use stock golangci-lint from nixpkgs

.golangci.yaml

@@ -277,9 +277,7 @@ linters:
 
     staticcheck:
       # Enable all checks (SA*, S*, ST*, QF*).
-      # SA4023: false positives on nabat Context.Form (can return nil) with the
-      # Go 1.27 staticcheck snapshot; re-enable when upstream settles.
-      checks: ["all", "-SA4023"]
+      checks: ["all"]
 
     nolintlint:
       # Fail unused //nolint and require naming the suppressed linter (no bare //nolint).

flake.nix

@@ -21,29 +21,14 @@
       system:
       let
         pkgs = import nixpkgs { inherit system; };
-        # nixpkgs' default `go` may lag; pin the toolchain Nabat requires.
+        # nixpkgs' default `go` is still 1.26; pin 1.27 for the module.
         go = pkgs.go_1_27;
 
         buildGoModule' = pkgs.buildGoModule.override { inherit go; };
 
         deployahVendorHash = "sha256-CT9xvdQvEU6shdz12Yu30R/uvbV36oA6Nok0LZ9f2mE=";
 
-        golangci-lint = import ./nix/golangci-lint.nix {
-          buildGoModule = buildGoModule';
-          inherit (pkgs)
-            fetchFromGitHub
-            installShellFiles
-            lib
-            stdenv
-            buildPackages
-            ;
-        };
-
-        # nixpkgs gopls is built with default `go` (still 1.26). gopls must be
-        # compiled with at least the toolchain it analyzes.
-        gopls = pkgs.gopls.override {
-          buildGoLatestModule = buildGoModule';
-        };
+        inherit (pkgs) golangci-lint gopls;
 
         deployah = import ./nix/deployah.nix {
           buildGoModule = buildGoModule';

internal/cmd/shell/executor.go

@@ -314,8 +314,8 @@ func isBrokenPipe(err error) bool {
 	if errors.Is(err, syscall.EPIPE) {
 		return true
 	}
-	var errno syscall.Errno
-	return errors.As(err, &errno) && errno == syscall.EPIPE
+	errno, ok := errors.AsType[syscall.Errno](err)
+	return ok && errno == syscall.EPIPE
 }
 
 // execTest executes a test command to check if something exists

nix/checks.nix

@@ -33,14 +33,11 @@ in
 git-hooks.lib.${system}.run {
   inherit src;
   hooks = {
-    # Use the pinned Go toolchain's gofmt; git-hooks' default wrapper
-    # still ships Go 1.26 and rejects go.mod 1.27.
+    # git-hooks' default gofmt package is pkgs.go (still 1.26).
     gofmt = {
       enable = true;
-      entry = "${go}/bin/gofmt -l -w";
-      files = "\\.go$";
+      package = go;
     };
-    # Flake-pinned golangci-lint (v2.13.1; nixpkgs-unstable still ships 2.12.2).
     golangci-lint = {
       enable = true;
       package = golangci-lint;