From e91c6b5a407dad2970de15a4faa48dcb2a72620f Mon Sep 17 00:00:00 2001 From: Bo Date: Fri, 9 Oct 2026 19:10:47 -0400 Subject: [PATCH] chore(ci): bump golangci-lint to v2.14.0 for the go1.27.2 toolchain The pinned v2.13.1 (x/tools 0.49.0) cannot read go1.27 export data ("export data version 5 is greater than maximum supported version 4"), so the go.lint gate failed on every PR after the toolchain bump in #1201. v2.14.0 ships x/tools 0.50.0 and lints the tree clean (0 findings). --- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/validate.yml | 2 +- scripts/golangci-lint-v2.sh | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 6060c70f9..ecf0c7c0d 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -95,7 +95,7 @@ jobs: GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1 # golangci-lint - GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1 + GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 # govulncheck — known-CVE reachability over the module graph + stdlib # (sweep 2026-07-09 M-2: the blind spot that let GO-2026-4970 sit a week). diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index de6bec2d7..4e453386d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -65,7 +65,7 @@ jobs: GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1 # golangci-lint - GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1 + GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 # Use the same scanner pins as the nightly full-security lane. # govulncheck covers known-CVE reachability in dependencies and stdlib. diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 467b8027e..7f6a10339 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -621,7 +621,7 @@ jobs: retry python -m pip install semgrep==1.169.0 ruff==0.15.21 radon==6.0.1 retry env GOBIN=/usr/local/bin go install github.com/securego/gosec/v2/cmd/gosec@v2.27.1 retry env GOBIN=/usr/local/bin go install github.com/zricethezav/gitleaks/v8@v8.30.1 - retry env GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1 + retry env GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 retry env GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@v1.6.0 # trivy — pinned tag, download-then-execute (mirrors nightly.yml; piping a # mutable-branch script into sh is the gha-curl-pipe-shell supply-chain class). diff --git a/scripts/golangci-lint-v2.sh b/scripts/golangci-lint-v2.sh index 42b1c79d4..9aacbf5d8 100755 --- a/scripts/golangci-lint-v2.sh +++ b/scripts/golangci-lint-v2.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -VERSION="${GOLANGCI_LINT_VERSION:-v2.13.1}" +VERSION="${GOLANGCI_LINT_VERSION:-v2.14.0}" DISPLAY_VERSION="${VERSION#v}" MODULE="github.com/golangci/golangci-lint/v2/cmd/golangci-lint"