diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7c4b25c..a097f45 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -11,7 +11,7 @@ on:
 
 env:
   DESTDIR: ./bin
-  GO_VERSION: 1.16.7
+  GO_VERSION: 1.18.5
 
 jobs:
   validate:
@@ -20,6 +20,7 @@ jobs:
       fail-fast: false
       matrix:
         target:
+          - lint
           - validate-vendor
     steps:
       -
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 0000000..930e66a
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,35 @@
+run:
+  timeout: 10m
+  modules-download-mode: vendor
+
+linters:
+  enable:
+    - gofmt
+    - govet
+    - deadcode
+    - depguard
+    - goimports
+    - ineffassign
+    - misspell
+    - unused
+    - varcheck
+    - revive
+    - staticcheck
+    - typecheck
+    - structcheck
+  disable-all: true
+
+linters-settings:
+  depguard:
+    list-type: blacklist
+    include-go-root: true
+    packages:
+      # The io/ioutil package has been deprecated.
+      # https://go.dev/doc/go1.16#ioutil
+      - io/ioutil
+
+issues:
+  exclude-rules:
+    - linters:
+        - revive
+      text: "stutters"
diff --git a/Dockerfile b/Dockerfile
index 85845fd..a428272 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,6 +3,7 @@
 ARG GO_VERSION=1.18.5
 ARG XX_VERSION=1.1.2
 ARG OSXCROSS_VERSION=11.3-r7-alpine
+ARG GOLANGCI_LINT_VERSION=v1.47.3
 
 ARG PKG=github.com/docker/docker-credential-helpers
 
@@ -48,6 +49,14 @@ RUN --mount=type=bind,target=.,rw <<EOT
   fi
 EOT
 
+FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine AS golangci-lint
+FROM gobase AS lint
+RUN apk add musl-dev gcc libsecret-dev pass
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/root/.cache \
+    --mount=from=golangci-lint,source=/usr/bin/golangci-lint,target=/usr/bin/golangci-lint \
+    golangci-lint run ./...
+
 FROM gobase AS version
 ARG PKG
 RUN --mount=target=. \
diff --git a/Makefile b/Makefile
index 2f29c74..8a333fa 100644
--- a/Makefile
+++ b/Makefile
@@ -1,13 +1,9 @@
-.PHONY: all deps osxkeychain secretservice test validate wincred pass deb
+.PHONY: all osxkeychain secretservice test lint validate-vendor fmt validate wincred pass deb vendor
 
-TRAVIS_OS_NAME ?= linux
 VERSION := $(shell grep 'const Version' credentials/version.go | awk -F'"' '{ print $$2 }')
 
 all: test
 
-deps:
-	go get -u golang.org/x/lint/golint
-
 clean:
 	rm -rf bin
 	rm -rf release
@@ -50,28 +46,16 @@ test:
 	# tests all packages except vendor
 	go test -v `go list ./... | grep -v /vendor/`
 
-vet: vet_$(TRAVIS_OS_NAME)
-	go vet ./credentials
-
-vet_win:
-	go vet ./wincred
-
-vet_osx:
-	go vet ./osxkeychain
-
-vet_linux:
-	go vet ./secretservice
-
 lint:
-	for p in `go list ./... | grep -v /vendor/`; do \
-		golint $$p ; \
-	done
+	docker buildx bake lint
+
+validate-vendor:
+	docker buildx bake vendor-validate
 
 fmt:
 	gofmt -s -l `ls **/*.go | grep -v vendor`
 
-validate: vet lint fmt
-
+validate: lint validate-vendor fmt
 
 BUILDIMG:=docker-credential-secretservice-$(VERSION)
 deb:
@@ -84,14 +68,9 @@ deb:
 	docker run --rm --net=none $(BUILDIMG) tar cf - /release | tar xf -
 	docker rmi $(BUILDIMG)
 
