From b6ffbc4fe419726427dddeb7555163e2b60d89db Mon Sep 17 00:00:00 2001 From: Bo Date: Fri, 9 Oct 2026 18:59:55 -0400 Subject: [PATCH 1/2] fix(skills): drop broad allowed-tools grant from research The plugin marketplace validator flagged research's allowed-tools line (ALLOWED_TOOLS_BROAD for unscoped Bash, ALLOWED_TOOLS_UNSCOPED_WRITE for unscoped Write). No step in the skill needs unprompted execution, so the grant is removed and research uses the normal permission prompts like the other 28 skills. --- skills/research/SKILL.md | 1 - 1 file changed, 1 deletion(-) diff --git a/skills/research/SKILL.md b/skills/research/SKILL.md index d05662d67..3dd4410cc 100644 --- a/skills/research/SKILL.md +++ b/skills/research/SKILL.md @@ -14,7 +14,6 @@ produces: context_rel: [] skill_api_version: 1 user-invocable: true -allowed-tools: Read, Grep, Glob, Bash, Write metadata: capabilities: [research, codebase_recon, pattern_mining] effects: [write_research_report, write_recon_pack, write_pattern_evidence] From e91c6b5a407dad2970de15a4faa48dcb2a72620f Mon Sep 17 00:00:00 2001 From: Bo Date: Fri, 9 Oct 2026 19:10:47 -0400 Subject: [PATCH 2/2] chore(ci): bump golangci-lint to v2.14.0 for the go1.27.2 toolchain The pinned v2.13.1 (x/tools 0.49.0) cannot read go1.27 export data ("export data version 5 is greater than maximum supported version 4"), so the go.lint gate failed on every PR after the toolchain bump in #1201. v2.14.0 ships x/tools 0.50.0 and lints the tree clean (0 findings). --- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/validate.yml | 2 +- scripts/golangci-lint-v2.sh | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 6060c70f9..ecf0c7c0d 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -95,7 +95,7 @@ jobs: GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1 # golangci-lint - GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1 + GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 # govulncheck — known-CVE reachability over the module graph + stdlib # (sweep 2026-07-09 M-2: the blind spot that let GO-2026-4970 sit a week). diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index de6bec2d7..4e453386d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -65,7 +65,7 @@ jobs: GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1 # golangci-lint - GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1 + GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 # Use the same scanner pins as the nightly full-security lane. # govulncheck covers known-CVE reachability in dependencies and stdlib. diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 467b8027e..7f6a10339 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -621,7 +621,7 @@ jobs: retry python -m pip install semgrep==1.169.0 ruff==0.15.21 radon==6.0.1 retry env GOBIN=/usr/local/bin go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1 retry env GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1 - retry env GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1 + retry env GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 retry env GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@v1.6.0 # trivy — pinned tag, download-then-execute (mirrors nightly.yml; piping a # mutable-branch script into sh is the gha-curl-pipe-shell supply-chain class). diff --git a/scripts/golangci-lint-v2.sh b/scripts/golangci-lint-v2.sh index 42b1c79d4..9aacbf5d8 100755 --- a/scripts/golangci-lint-v2.sh +++ b/scripts/golangci-lint-v2.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -VERSION="${GOLANGCI_LINT_VERSION:-v2.13.1}" +VERSION="${GOLANGCI_LINT_VERSION:-v2.14.0}" DISPLAY_VERSION="${VERSION#v}" MODULE="github.com/golangci/golangci-lint/v2/cmd/golangci-lint"