chore(build): run golangci-lint via go run (#39907)

`make lint-go` ran `go install` and then a bare `golangci-lint` from
`PATH`, which fails when `GOBIN` is not in `PATH` and overwrites any
`golangci-lint` installed there. It now uses `go run -exec 'env
GOOS=<target>'`, which builds golangci-lint for the host and passes the
lint target `GOOS` only to golangci-lint.

`deps-tools` prebuilds the tools with `go run -exec true` instead of `go
install`, because `go install` does not fill the executable cache that
`go run` uses.

Also drops the unused `TAGS` env and the redundant OS name in
`--build-tags`.

Makefile

@@ -561,14 +561,14 @@ deps-backend: ## install backend dependencies
 	$(GO) mod download
 
 .PHONY: deps-tools
-deps-tools: ## install tool dependencies
-	$(GO) install $(AIR_PACKAGE) & \
-	$(GO) install $(EDITORCONFIG_CHECKER_PACKAGE) & \
-	$(GO) install $(GOLANGCI_LINT_PACKAGE) & \
-	$(GO) install $(GXZ_PACKAGE) & \
-	$(GO) install $(SWAGGER_PACKAGE) & \
-	$(GO) install $(GOVULNCHECK_PACKAGE) & \
-	$(GO) install $(ACTIONLINT_PACKAGE) & \
+deps-tools: ## fetch and compile tool dependencies
+	$(GO) run -exec true $(AIR_PACKAGE) & \
+	$(GO) run -exec true $(EDITORCONFIG_CHECKER_PACKAGE) & \
+	$(GO) run -exec true $(GOLANGCI_LINT_PACKAGE) & \
+	$(GO) run -exec true $(GXZ_PACKAGE) & \
+	$(GO) run -exec true $(SWAGGER_PACKAGE) & \
+	$(GO) run -exec true $(GOVULNCHECK_PACKAGE) & \
+	$(GO) run -exec true $(ACTIONLINT_PACKAGE) & \
 	wait
 
 node_modules: pnpm-lock.yaml

tools/lint-go-all.go

@@ -4,6 +4,7 @@
 package main
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"io/fs"
@@ -11,6 +12,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"strings"
 
 	"golang.org/x/mod/modfile"
@@ -82,20 +84,7 @@ func lintGoHeader() bool {
 	return err == nil && bad == 0
 }
 
-func runCmd(env []string, name string, args []string) bool {
-	cmd := exec.Command(name, args...)
-	cmd.Env = append(os.Environ(), env...)
-	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
-	if err := cmd.Run(); err != nil {
-		_, _ = fmt.Fprintln(os.Stderr, err)
-		return false
-	}
-	return true
-}
-
 func main() {
-	// 'go run' can not have distinct GOOS/GOARCH for its build and run steps,
-	// so install a pre-compiled binary and run it for different target platforms.
 	_, _ = os.Unsetenv("GOOS"), os.Unsetenv("GOARCH")
 
 	envGolangciLintPackage := os.Getenv("GOLANGCI_LINT_PACKAGE")
@@ -104,8 +93,14 @@ func main() {
 		_, _ = fmt.Fprintln(os.Stderr, "Environment variables GO and GOLANGCI_LINT_PACKAGE must be set")
 		os.Exit(1)
 	}
-	if !runCmd(nil, envGo, []string{"install", envGolangciLintPackage}) {
-		os.Exit(1)
+	golangciLint := func(goos string, args ...string) bool {
+		cmd := exec.Command(envGo, slices.Concat([]string{"run", "-exec", "env GOOS=" + goos, envGolangciLintPackage, "run"}, args, os.Args[1:])...)
+		cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+		err := cmd.Run()
+		if _, isExit := errors.AsType[*exec.ExitError](err); err != nil && !isExit {
+			_, _ = fmt.Fprintln(os.Stderr, err)
+		}
+		return err == nil
 	}
 
 	_, _ = fmt.Fprintln(os.Stdout, "lint go header ...")
@@ -117,12 +112,12 @@ func main() {
 		// also lint with bindata tag if we are in CI or the "bindata" is explicitly set in the env TAGS
 		lintTagsLinux = "bindata"
 	}
-	succeed = runCmd([]string{"GOOS=linux", "TAGS=" + lintTagsLinux}, "golangci-lint", append([]string{"run", "--build-tags=linux," + lintTagsLinux}, os.Args[1:]...)) && succeed
+	succeed = golangciLint("linux", "--build-tags="+lintTagsLinux) && succeed
 
 	if os.Getenv("CI") != "" {
 		// only lint for other platforms when in CI, to keep local lint fast
 		_, _ = fmt.Fprintln(os.Stdout, "lint for windows ...")
-		succeed = runCmd([]string{"GOOS=windows"}, "golangci-lint", append([]string{"run", "--build-tags=windows"}, os.Args[1:]...)) && succeed
+		succeed = golangciLint("windows") && succeed
 	}
 
 	if !succeed {