diff --git a/.golangci.yaml b/.golangci.yaml
index c8eb74af..81ab76d1 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -63,6 +63,7 @@ linters:
     - perfsprint
     - predeclared
     - rowserrcheck
+    - revive
     - sqlclosecheck
     - staticcheck
     - unconvert
@@ -159,6 +160,12 @@ linters:
     perfsprint:
       # modernize generates nicer fix code
       concat-loop: false
+    revive:
+      rules:
+        - name: exported
+          arguments:
+            - checkPrivateReceivers
+            - disableChecksOnConstants
     staticcheck:
       dot-import-whitelist:
         - github.com/majewsky/gg/option
diff --git a/Makefile.maker.yaml b/Makefile.maker.yaml
index d37c8c69..76aeead1 100644
--- a/Makefile.maker.yaml
+++ b/Makefile.maker.yaml
@@ -14,6 +14,11 @@ golang:
 
 golangciLint:
   createConfig: true
+  reviveRules:
+    - name: exported
+      arguments:
+        - checkPrivateReceivers
+        - disableChecksOnConstants
 
 githubWorkflow:
   ci:
diff --git a/internal/core/config.go b/internal/core/config.go
index 663a4a14..9ca3a1d2 100644
--- a/internal/core/config.go
+++ b/internal/core/config.go
@@ -17,6 +17,9 @@ import (
 	"github.com/sapcc/go-bits/regexpext"
 )
 
+// AutogeneratedHeader is a template.Template which gets used for inserting
+// copyright and license information into files.
+//
 //go:embed autogenerated-header.tmpl
 var AutogeneratedHeader string
 
@@ -109,6 +112,7 @@ type GolangConfiguration struct {
 	SetGoModVersion      bool                  `yaml:"setGoModVersion"`
 }
 
+// ReviveRule appears in type GolangciLintConfiguration.
 type ReviveRule struct {
 	Name      string   `yaml:"name"`
 	Arguments []string `yaml:"arguments"`
@@ -123,6 +127,7 @@ type GolangciLintConfiguration struct {
 	ReviveRules      []ReviveRule  `yaml:"reviveRules"`
 }
 
+// GoReleaserConfiguration appears in type Configuration.
 type GoReleaserConfiguration struct {
 	CreateConfig Option[bool]      `yaml:"createConfig"`
 	BinaryName   string            `yaml:"binaryName"`
@@ -132,7 +137,7 @@ type GoReleaserConfiguration struct {
 	NameTemplate string            `yaml:"nameTemplate"`
 }
 
-// IsEnabled encodes that the default state for the Enabled field is `false`.
+// ShouldCreateConfig encodes that the default state for the CreateConfig field is `false`.
 func (g GoReleaserConfiguration) ShouldCreateConfig() bool {
 	return g.CreateConfig.UnwrapOr(false)
 }
@@ -194,12 +199,14 @@ func (l LicenseWorkflowConfig) IsEnabled() bool {
 	return l.Enabled.UnwrapOr(true)
 }
 
+// PushContainerToGhcrConfig appears in type GithubWorkflowConfiguration.
 type PushContainerToGhcrConfig struct {
 	Enabled     bool     `yaml:"enabled"`
 	Platforms   string   `yaml:"platforms"`
 	TagStrategy []string `yaml:"tagStrategy"`
 }
 
+// ReleaseWorkflowConfig appears in type ReleaseWorkflowConfig.
 type ReleaseWorkflowConfig struct {
 	Enabled Option[bool] `yaml:"enabled"`
 }
@@ -222,6 +229,7 @@ type ShellCheckConfiguration struct {
 	Opts        string       `yaml:"opts"`
 }
 
+// AllIgnorePaths appends the vendor paths to the IgnorePaths when vendoring is enabled.
 func (s ShellCheckConfiguration) AllIgnorePaths(g GolangConfiguration) []string {
 	if g.EnableVendoring {
 		return append(slices.Clone(s.IgnorePaths), "./vendor/*")
@@ -234,6 +242,7 @@ func (s ShellCheckConfiguration) IsEnabled() bool {
 	return s.Enabled.UnwrapOr(true)
 }
 
