chore!: modernize toolchain and project automation

.commitlintrc.yml

@@ -0,0 +1,5 @@
+extends:
+  - '@commitlint/config-conventional'
+
+rules:
+  header-max-length: [0, 'always', 100]

.github/workflows/ci.yml

@@ -0,0 +1,104 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      go_ci: ${{ steps.filter.outputs.go_ci }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Detect changed paths
+        id: filter
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            go_ci:
+              - '**/*.go'
+              - 'go.mod'
+              - 'go.sum'
+              - '.golangci.yml'
+              - '.github/workflows/ci.yml'
+
+  go:
+    needs: changes
+    if: needs.changes.outputs.go_ci == 'true'
+    runs-on: ubuntu-latest
+    container: golang:1.26-alpine
+    env:
+      CGO_ENABLED: 0
+      GOFLAGS: -buildvcs=false
+      GOMODCACHE: /go/pkg/mod
+      GOCACHE: /root/.cache/go-build
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Install system dependencies
+        shell: sh
+        run: apk add --no-cache bash ca-certificates git
+
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Cache Go modules and build outputs
+        uses: actions/cache@v5
+        with:
+          path: |
+            /go/pkg/mod
+            /root/.cache/go-build
+          key: ${{ runner.os }}-go-1.26-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-1.26-
+
+      - name: Verify generated files and module metadata
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          go generate ./...
+          go mod tidy
+          git diff --exit-code
+
+      - name: Check Go formatting
+        run: test -z "$(gofmt -l .)"
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12
+          args: --verbose
+
+      - name: Run Go tests
+        run: go test ./... -v -cover
+
+      - name: Run Go build
+        run: go build ./...
+
+      - name: Build CoreDNS with the local plugin
+        run: |
+          plugin_dir="$GITHUB_WORKSPACE"
+          coredns_version="$(go list -m -f '{{.Version}}' github.com/coredns/coredns)"
+          coredns_dir="$(mktemp -d)"
+
+          git clone --depth 1 --branch "$coredns_version" https://github.com/coredns/coredns.git "$coredns_dir"
+          cd "$coredns_dir"
+          go mod edit -replace "github.com/v-byte-cpu/coredns-https=$plugin_dir"
+          go get github.com/v-byte-cpu/coredns-https@v0.0.0
+          COREDNS_PLUGINS="dohproxy:github.com/v-byte-cpu/coredns-https" go generate coredns.go
+          go build -o coredns .
+          ./coredns -plugins | grep -Fx dohproxy

.github/workflows/commitlint.yml

@@ -0,0 +1,50 @@
+name: Commit checks
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: commitlint-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  commitlint:
+    if: >-
+      (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
+      || (github.event_name == 'push' && github.event.head_commit.author.name != 'dependabot[bot]')
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Enforce single-commit PRs
+        if: github.event_name == 'pull_request'
+        env:
+          PR_COMMIT_COUNT: ${{ github.event.pull_request.commits }}
+        run: test "$PR_COMMIT_COUNT" -eq 1
+
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+
+      - name: Install commitlint
+        run: npm install --no-save --no-package-lock @commitlint/cli @commitlint/config-conventional
+
+      - name: Validate PR title
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: printf '%s\n' "$PR_TITLE" | npx commitlint --verbose
+
+      - name: Validate last commit
+        run: npx commitlint --last --verbose

.github/workflows/release.yml

@@ -0,0 +1,78 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    env:
+      NOTES_PATH: ${{ github.workspace }}/release-notes.md
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Validate release tag
+        id: release_flags
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$ ]]; then
+            echo "invalid release tag: ${RELEASE_TAG}" >&2
+            exit 1
+          fi
+
+          if [[ "${RELEASE_TAG}" =~ -rc\.[0-9]+$ ]]; then
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+            echo "make_latest=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+            echo "make_latest=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Install git-cliff
+        uses: taiki-e/install-action@git-cliff
+
+      - name: Generate release notes
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          ignore_rc_tags='^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$'
+          if [[ "${RELEASE_TAG}" =~ -rc\.[0-9]+$ ]]; then
+            git-cliff --current --output "${NOTES_PATH}"
+          else
+            git-cliff --current --ignore-tags "${ignore_rc_tags}" --output "${NOTES_PATH}"
+          fi
+
+          cat "${NOTES_PATH}" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Create draft GitHub Release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          body_path: ${{ env.NOTES_PATH }}
+          draft: true
+          prerelease: ${{ steps.release_flags.outputs.prerelease }}
+          make_latest: ${{ steps.release_flags.outputs.make_latest }}

.golangci.yml

@@ -1,31 +1,71 @@
+version: "2"
+
 linters:
+  disable:
+    - errcheck
   enable:
     - dogsled
-    - errname
-    - errorlint
-    - exportloopref
+    - gochecknoinits
     - funlen
     - gocognit
     - goconst
     - gocritic
     - gocyclo
-    - gofmt
-    - goimports
+    - nolintlint
+    - paralleltest
+    - testifylint
     - staticcheck
     - gosec
-    - govet
     - misspell
     - nestif
     - prealloc
+    - revive
     - unconvert
     - unparam
+  exclusions:
+    rules:
+      # CoreDNS external plugins must register themselves during package initialization.
+      - linters:
+          - gochecknoinits
+        path: setup\.go
+        text: "don't use `init` function"
+      # Runtime configuration limits poolLen to maxUpstreams before this conversion.
+      - linters:
+          - gosec
+        path: policy\.go
+        text: "G115"
+      - linters:
+          - funlen
+          - goconst
+        path: _test\.go
+  settings:
+    revive:
+      severity: warning
+      confidence: 0.8
+      rules:
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: dot-imports
+        - name: error-return
+        - name: error-strings
+        - name: empty-block
+        - name: superfluous-else
+        - name: unhandled-error
+        - name: unused-receiver
+        - name: unreachable-code
+        - name: range-val-in-closure
+        - name: range-val-address
+        - name: waitgroup-by-value
+        - name: atomic
+        - name: early-return
+        - name: unconditional-recursion
+        - name: identical-branches
 
-run:
-  timeout: 5m
+formatters:
+  enable:
+    - gofmt
+    - goimports
 
-issues:
-  exclude-rules:
-    - linters:
-        - funlen
-        - gosec
-      path: _test\.go
+run:
+  timeout: 3m