perf(hooks): take vulnerability scanning out of the commit path

Makefile

@@ -1,5 +1,5 @@
 # Include ODC common make targets
-DEV_KIT_VERSION := v1.0.15
+DEV_KIT_VERSION := v2.0.0
 -include common.mk
 common.mk:
 	@[ -f .common.mk-download ] || \
@@ -71,12 +71,15 @@ codegen: $(OPENAPI_GEN) manifests ## Run code generation, e.g. openapi
 .PHONY: fmt
 fmt: $(ADDLICENSE) $(GOLANGCI_LINT) ## Add license headers and format code
 	git ls-files | grep '.*\.go$$' | xargs $(ADDLICENSE) -c 'BWI GmbH and Solution Arsenal contributors' -l apache -s=only
-	$(GO) fmt ./...
-	$(GOLANGCI_LINT) run --fix
+	$(GOLANGCI_LINT) fmt
 
 .PHONY: lint
 lint: lint-no-golangci golangci-lint ## Run linters
 
+.PHONY: lint-fix
+lint-fix: lint-no-golangci $(GOLANGCI_LINT) ## Run linters, auto-fixing what golangci-lint can fix (used by the pre-commit hook)
+	$(GOLANGCI_LINT) run --fix
+
 .PHONY: lint-no-golangci
 lint-no-golangci: $(ADDLICENSE) shellcheck  ## Run linters but not golangci-lint to exit early in CI/CD pipeline
 	git ls-files | grep '.*\.go$$' | xargs $(ADDLICENSE) -check -l apache -s=only -check

docs/CONTRIBUTING.md

@@ -71,8 +71,9 @@ The SolAr build system uses a Makefile to orchestrate various tools, designed fo
 | ---------------- | -------------------------------------- | ------------------------------------------- |
 | `make codegen`   | Generate client-go libraries & OpenAPI | `openapi-gen`, `kube_codegen.sh`            |
 | `make manifests` | Generate RBAC manifests                | `controller-gen`                            |
-| `make fmt`       | Format code, add license headers       | `addlicense`, `go fmt`                      |
+| `make fmt`       | Format code, add license headers       | `addlicense`, `golangci-lint`               |
 | `make lint`      | Run linters and checks                 | `golangci-lint`, `shellcheck`, `addlicense` |
+| `make lint-fix`  | As `make lint`, but auto-fixing        | `golangci-lint`, `shellcheck`, `addlicense` |
 | `make test`      | Run all tests with coverage            | `ginkgo`, `setup-envtest`                   |
 | `make clean`     | Remove generated binaries              | -                                           |
 | `make help`      | Show help for all make targets         | -                                           |
@@ -247,7 +248,10 @@ Fix issues with:
 
 ```sh
 make fmt
-make lint
+make lint-fix
 ```
 
+`make lint` reports findings without rewriting files; `make lint-fix` applies what
+`golangci-lint` can fix automatically.
+
 ***

flake.nix

@@ -12,7 +12,7 @@
     };
 
     dev-kit = {
-      url = "github:opendefensecloud/dev-kit";
+      url = "github:opendefensecloud/dev-kit/v2.0.0";
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.go-overlay.follows = "go-overlay";
       inputs.flake-utils.follows = "flake-utils";
@@ -41,6 +41,16 @@
 
           preCommitHooks = {
             commitlint.enable = true;
+
+            # `make lint-fix` is `make lint` with `golangci-lint run --fix`.
+            # Linters that can repair their own findings rewrite the file, so
+            # pre-commit aborts the first attempt with "files were modified by
+            # this hook" and the fix costs a `git add` plus a second `git
+            # commit` rather than a hand edit. Unfixable findings fail
+            # outright. `pass_filenames = false` is inherited from dev-kit's
+            # default, so this lints the whole repo, not just staged files.
+            # CI runs plain `make lint`, which reports rather than rewrites.
+            lint.entry = "make lint-fix";
           };
         };
       }