diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 79ce408..871cdf8 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -17,6 +17,18 @@ jobs:
           go-version-file: go.mod
       - run: go build -o out/server ./cmd/server
 
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - uses: golangci/golangci-lint-action@v6
+        with:
+          version: v1.62
+
   test:
     name: Test
     runs-on: ubuntu-latest
diff --git a/.golangci.yaml b/.golangci.yaml
new file mode 100644
index 0000000..93ecf4b
--- /dev/null
+++ b/.golangci.yaml
@@ -0,0 +1,9 @@
+linters:
+  enable:
+    - gofmt
+    - revive
+
+issues:
+  exclude-dirs:
+    - server/handler/openapi
+    - ".*/mock$"
diff --git a/server/handler/handler_test.go b/server/handler/handler_test.go
index 491ba06..7b18940 100644
--- a/server/handler/handler_test.go
+++ b/server/handler/handler_test.go
@@ -95,7 +95,7 @@ func Login(t *testing.T, server *httptest.Server, client *http.Client, userID st
 	t.Helper()
 
 	// not following redirect for the first request
-	client.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+	client.CheckRedirect = func(*http.Request, []*http.Request) error {
 		return http.ErrUseLastResponse
 	}
 
@@ -254,12 +254,12 @@ func (s *oauth2MockServer) handleToken(w http.ResponseWriter, r *http.Request) {
 
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
-	json.NewEncoder(w).Encode(res)
+	_ = json.NewEncoder(w).Encode(res)
 }
 
-func (s *oauth2MockServer) handleWellKnown(w http.ResponseWriter, r *http.Request) {
+func (s *oauth2MockServer) handleWellKnown(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]any{
+	_ = json.NewEncoder(w).Encode(map[string]any{
 		"issuer":                 s.rootURL,
 		"authorization_endpoint": s.rootURL + "/authorize",
 		"token_endpoint":         s.rootURL + "/token",
@@ -269,7 +269,7 @@ func (s *oauth2MockServer) handleWellKnown(w http.ResponseWriter, r *http.Reques
 
 func (s *oauth2MockServer) handleJWKS(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(map[string]any{
+	_ = json.NewEncoder(w).Encode(map[string]any{
 		"keys": []map[string]any{
 			{
 				"kty": "RSA",
diff --git a/server/handler/middleware_test.go b/server/handler/middleware_test.go
index 4238db0..0d73987 100644
--- a/server/handler/middleware_test.go
+++ b/server/handler/middleware_test.go
@@ -72,7 +72,7 @@ func TestAuthMiddleware(t *testing.T) {
 
 			req := httptest.NewRequest(http.MethodGet, "/", nil)
 			rec := httptest.NewRecorder()
-			needAuthorize(echo.New().NewContext(req, rec))
+			_ = needAuthorize(echo.New().NewContext(req, rec))
 			if rec.Code != tt.expectStatus {
 				t.Errorf("unexpected status code: expected=%d, got=%d", tt.expectStatus, rec.Code)
 			}
diff --git a/server/handler/oauth2_test.go b/server/handler/oauth2_test.go
index df50319..ad2dc4d 100644
--- a/server/handler/oauth2_test.go
+++ b/server/handler/oauth2_test.go
@@ -65,7 +65,7 @@ func TestLogout(t *testing.T) {
 	// logout
 	// return not expired session
 	mockRepo.EXPECT().FindSession(gomock.Any(), gomock.Any()).
-		DoAndReturn(func(ctx context.Context, sid string) (domain.Session, error) {
+		DoAndReturn(func(_ context.Context, sid string) (domain.Session, error) {
 			return domain.Session{
 				ID:        sid,
 				UserID:    userID,
diff --git a/server/repository/db/repository.go b/server/repository/db/repository.go
index d09b7e3..add168c 100644
--- a/server/repository/db/repository.go
+++ b/server/repository/db/repository.go
@@ -33,7 +33,7 @@ func (r *Repository) Transaction(ctx context.Context, f func(ctx context.Context
 	if err != nil {
 		return err
 	}
-	defer tx.Rollback()
+	defer tx.Rollback() //nolint errcheck
 
 	txRepo := newTxRepository(tx)