+// PackageRule appears in type Configuration.
 type PackageRule struct {
 	MatchPackageNames           []string     `yaml:"matchPackageNames" json:"matchPackageNames,omitempty"`
 	MatchUpdateTypes            []string     `yaml:"matchUpdateTypes" json:"matchUpdateTypes,omitempty"`
@@ -274,6 +283,7 @@ type DockerfileConfig struct {
 	WithLinkerdAwait     bool     `yaml:"withLinkerdAwait"`
 }
 
+// ControllerGen appears in type Configuration.
 type ControllerGen struct {
 	Enabled                      Option[bool] `yaml:"enabled"`
 	CrdOutputPath                string       `yaml:"crdOutputPath"`
@@ -282,6 +292,7 @@ type ControllerGen struct {
 	ApplyconfigurationHeaderFile string       `yaml:"applyconfigurationHeaderFile"`
 }
 
+// LicenseConfig appears in type Configuration.
 type LicenseConfig struct {
 	AddHeaders        Option[bool]            `yaml:"addHeaders"`
 	CheckDependencies Option[bool]            `yaml:"checkDependencies"`
@@ -290,14 +301,17 @@ type LicenseConfig struct {
 	SPDX              Option[string]          `yaml:"spdx"`
 }
 
+// GetCopyright returns the set copyright string or a default.
 func (l LicenseConfig) GetCopyright() string {
 	return l.Copyright.UnwrapOr("SAP SE or an SAP affiliate company")
 }
 
+// GetSPDX returns the set spdx string or a default.
 func (l LicenseConfig) GetSPDX() string {
 	return l.SPDX.UnwrapOr("Apache-2.0")
 }
 
+// GoLicenseDetectorConfig appears in type LicenseConfig.
 type GoLicenseDetectorConfig struct {
 	Overrides []LicenseDetectorOverride `yaml:"overrides"`
 }
@@ -312,6 +326,7 @@ type LicenseDetectorOverride struct {
 	LicenceTextOverrideFile string `yaml:"licenceTextOverrideFile" json:"licenceTextOverrideFile,omitzero"`
 }
 
+// MakefileConfig appears in type Configuration.
 type MakefileConfig struct {
 	Enabled Option[bool] `yaml:"enabled"` // this is a pointer to bool to treat an absence as true for backwards compatibility
 }
@@ -332,6 +347,7 @@ func (m Metadata) IsSAPProject() bool {
 		strings.HasPrefix(m.URL, "https://github.tools.sap/")
 }
 
+// NixConfig appears in type Configuration.
 type NixConfig struct {
 	ExtraLibraries []string `yaml:"extraLibraries"`
 	ExtraPackages  []string `yaml:"extraPackages"`
@@ -340,6 +356,7 @@ type NixConfig struct {
 ///////////////////////////////////////////////////////////////////////////////
 // Helper functions
 
+// Validate checks the provided Configuration for integrity.
 func (c *Configuration) Validate() {
 	if len(c.SpellCheck.IgnoreWords) > 0 {
 		logg.Fatal("SpellCheck/misspell is deprecated, please migrate to typos")
diff --git a/internal/core/constants.go b/internal/core/constants.go
index 9f11e1e0..ac259f35 100644
--- a/internal/core/constants.go
+++ b/internal/core/constants.go
@@ -11,9 +11,12 @@ const (
 	DefaultGitHubComRunsOn     = "ubuntu-latest"
 )
 
+// DefaultGitHubEnterpriseRunsOn is a map of group names to runner labels for GitHub Enterprise.
 var DefaultGitHubEnterpriseRunsOn = map[string]string{
 	"group": "organization/Default",
 }
+
+// SugarRunsOn is an array of Sugar runners.
 var SugarRunsOn = []string{"self-hosted"}
 
 // GetUploadArtifactAction works around GitHub not supporting their own stuff
@@ -27,6 +30,7 @@ func GetUploadArtifactAction(isSelfHostedRunner bool) string {
 	}
 }
 
