feat: cert file and TLS skip verify

.github/golangci.yaml

@@ -1,33 +1,46 @@
+version: "2"
 run:
-  timeout: 5m
   modules-download-mode: readonly
-
 output:
-  formats: colored-line-number
-
+  formats:
+    text:
+      path: stdout
+      color: true
 linters:
   enable:
-    - revive
-    - errcheck
-    - unused
-    - staticcheck
-    - ineffassign
-    - govet
-    - gosimple
     - bodyclose
-    - gofumpt
-
-issues:
-  exclude-use-default: false
-  exclude-rules:
-    - path: /*.go
-      text: "package-comments: should have a package comment"
-      linters:
-        - revive
-
+    - revive
+  exclusions:
+    generated: lax
+    rules:
+      - linters:
+          - revive
+        path: /*.go
+        text: 'package-comments: should have a package comment'
+      - path: /*.go
+        text: 'SA1019: filter.DataType is deprecated'
+      - path: /*.go
+        text: 'SA1019: g.client.RetrieveIngestionLogs is deprecated'
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
 severity:
-  default-severity: error
-
-linters-settings:
-  go-fumpt:
-    extra-rules: true
+  default: error
+formatters:
+  enable:
+    - gci
+    - gofumpt
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(github.com/netboxlabs/diode-sdk-go)
+      custom-order: true
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.github/workflows/lint.yaml

@@ -16,13 +16,15 @@ jobs:
   golangci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Go
+        uses: actions/setup-go@v5
         with:
-          go-version: '1.23.x'
-          cache: false
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6
+          go-version: '1.24.x'
+          check-latest: true
+      - name: Lint
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 #v8.0.0
         with:
-          version: v1.62
+          version: v2.1
           args: --config ./.github/golangci.yaml

.github/workflows/test.yaml

@@ -21,9 +21,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
-          go-version: '1.23.x'
+          go-version: '1.24.x'
           check-latest: true
       - name: Run go build
         run: go build ./...

README.md

@@ -26,6 +26,8 @@ go get github.com/netboxlabs/diode-sdk-go
 * `DIODE_SDK_LOG_LEVEL` - Log level for the SDK (default: `INFO`)
 * `DIODE_CLIENT_ID` - Client ID for OAuth2 authentication
 * `DIODE_CLIENT_SECRET` - Client Secret for OAuth2 authentication
+* `DIODE_CERT_FILE` - Path to custom certificate file for TLS connections
+* `DIODE_SKIP_TLS_VERIFY` - Skip TLS verification (default: `false`)
 * `DIODE_DRY_RUN_OUTPUT_DIR` - Directory to write dry run output files when using `DryRunClient`
 
 ### Example
@@ -117,6 +119,51 @@ func main() {
 
 See all [examples](./examples/main.go) for reference.
 
+### TLS verification and certificates
+
+TLS verification is controlled by the target URL scheme:
+- **Secure schemes** (`grpcs://`, `https://`): TLS verification enabled  
+- **Insecure schemes** (`grpc://`, `http://`): TLS verification disabled
+
+```go
+// TLS verification enabled (uses system certificates)
+client, err := diode.NewClient("grpcs://example.com", ...)
+
+// TLS verification disabled  
+client, err := diode.NewClient("grpc://example.com", ...)
+```
+
+#### Using custom certificates
+
+```go
+// Via constructor parameter
+client, err := diode.NewClient(
+	"grpcs://example.com", 
+	"example-app", "0.1.0",
+	diode.WithCertFile("/path/to/cert.pem"),
+)
+
+// Or via environment variable
+export DIODE_CERT_FILE=/path/to/cert.pem
+```
+
+#### Disabling TLS verification
+
+```bash
+export DIODE_SKIP_TLS_VERIFY=true
+```
+
+#### For legacy certificates (CN-only, no SANs)
+
+```go
+client, err := diode.NewClient(
+	"grpcs://example.com",
+	"example-app", "0.1.0", 
+	diode.WithCertFile("/path/to/cert.pem"),
+	diode.WithSkipTLSVerify(),
+)
+```
+
 ### Dry run client
 
 Use a `DryRunClient` to inspect what would be sent to Diode without actually sending any data. When a directory is provided a new JSON file is created for each ingest call.