Add bullseye targets for CI and security loose ends - #92
Merged
Conversation
Three targets identified during PR #91's push cycle, tracked durably rather than left as transcript notes: - 🎯T1: CI lints cleanly under current golangci-lint without a version pin. PR #91 restored a v1.48 pin as a stopgap after two-plus years of golangci-lint drift surfaced at once. Removing the pin cleanly requires addressing the underlying findings (gosec G115 integer overflows in wbnf/compile.go, an errcheck on state.Write, an unparam on testWbnfFile, and a .golangci.yml depguard config in an obsolete format) plus removing deprecated config keys. - 🎯T2: No open high-severity Dependabot alerts on master. GitHub flagged 1 high-severity alert during the PR #91 push, unrelated to the PR's content. Likely resolvable by a targeted `go get -u` plus `go mod tidy`. - 🎯T3: CI workflow actions run on Node 24-compatible versions. CI annotations flagged Node.js 20 deprecations on actions/checkout@v3, actions/setup-go@v3, and golangci/golangci-lint-action@v3. GitHub forces Node 24 on 2026-06-02 and removes Node 20 on 2026-09-16, so there's time but the bump is inevitable. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
marcelocantos
added a commit
that referenced
this pull request
Apr 11, 2026
The Generate-Tag workflow had been silently cutting minor version tags on every push to master (v0.38.0 from PR #91, v0.39.0 from PR #92) because its config never matched the commented intent. The workflow's comment documented "Generate tag if commit message contains #major or #patch or #patch" but the underlying anothrNick/github-tag-action defaults to DEFAULT_BUMP=minor, so every push produced an auto-bump regardless of commit content. The issue had been latent for years because no-one had merged anything in a long while; it surfaced this week when two unrelated PRs cut v0.38.0 and v0.39.0 on merges that weren't releases in any meaningful sense. Pare back to rely on the /release skill for deliberate releases — version bumping, release notes, CI, Homebrew tap, tag creation, and GitHub release publishing as explicit user actions. This matches the "only the user can initiate releases" principle from global CLAUDE.md. The go.yml workflow is kept unchanged — it remains the CI gate that /push watches before merging. Knock-on: 🎯T3 (CI workflow actions run on Node 24-compatible versions) shrinks from two workflow files to one, since the deleted workflow's actions/checkout@master and actions/checkout@v3 references are gone with it. Target context updated accordingly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
marcelocantos
added a commit
that referenced
this pull request
Apr 11, 2026
The Generate-Tag workflow had been silently cutting minor version tags on every push to master (v0.38.0 from PR #91, v0.39.0 from PR #92) because its config never matched the commented intent. The workflow's comment documented "Generate tag if commit message contains #major or #patch or #patch" but the underlying anothrNick/github-tag-action defaults to DEFAULT_BUMP=minor, so every push produced an auto-bump regardless of commit content. The issue had been latent for years because no-one had merged anything in a long while; it surfaced this week when two unrelated PRs cut v0.38.0 and v0.39.0 on merges that weren't releases in any meaningful sense. Pare back to rely on the /release skill for deliberate releases — version bumping, release notes, CI, Homebrew tap, tag creation, and GitHub release publishing as explicit user actions. This matches the "only the user can initiate releases" principle from global CLAUDE.md. The go.yml workflow is kept unchanged — it remains the CI gate that /push watches before merging. Knock-on: 🎯T3 (CI workflow actions run on Node 24-compatible versions) shrinks from two workflow files to one, since the deleted workflow's actions/checkout@master and actions/checkout@v3 references are gone with it. Target context updated accordingly. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three targets identified during PR #91's push cycle, tracked durably
rather than left as transcript notes:
🎯T1: CI lints cleanly under current golangci-lint without a version
pin. PR Refine research doc and pin golangci-lint to restore CI #91 restored a v1.48 pin as a stopgap after two-plus years of
golangci-lint drift surfaced at once. Removing the pin cleanly
requires addressing the underlying findings (gosec G115 integer
overflows in wbnf/compile.go, an errcheck on state.Write, an unparam
on testWbnfFile, and a .golangci.yml depguard config in an obsolete
format) plus removing deprecated config keys.
🎯T2: No open high-severity Dependabot alerts on master. GitHub
flagged 1 high-severity alert during the PR Refine research doc and pin golangci-lint to restore CI #91 push, unrelated to
the PR's content. Likely resolvable by a targeted
go get -uplusgo mod tidy.🎯T3: CI workflow actions run on Node 24-compatible versions. CI
annotations flagged Node.js 20 deprecations on actions/checkout@v3,
actions/setup-go@v3, and golangci/golangci-lint-action@v3. GitHub
forces Node 24 on 2026-06-02 and removes Node 20 on 2026-09-16, so
there's time but the bump is inevitable.
Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com