+// GetCodeqlInitAction returns the right CodeQL init action for the chosen Runner.
 // see https://github.com/github/codeql-action/releases
 // and https://github.wdf.sap.corp/Security-Testing/codeql-action/releases
 func GetCodeqlInitAction(isSelfHostedRunner bool) string {
@@ -36,6 +40,8 @@ func GetCodeqlInitAction(isSelfHostedRunner bool) string {
 		return "github/codeql-action/init@v4"
 	}
 }
+
+// GetCodeqlAnalyzeAction returns the right CodeQL analyze action for the chosen Runner.
 func GetCodeqlAnalyzeAction(isSelfHostedRunner bool) string {
 	if isSelfHostedRunner {
 		return "Security-Testing/codeql-action/analyze@v3"
@@ -43,6 +49,8 @@ func GetCodeqlAnalyzeAction(isSelfHostedRunner bool) string {
 		return "github/codeql-action/analyze@v4"
 	}
 }
+
+// GetCodeqlAutobuildAction returns the right CodeQL autobild action for the chosen Runner.
 func GetCodeqlAutobuildAction(isSelfHostedRunner bool) string {
 	if isSelfHostedRunner {
 		return "Security-Testing/codeql-action/autobuild@v3"
diff --git a/internal/dockerfile/docker.go b/internal/dockerfile/docker.go
index 3c5ce53b..6cfda7d7 100644
--- a/internal/dockerfile/docker.go
+++ b/internal/dockerfile/docker.go
@@ -24,6 +24,7 @@ var (
 	dockerignoreTemplate string
 )
 
+// RenderConfig writes the docker configuration files from the provided config and scan results.
 func RenderConfig(cfg core.Configuration, sr golang.ScanResult) {
 	// if there is an entrypoint configured use that otherwise fallback to the first binary name
 	var entrypoint string
diff --git a/internal/ghworkflow/utils.go b/internal/ghworkflow/utils.go
index 851019ba..3d6721b9 100644
--- a/internal/ghworkflow/utils.go
+++ b/internal/ghworkflow/utils.go
@@ -28,7 +28,7 @@ func baseJob(name string, cfg *core.GithubWorkflowConfiguration) job {
 	var (
 		runsOn   any
 		envs     map[string]string
-		strategy JobStrategy
+		strategy jobStrategy
 	)
 
 	if cfg.IsSelfHostedRunner {
diff --git a/internal/ghworkflow/workflow.go b/internal/ghworkflow/workflow.go
index 25fe3645..c5f6f625 100644
--- a/internal/ghworkflow/workflow.go
+++ b/internal/ghworkflow/workflow.go
@@ -90,6 +90,7 @@ type workflowDispatch struct {
 	manualTrigger bool `yaml:"-"`
 }
 
+// IsZero defines whether a workflowDispatch is zero (not set).
 func (w workflowDispatch) IsZero() bool {
 	return !w.manualTrigger
 }
@@ -119,7 +120,7 @@ type job struct {
 
 	// Strategy creates a build matrix for the job and allows different
 	// variations to run each job in.
-	Strategy JobStrategy `yaml:"strategy,omitempty"`
+	Strategy jobStrategy `yaml:"strategy,omitempty"`
 
 	// A map of <service_id> to their configuration(s).
 	Services map[string]jobService `yaml:"services,omitempty"`
@@ -130,7 +131,7 @@ type job struct {
 	Permissions permissions `yaml:"permissions,omitempty"`
 }
 
-type JobStrategy struct {
+type jobStrategy struct {
 	Matrix struct {
 		OS []string `yaml:"os"`
 	} `yaml:"matrix"`
diff --git a/internal/golang/scan.go b/internal/golang/scan.go
index 61660e85..9b5232a4 100644
--- a/internal/golang/scan.go
+++ b/internal/golang/scan.go
@@ -32,6 +32,7 @@ type ScanResult struct {
 
 const ModFilename = "go.mod"
 
