Repository navigation
ci: fix lint, bump and pin actions, add dependabot - #818
Merged
Merged
Conversation
A golangci-lint built against Go 1.27 reports four issues on the tree that the currently pinned version never reaches, because it aborts on a typecheck error before any linter runs. Two are govet telling us reflect.Ptr is the old spelling of reflect.Pointer. Two are staticcheck on the deprecated Hooks.Prestart in a test table, annotated the way the non-test use of the same field in checkEventHooks already is. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
The lint job fails since setup-go's "stable" became Go 1.27, as
golangci-lint v2.9 is built with go1.26 and can't load packages
compiled by a newer Go:
could not load export data ... export data version 4 is greater
than maximum supported version 2
Since the lint job uses the latest stable Go, it makes sense to also
use the latest golangci-lint, rather than pinning it and bumping the
pin every time a new Go release comes out. This way, a new Go release
results in new warnings (which we need to fix anyway) rather than in
golangci-lint being unable to work at all.
The issues found by the current version (v2.14.0) were fixed by the
previous commit.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Contributor
Author
The alternative to that is to switch back from |
thaJeztah
reviewed
Oct 14, 2026
thaJeztah
reviewed
Oct 16, 2026
Bump actions/checkout to v7.0.1 and actions/setup-go to v7.0.0, pinning them by commit SHA. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Replace two third-party actions (tim-actions/get-pr-commits and tim-actions/commit-message-checker-with-regex) with a few lines of shell using the GitHub API. Listing the PR commits via the API means no checkout is needed. Merge commits are skipped, as their subjects are generated by git and GitHub, not by the contributor. The API output is saved to a file before being fed to jq, rather than piped into it. In a pipeline, a gh failure would be masked, as jq happily succeeds on empty input. With the file, a gh failure fails the step via the default bash -e. While at it, set explicit minimal permissions for the job. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Bump golangci/golangci-lint-action to v9.3.0 and pin it by commit SHA, like actions/checkout and actions/setup-go already are. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
kolyshkin
changed the title
Fix the following issues reported by zizmor: - artipacked: set persist-credentials: false for actions/checkout, as no job needs git credentials after checkout; - excessive-permissions: set read-only default permissions for the workflow (the commit job sets its own); - cache-poisoning: disable actions/setup-go caching. The Go module cache is of little use here since dependencies are vendored. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This makes dependabot open PRs to bump actions used by CI workflows, so they don't get stale. Use a 7-day cooldown, so a new release gets some time in the wild (and a chance to be yanked if compromised) before we pick it up. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Contributor
Author
|
just wanted to make CI green again and look what we have here now... |
utam0k
approved these changes
Oct 16, 2026
giuseppe
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The lint job is failing since setup-go's
stablemoved to Go 1.27, as golangci-lint v2.9 (built with go1.26) can't load packages compiled by a newer Go.This:
latest. Since the lint job uses the latest stable Go anyway, this avoids bumping the pin on every Go release, and makes a new Go release result in new warnings rather than in a non-working linter.persist-credentials: falsefor actions/checkout, read-only default workflow permissions, and disables actions/setup-go caching.Closes: #815