perf: replace goheader linter with custom check

.github/workflows/cache-seeder.yml

@@ -54,8 +54,6 @@ jobs:
       matrix:
         include:
           - { job: lint-backend, tags: "bindata", target: "lint-backend" }
-          - { job: lint-go-windows, tags: "bindata", target: "lint-go-windows" }
-          - { job: lint-go-gogit, tags: "bindata gogit", target: "lint-go" }
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0

.github/workflows/pull-compliance.yml

@@ -64,48 +64,6 @@ jobs:
       - if: needs.files-changed.outputs.actions == 'true'
         run: make lint-actions
 
-  lint-go-windows:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: lint-go-windows
-          lint-cache: "true"
-      - run: make deps-backend deps-tools
-      - run: make lint-go-windows
-        env:
-          TAGS: bindata
-          GOOS: windows
-          GOARCH: amd64
-
-  lint-go-gogit:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: lint-go-gogit
-          lint-cache: "true"
-      - run: make deps-backend deps-tools
-      - run: make lint-go
-        env:
-          TAGS: bindata gogit
-
   checks-backend:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
     needs: files-changed

.golangci.yml

@@ -13,7 +13,6 @@ linters:
     - forbidigo
     - gocheckcompilerdirectives
     - gocritic
-    - goheader
     - govet
     - ineffassign
     - mirror
@@ -118,11 +117,6 @@ linters:
       enable:
         - nilness
         - unusedwrite
-    goheader:
-      values:
-        regexp:
-          HEADER: '((Copyright [^\n]+|All rights reserved\.)\n)*Copyright \d{4} (The (Gogs|Gitea) Authors|Gitea Authors|Gitea)\.( All rights reserved\.)?(\n(Copyright [^\n]+|All rights reserved\.))*\nSPDX-License-Identifier: [\w.-]+'
-      template: '{{ HEADER }}'
   exclusions:
     generated: lax
     presets:

Makefile

@@ -332,18 +332,11 @@ lint-spell-fix: ## lint spelling and fix issues
 
 .PHONY: lint-go
 lint-go: ## lint go files
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) run
+	GO=$(GO) GOLANGCI_LINT_PACKAGE=$(GOLANGCI_LINT_PACKAGE) $(GO) run ./tools/lint-go-all.go
 
 .PHONY: lint-go-fix
 lint-go-fix: ## lint go files and fix issues
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) run --fix
-
-# workaround step for the lint-go-windows CI task because 'go run' can not
-# have distinct GOOS/GOARCH for its build and run steps
-.PHONY: lint-go-windows
-lint-go-windows:
-	@GOOS= GOARCH= $(GO) install $(GOLANGCI_LINT_PACKAGE)
-	golangci-lint run
+	GO=$(GO) GOLANGCI_LINT_PACKAGE=$(GOLANGCI_LINT_PACKAGE) $(GO) run ./tools/lint-go-all.go --fix
 
 .PHONY: lint-editorconfig
 lint-editorconfig:

build/generate-gitignores.go

@@ -1,3 +1,6 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
 //go:build ignore
 
 package main

models/db/driver_sqlite_mattn.go

@@ -1,8 +1,8 @@
-//go:build sqlite_mattn && sqlite_unlock_notify
-
 // Copyright 2026 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
+//go:build sqlite_mattn && sqlite_unlock_notify
+
 package db
 
 import (

models/db/driver_sqlite_modernc.go

@@ -1,8 +1,8 @@
-//go:build !sqlite_mattn
-
 // Copyright 2026 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
+//go:build !sqlite_mattn
+
 // modernc driver is chosen as the default one (compared to mattn, ncruces)
 // * mattn was used as default, but it requires CGO
 // * the CI times are almost the same for these three (race detector must be disabled)

modules/auth/pam/pam_test.go

@@ -1,8 +1,8 @@
-//go:build pam
-
 // Copyright 2021 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
+//go:build pam
+
 package pam
 
 import (

tools/lint-go-all.go

@@ -0,0 +1,96 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+)
+
+func lintGoHeader() bool {
+	headerRE := regexp.MustCompile(`^(// (Copyright [^\n]+|All rights reserved\.)\n)*// Copyright \d{4} (The Gogs Authors|The Gitea Authors|Gitea Authors|Gitea)\.( All rights reserved\.)?\n(// (Copyright [^\n]+|All rights reserved\.)\n)*// SPDX-License-Identifier: [\w.-]+`)
+	generatedRE := regexp.MustCompile(`(?m)^// (Code|This file is) [Gg]enerated.*DO NOT EDIT`)
+	skipDirs := map[string]bool{
+		".git":         true,
+		".venv":        true,
+		"node_modules": true,
+		"public":       true,
+		"vendor":       true,
+		"web_src":      true,
+	}
+	root, bad := ".", 0
+	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			if rel, _ := filepath.Rel(root, path); skipDirs[filepath.ToSlash(rel)] {
+				return fs.SkipDir
+			}
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") {
+			return nil
+		}
+		f, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		data, err := io.ReadAll(io.LimitReader(f, 512))
+		_ = f.Close()
+		if err != nil {
+			return err
+		}
+		if generatedRE.Match(data) {
+			return nil
+		}
+		if !headerRE.Match(data) {
+			_, _ = fmt.Fprintf(os.Stderr, "%s: missing or invalid copyright header\n", path)
+			bad++
+		}
+		return nil
+	})
+	if err != nil {
+		_, _ = fmt.Fprintln(os.Stderr, err)
+	}
+	return err == nil && bad == 0
+}
+
+func runCmd(env []string, name string, args []string) bool {
+	cmd := exec.Command(name, args...)
+	cmd.Env = append(os.Environ(), env...)
+	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+	if err := cmd.Run(); err != nil {
+		_, _ = fmt.Fprintln(os.Stderr, err)
+		return false
+	}
+	return true
+}
+
+func main() {
+	// 'go run' can not have distinct GOOS/GOARCH for its build and run steps,
+	// so install a pre-compiled binary and run it for different target platforms.
+	_, _ = os.Unsetenv("GOOS"), os.Unsetenv("GOARCH")
+	envGolangciLintPackage := os.Getenv("GOLANGCI_LINT_PACKAGE")
+	envGo := os.Getenv("GO")
+	if !runCmd(nil, envGo, []string{"install", envGolangciLintPackage}) {
+		os.Exit(1)
+	}
+
+	_, _ = fmt.Fprintln(os.Stdout, "lint go header ...")
+	succeed := lintGoHeader()
+	_, _ = fmt.Fprintln(os.Stdout, "lint for linux ...")
+	succeed = runCmd([]string{"GOOS=linux", "TAGS=bindata"}, "golangci-lint", append([]string{"run"}, os.Args[1:]...)) && succeed
+	_, _ = fmt.Fprintln(os.Stdout, "lint for windows ...")
+	succeed = runCmd([]string{"GOOS=windows", "TAGS=gogit"}, "golangci-lint", append([]string{"run"}, os.Args[1:]...)) && succeed
+	if !succeed {
+		os.Exit(1)
+	}
+}