-.PHONY: vendor
 vendor:
 	$(eval $@_TMP_OUT := $(shell mktemp -d -t docker-output.XXXXXXXXXX))
 	docker buildx bake --set "*.output=type=local,dest=$($@_TMP_OUT)" vendor
 	rm -rf ./vendor
 	cp -R "$($@_TMP_OUT)"/* .
 	rm -rf "$($@_TMP_OUT)"
-
-.PHONY: validate-vendor
-validate-vendor:
-	docker buildx bake vendor-validate
diff --git a/client/client_test.go b/client/client_test.go
index 649c1ae..693faaa 100644
--- a/client/client_test.go
+++ b/client/client_test.go
@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"strings"
 	"testing"
 
@@ -32,7 +31,7 @@ type mockProgram struct {
 // Output returns responses from the remote credentials helper.
 // It mocks those responses based in the input in the mock.
 func (m *mockProgram) Output() ([]byte, error) {
-	in, err := ioutil.ReadAll(m.input)
+	in, err := io.ReadAll(m.input)
 	if err != nil {
 		return nil, err
 	}
@@ -108,8 +107,8 @@ func ExampleStore() {
 
 func TestStore(t *testing.T) {
 	valid := []credentials.Credentials{
-		{validServerAddress, "foo", "bar"},
-		{validServerAddress2, "<token>", "abcd1234"},
+		{ServerURL: validServerAddress, Username: "foo", Secret: "bar"},
+		{ServerURL: validServerAddress2, Username: "<token>", Secret: "abcd1234"},
 	}
 
 	for _, v := range valid {
@@ -119,7 +118,7 @@ func TestStore(t *testing.T) {
 	}
 
 	invalid := []credentials.Credentials{
-		{invalidServerAddress, "foo", "bar"},
+		{ServerURL: invalidServerAddress, Username: "foo", Secret: "bar"},
 	}
 
 	for _, v := range invalid {
@@ -142,8 +141,8 @@ func ExampleGet() {
 
 func TestGet(t *testing.T) {
 	valid := []credentials.Credentials{
-		{validServerAddress, "foo", "bar"},
-		{validServerAddress2, "<token>", "abcd1234"},
+		{ServerURL: validServerAddress, Username: "foo", Secret: "bar"},
+		{ServerURL: validServerAddress2, Username: "<token>", Secret: "abcd1234"},
 	}
 
 	for _, v := range valid {
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 80ecf32..4cc91ae 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -22,15 +22,23 @@ group "default" {
 }
 
 group "validate" {
-  targets = ["vendor-validate"]
+  targets = ["lint", "vendor-validate"]
+}
+
+target "lint" {
+  inherits = ["_common"]
+  target = "lint"
+  output = ["type=cacheonly"]
 }
 
 target "vendor-validate" {
+  inherits = ["_common"]
   target = "vendor-validate"
   output = ["type=cacheonly"]
 }
 
 target "vendor" {
+  inherits = ["_common"]
   target = "vendor-update"
   output = ["."]
 }
diff --git a/pass/pass.go b/pass/pass.go
index 5750a78..6cce15d 100644
--- a/pass/pass.go
+++ b/pass/pass.go
@@ -9,7 +9,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io/fs"
 	"os"
 	"os/exec"
 	"path"
@@ -20,7 +20,7 @@ import (
 )
 
 // PASS_FOLDER contains the directory where credentials are stored
-const PASS_FOLDER = "docker-credential-helpers" //nolint: golint
+const PASS_FOLDER = "docker-credential-helpers" //nolint:revive
 
 // Pass handles secrets using Linux secret-service as a store.
 type Pass struct{}
@@ -116,16 +116,22 @@ func getPassDir() string {
 func listPassDir(args ...string) ([]os.FileInfo, error) {
 	passDir := getPassDir()
 	p := path.Join(append([]string{passDir, PASS_FOLDER}, args...)...)
-	contents, err := ioutil.ReadDir(p)
+	entries, err := os.ReadDir(p)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return []os.FileInfo{}, nil
 		}
-
 		return nil, err
 	}
-
-	return contents, nil
+	infos := make([]fs.FileInfo, 0, len(entries))
+	for _, entry := range entries {
+		info, err := entry.Info()
+		if err != nil {
+			return nil, err
+		}
+		infos = append(infos, info)
+	}
+	return infos, nil
 }
 
 // Get returns the username and secret to use for a given registry server URL.