fix: add golangci-lint config and fix all lint errors

- Add .golangci.yml with v2 config (errcheck, govet, staticcheck, misspell, etc.)
- Fix 32 errcheck issues across config, discord, ntfy, server packages
- Fix misspelling: cancelled → canceled
- Fix staticcheck: use append(slice...) instead of loop
- Fix staticcheck: remove empty error branch
- Use t.Setenv instead of os.Setenv/Unsetenv in tests
- Update CI workflow: add lint job, release tagging, ntfy notifications

internal/config/config.go

@@ -180,7 +180,7 @@ func (c *Config) watchFileSecrets(ctx context.Context) {
 		slog.Error("failed to create fsnotify watcher", "error", err)
 		return
 	}
-	defer watcher.Close()
+	defer func() { _ = watcher.Close() }()
 
 	// Watch the secrets directory
 	// Kubernetes updates secrets by changing the symlink, so watch the parent

internal/config/config_test.go

@@ -10,8 +10,7 @@ import (
 
 func TestGetEnv(t *testing.T) {
 	// Set a test env var
-	os.Setenv("TEST_CONFIG_VAR", "test_value")
-	defer os.Unsetenv("TEST_CONFIG_VAR")
+	t.Setenv("TEST_CONFIG_VAR", "test_value")
 
 	tests := []struct {
 		name       string
@@ -112,12 +111,8 @@ func TestConfig_LoadWebhookFromSecret_TrimsWhitespace(t *testing.T) {
 }
 
 func TestLoad_ParsesTopics(t *testing.T) {
-	os.Setenv("NTFY_TOPICS", "alerts, updates , notifications")
-	os.Setenv("VAULT_ENABLED", "false")
-	defer func() {
-		os.Unsetenv("NTFY_TOPICS")
-		os.Unsetenv("VAULT_ENABLED")
-	}()
+	t.Setenv("NTFY_TOPICS", "alerts, updates , notifications")
+	t.Setenv("VAULT_ENABLED", "false")
 
 	cfg, err := Load(context.Background())
 	if err != nil {
@@ -138,9 +133,9 @@ func TestLoad_ParsesTopics(t *testing.T) {
 
 func TestLoad_Defaults(t *testing.T) {
 	// Clear any existing env vars
-	os.Unsetenv("NTFY_URL")
-	os.Unsetenv("HTTP_PORT")
-	os.Unsetenv("VAULT_ENABLED")
+	t.Setenv("NTFY_URL", "")
+	t.Setenv("HTTP_PORT", "")
+	t.Setenv("VAULT_ENABLED", "")
 
 	cfg, err := Load(context.Background())
 	if err != nil {
@@ -161,8 +156,7 @@ func TestLoad_Defaults(t *testing.T) {
 }
 
 func TestLoad_VaultEnabled(t *testing.T) {
-	os.Setenv("VAULT_ENABLED", "true")
-	defer os.Unsetenv("VAULT_ENABLED")
+	t.Setenv("VAULT_ENABLED", "true")
 
 	// This will fail to init Vault (no server), but should gracefully fall back
 	cfg, err := Load(context.Background())
@@ -182,12 +176,8 @@ func TestLoad_VaultEnabled(t *testing.T) {
 
 func TestLoad_FallsBackToEnvVar(t *testing.T) {
 	webhookURL := "https://discord.com/api/webhooks/env/test"
-	os.Setenv("DISCORD_WEBHOOK_URL", webhookURL)
-	os.Setenv("VAULT_ENABLED", "false")
-	defer func() {
-		os.Unsetenv("DISCORD_WEBHOOK_URL")
-		os.Unsetenv("VAULT_ENABLED")
-	}()
+	t.Setenv("DISCORD_WEBHOOK_URL", webhookURL)
+	t.Setenv("VAULT_ENABLED", "false")
 
 	cfg, err := Load(context.Background())
 	if err != nil {

internal/config/fuzz_test.go

@@ -25,10 +25,7 @@ func FuzzParseTopics(f *testing.F) {
 			return
 		}
 
-		topics := make([]string, 0)
-		for _, topic := range splitAndTrim(input) {
-			topics = append(topics, topic)
-		}
+		topics := append([]string{}, splitAndTrim(input)...)
 
 		// Accessing results should not panic
 		_ = len(topics)