revive:
+      severity: warning
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - dupl
+          - goconst
+          - gosec
+        path: _test\.go
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+      - \.pb\.go
diff --git a/.github/linters/.protolintrc.yml b/.github/linters/.protolintrc.yml
index 7bb2bd1ea..057e733b6 100644
--- a/.github/linters/.protolintrc.yml
+++ b/.github/linters/.protolintrc.yml
@@ -1,3 +1,4 @@
+---
 lint:
   rules:
     remove: # TODO: fix proto files and remove these.
diff --git a/.github/linters/trivy.yaml b/.github/linters/trivy.yaml
index fc175b68b..3aae11706 100644
--- a/.github/linters/trivy.yaml
+++ b/.github/linters/trivy.yaml
@@ -1,3 +1,4 @@
+---
 scan:
   skip-dirs:
     - manifests