+// Scan goes through the configuration files in the project to assemble a ScanResult.
 func Scan() ScanResult {
 	// assume this is not a go project if there is no go.mod file
 	_, err := os.Stat(ModFilename)
diff --git a/internal/golangcilint/golangci_lint.go b/internal/golangcilint/golangci_lint.go
index b94f6040..32326d9a 100644
--- a/internal/golangcilint/golangci_lint.go
+++ b/internal/golangcilint/golangci_lint.go
@@ -21,6 +21,7 @@ var (
 	configTemplate string
 )
 
+// RenderConfig writes the golanci-lint configuration files from the provided config and scan results.
 func RenderConfig(cfg core.Configuration, sr golang.ScanResult) {
 	timeout := 3 * time.Minute
 	if cfg.GolangciLint.Timeout != 0 {
diff --git a/internal/goreleaser/goreleaser.go b/internal/goreleaser/goreleaser.go
index 44741306..52977224 100644
--- a/internal/goreleaser/goreleaser.go
+++ b/internal/goreleaser/goreleaser.go
@@ -4,11 +4,10 @@
 package goreleaser
 
 import (
+	_ "embed"
 	"net/url"
 	"strings"
 
-	_ "embed"
-
 	"github.com/sapcc/go-makefile-maker/internal/core"
 	"github.com/sapcc/go-makefile-maker/internal/util"
 
@@ -24,6 +23,7 @@ var (
 	goreleaserTemplate string
 )
 
+// RenderConfig writes the goreleaser configuration files from the provided config and scan results.
 func RenderConfig(cfg core.Configuration) {
 	if len(cfg.Binaries) < 1 {
 		logg.Fatal("GoReleaser requires at least 1 binary to be configured in binaries!")
diff --git a/internal/nix/nix-shell.go b/internal/nix/nix-shell.go
index f6bc9277..bea7c14b 100644
--- a/internal/nix/nix-shell.go
+++ b/internal/nix/nix-shell.go
@@ -23,6 +23,7 @@ var (
 	envrcTemplate string
 )
 
+// RenderShell renders the Nix shell.
 func RenderShell(cfg core.Configuration, sr golang.ScanResult, renderGoreleaserConfig bool) {
 	goVersionSlice := strings.Split(core.DefaultGoVersion, ".")
 	goPackage := fmt.Sprintf("go_%s_%s", goVersionSlice[0], goVersionSlice[1])
diff --git a/internal/renovate/renovate.go b/internal/renovate/renovate.go
index 811f47f6..ddae7da4 100644
--- a/internal/renovate/renovate.go
+++ b/internal/renovate/renovate.go
@@ -39,6 +39,7 @@ type config struct {
 	SemanticCommits                            string             `json:"semanticCommits,omitempty"`
 }
 
+// RenderConfig writes the renovate configuration files from the provided config and scan results.
 func RenderConfig(cfg core.Configuration, scanResult golang.ScanResult) {
 	isGoMakefileMakerRepo := scanResult.ModulePath == "github.com/sapcc/go-makefile-maker"
 	isInternalRenovate := strings.HasPrefix(cfg.Metadata.URL, "https://github.wdf.sap.corp")
diff --git a/internal/reuse/reuse.go b/internal/reuse/reuse.go
index b2e32bf4..c9da8ba1 100644
--- a/internal/reuse/reuse.go
+++ b/internal/reuse/reuse.go
@@ -28,6 +28,7 @@ var (
 	goLicenceDetectorTemplate []byte
 )
 
+// RenderConfig writes the reuse configuration files from the provided config and scan results.
 func RenderConfig(cfg core.Configuration, sr golang.ScanResult) {
 	// If disabled, the REUSE.toml file should not be overridden.
 	// This is useful if the project needs additional information in
diff --git a/internal/typos/typos.go b/internal/typos/typos.go
index 0b502f05..9b54ee84 100644
--- a/internal/typos/typos.go
+++ b/internal/typos/typos.go
@@ -17,6 +17,7 @@ var (
 	typosConfigTemplate string
 )
 
+// RenderConfig writes the typos configuration files from the provided config.
 func RenderConfig(cfg core.Configuration) {
 	extendExcludes := []string{"go.mod"}
 	if cfg.Golang.EnableVendoring {