Fix CI: bump toolchain to go 1.26.4 and migrate golangci-lint to v2 - #3
Merged
Conversation
The CI Lint and Govulncheck jobs were failing because go.mod pinned an outdated go 1.26.1: - golangci-lint v1.62.2 (built with go1.23) refused to run against the go1.26 target. - govulncheck reported 9 stdlib vulns all fixed in go1.26.2-1.26.4. Changes: - go.mod: go 1.26.1 -> 1.26.4 (clears all govulncheck findings). - ci.yml: golangci-lint-action v6 -> v9, lint version v1.62.2 -> v2.12.2. - .golangci.yml: convert to v2 schema; exclude gosec G204/G304 (this CLI intentionally shells out to docker and opens files by computed path). - Resolve real findings surfaced by enabling the linters on existing code: errcheck (unchecked Close/RemoveAll/MkdirAll), revive (package comments), gosec G301 (dir perms 0755 -> 0750). Annotate the already-guarded Zip-Slip Join (G305) and the local docker-save copy (G110) with nolint. Validated locally: gofmt, go vet, go test -race, golangci-lint run (0 issues), and govulncheck (no vulnerabilities). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
LintandGovulncheckCI jobs have been failing since the CI pipeline merged (run #27835083693 on main), becausego.modpinned an outdated go 1.26.1:Changes
go.mod:go 1.26.1→1.26.4— clears all 9 govulncheck findings..github/workflows/ci.yml:golangci-lint-action@v6→@v9, versionv1.62.2→v2.12.2..golangci.yml: convert to the v2 schema; exclude gosec G204/G304 (this CLI intentionally shells out todockerand opens files by computed path).Close/RemoveAll/MkdirAll.0755→0750.Join(G305) and the localdocker savecopy (G110) with//nolint+ rationale.Validation (local)
gofmt -s -l .— cleango vet ./...— cleango test -race -cover ./...— passgolangci-lint run ./...(v2.12.2) — 0 issuesgovulncheck ./...— No vulnerabilities found🤖 Generated with Claude Code