From 2a4f839ab0e380ad6437a7009bcb8d2b97430fa3 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Mon, 21 Sep 2026 12:05:52 +0100 Subject: [PATCH 1/8] validate: fix what a newer golangci-lint reports A golangci-lint built against Go 1.27 reports four issues on the tree that the currently pinned version never reaches, because it aborts on a typecheck error before any linter runs. Two are govet telling us reflect.Ptr is the old spelling of reflect.Pointer. Two are staticcheck on the deprecated Hooks.Prestart in a test table, annotated the way the non-test use of the same field in checkEventHooks already is. Signed-off-by: Daniel Golle Signed-off-by: Kir Kolyshkin --- validate/validate.go | 4 ++-- validate/validate_test.go | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/validate/validate.go b/validate/validate.go index 82e7b49b..4b2de5dc 100644 --- a/validate/validate.go +++ b/validate/validate.go @@ -742,13 +742,13 @@ func isStruct(t reflect.Type) bool { } func isStructPtr(t reflect.Type) bool { - return t.Kind() == reflect.Ptr && t.Elem().Kind() == reflect.Struct + return t.Kind() == reflect.Pointer && t.Elem().Kind() == reflect.Struct } func checkMandatoryUnit(field reflect.Value, tagField reflect.StructField, parent string) (errs error) { mandatory := !strings.Contains(tagField.Tag.Get("json"), "omitempty") switch field.Kind() { - case reflect.Ptr: + case reflect.Pointer: if mandatory && field.IsNil() { errs = multierror.Append(errs, fmt.Errorf("'%s.%s' should not be empty", parent, tagField.Name)) } diff --git a/validate/validate_test.go b/validate/validate_test.go index ac24845e..991dbbc3 100644 --- a/validate/validate_test.go +++ b/validate/validate_test.go @@ -669,7 +669,7 @@ func TestCheckHooks(t *testing.T) { val: rspec.Spec{ Version: "1.0.0", Hooks: &rspec.Hooks{ - Prestart: []rspec.Hook{ + Prestart: []rspec.Hook{ //nolint:staticcheck // Ignore SA1019: rspec.Hooks.Prestart is deprecated { Path: "/usr/bin/fix-mounts", }, @@ -682,7 +682,7 @@ func TestCheckHooks(t *testing.T) { val: rspec.Spec{ Version: "1.0.0", Hooks: &rspec.Hooks{ - Prestart: []rspec.Hook{ + Prestart: []rspec.Hook{ //nolint:staticcheck // Ignore SA1019: rspec.Hooks.Prestart is deprecated { Path: "usr", }, From f98e2a6233d18b35a54229ba512bdf1665533db8 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 14 Oct 2026 16:03:15 -0700 Subject: [PATCH 2/8] ci: use latest golangci-lint The lint job fails since setup-go's "stable" became Go 1.27, as golangci-lint v2.9 is built with go1.26 and can't load packages compiled by a newer Go: could not load export data ... export data version 4 is greater than maximum supported version 2 Since the lint job uses the latest stable Go, it makes sense to also use the latest golangci-lint, rather than pinning it and bumping the pin every time a new Go release comes out. This way, a new Go release results in new warnings (which we need to fix anyway) rather than in golangci-lint being unable to work at all. The issues found by the current version (v2.14.0) were fixed by the previous commit. Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 9f9a1258..e314a99a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -19,7 +19,7 @@ jobs: - uses: actions/checkout@v5 - uses: golangci/golangci-lint-action@v9 with: - version: v2.9 + version: latest commit: runs-on: ubuntu-24.04 From 25e15928793e7ced108e17277a088c2d759963fa Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 14 Oct 2026 16:03:40 -0700 Subject: [PATCH 3/8] ci: bump actions/checkout and actions/setup-go to v7 Bump actions/checkout to v7.0.1 and actions/setup-go to v7.0.0, pinning them by commit SHA. Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e314a99a..5adacf9e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -13,10 +13,10 @@ jobs: lint: runs-on: ubuntu-24.04 steps: - - uses: actions/setup-go@v6 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: stable - - uses: actions/checkout@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: golangci/golangci-lint-action@v9 with: version: latest @@ -49,9 +49,9 @@ jobs: steps: - name: checkout - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: install go ${{ matrix.go-version }} - uses: actions/setup-go@v6 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ matrix.go-version }} - name: build From 0efea7247fda765cd7fbd8295aff0a10dbac05d8 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 14 Oct 2026 17:07:04 -0700 Subject: [PATCH 4/8] ci: switch to ubuntu-26.04 Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 5adacf9e..b2ca6e62 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -11,7 +11,7 @@ on: jobs: lint: - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 steps: - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -22,7 +22,7 @@ jobs: version: latest commit: - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 # Only check commits on pull requests. if: github.event_name == 'pull_request' steps: @@ -40,7 +40,7 @@ jobs: error: 'Subject too long (max 72)' test: - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 strategy: fail-fast: false matrix: From 1b3cf2aa469e37259f62aa164218cb6f87e38ccc Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Fri, 16 Oct 2026 01:47:07 -0700 Subject: [PATCH 5/8] ci: simplify commit subject length check Replace two third-party actions (tim-actions/get-pr-commits and tim-actions/commit-message-checker-with-regex) with a few lines of shell using the GitHub API. Listing the PR commits via the API means no checkout is needed. Merge commits are skipped, as their subjects are generated by git and GitHub, not by the contributor. The API output is saved to a file before being fed to jq, rather than piped into it. In a pipeline, a gh failure would be masked, as jq happily succeeds on empty input. With the file, a gh failure fails the step via the default bash -e. While at it, set explicit minimal permissions for the job. Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 43 ++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 11 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b2ca6e62..a0021782 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -22,22 +22,43 @@ jobs: version: latest commit: + permissions: + contents: read + pull-requests: read # Needed to list the PR's commits. runs-on: ubuntu-26.04 # Only check commits on pull requests. if: github.event_name == 'pull_request' steps: - - name: get pr commits - id: 'get-pr-commits' - uses: tim-actions/get-pr-commits@v1.3.1 - with: - token: ${{ secrets.GITHUB_TOKEN }} + - name: check commit subject line length + env: + GH_TOKEN: ${{ github.token }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + # Save to a file first, so that a gh failure fails the step (rather + # than being masked by jq succeeding on empty input). + gh api --paginate --slurp \ + "/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/commits" \ + > "$RUNNER_TEMP/commits.json" - - name: check subject line length - uses: tim-actions/commit-message-checker-with-regex@v0.3.2 - with: - commits: ${{ steps.get-pr-commits.outputs.commits }} - pattern: '^.{0,72}(\n.*)*$' - error: 'Subject too long (max 72)' + # A page is an array, and --slurp gives an array of pages, thus + # the double iteration. Merge commits are skipped. + long=$(jq -r ' + .[][] + | select(.parents | length <= 1) + | (.commit.message | split("\n")[0]) as $subject + | select(($subject | length) > 72) + | "\(.sha[0:12]) \($subject)" + ' "$RUNNER_TEMP/commits.json") + + if [ -z "$long" ]; then + echo "All commit subject lines are 72 characters or less." + exit 0 + fi + + while read -r commit; do + echo "::error::subject line too long (max 72 characters): $commit" + done <<<"$long" + exit 1 test: runs-on: ubuntu-26.04 From ae2fe268517b5182610d62ccdf330d2d4692025d Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Fri, 16 Oct 2026 01:47:07 -0700 Subject: [PATCH 6/8] ci: bump and pin golangci-lint-action Bump golangci/golangci-lint-action to v9.3.0 and pin it by commit SHA, like actions/checkout and actions/setup-go already are. Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a0021782..c870cf61 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,7 +17,7 @@ jobs: with: go-version: stable - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: golangci/golangci-lint-action@v9 + - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: latest From 17210e43df6b51a9ec11a2f62ab0c12c2c9b880e Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Fri, 16 Oct 2026 01:52:35 -0700 Subject: [PATCH 7/8] ci: address zizmor warnings Fix the following issues reported by zizmor: - artipacked: set persist-credentials: false for actions/checkout, as no job needs git credentials after checkout; - excessive-permissions: set read-only default permissions for the workflow (the commit job sets its own); - cache-poisoning: disable actions/setup-go caching. The Go module cache is of little use here since dependencies are vendored. Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c870cf61..7c3af26c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -8,6 +8,9 @@ on: - release-* pull_request: +permissions: + contents: read + jobs: lint: @@ -16,7 +19,10 @@ jobs: - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: stable + cache: false - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: latest @@ -71,10 +77,13 @@ jobs: steps: - name: checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: install go ${{ matrix.go-version }} uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ matrix.go-version }} + cache: false - name: build run: make EXTRA_FLAGS="${{ matrix.race }}" - name: test From d64607d536712fe95cb6cc355baa0462302f72b8 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 14 Oct 2026 16:03:15 -0700 Subject: [PATCH 8/8] ci: add dependabot config for GitHub Actions This makes dependabot open PRs to bump actions used by CI workflows, so they don't get stale. Use a 7-day cooldown, so a new release gets some time in the wild (and a chance to be yanked if compromised) before we pick it up. Signed-off-by: Kir Kolyshkin --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..c6c8ed80 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +# Please see the documentation for all configuration options: +# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + +version: 2 +updates: + # Dependencies listed in .github/workflows/*.yml + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7