ci: pin golangci-lint to v2.5.0 in copilot-setup-steps

[devantler]

🤖 Generated by the Daily AI Assistant

Problem

The Copilot Setup Steps workflow is red on main (recurring — observed 2026-05-29 and 2026-06-07). The Install golangci-lint step:

run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "$HOME/go/bin" latest

is unpinned on both axes — installer from master, version latest. latest now resolves to golangci-lint v2.12.2, whose published tarball fails the installer's SHA-256 checksum verification:

golangci/golangci-lint err hash_sha256_verify checksum for '…/golangci-lint-2.12.2-linux-amd64.tar.gz' did not verify
  fd3a137c…  vs  8df580d2…
##[error]Process completed with exit code 1.

Fix

Pin both the installer ref and the installed version to v2.5.0 — the tag already used in .pre-commit-config.yaml:

run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.5.0/install.sh | sh -s -- -b "$HOME/go/bin" v2.5.0

Benefits:

• The installer-at-tag verifies a checksum from the same release as the version it installs (consistent by construction), so it can't break on a bad latest tarball.
• The Copilot toolchain now lints with the same golangci-lint version as local/pre-commit and CI (v2.5.0), eliminating drift.
• Matches the repo's universal pinning convention (and the go install …@v3.5.4 Mockery step right below it).

When the repo bumps golangci-lint, bump this alongside .pre-commit-config.yaml's rev so they stay in lockstep.

Validation

• actionlint clean on the modified workflow.
• The pinned installer URL (…/golangci-lint/v2.5.0/install.sh) resolves (HTTP 200); v2.5.0 is a real release already used by the repo.
• This workflow triggers on changes to itself (paths: .github/workflows/copilot-setup-steps.yml), so this PR's own CI run is the end-to-end proof the install now succeeds green.

Operate work (red-on-main fix). Template consumers who use the GitHub Copilot coding agent inherit this setup, so keeping it green benefits them too.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	6		0	0	0.33s
✅ ACTION	zizmor	6	0	0	0	2.31s
✅ BASH	bash-exec	1		0	0	0.01s
✅ BASH	shellcheck	1		0	0	0.03s
✅ BASH	shfmt	1	0	0	0	0.02s
✅ COPYPASTE	jscpd	yes		no	no	0.97s
✅ EDITORCONFIG	editorconfig-checker	29		0	0	0.04s
✅ GO	golangci-lint	yes	yes	no	no	19.47s
✅ JSON	jsonlint	1		0	0	0.4s
✅ JSON	prettier	1	0	0	0	0.4s
✅ JSON	v8r	1		0	0	2.22s
✅ MARKDOWN	markdownlint	5	0	0	0	1.03s
✅ MARKDOWN	markdown-table-formatter	5	0	0	0	0.25s
✅ REPOSITORY	checkov	yes		no	no	26.87s
✅ REPOSITORY	gitleaks	yes		no	no	0.12s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	56.82s
✅ REPOSITORY	osv-scanner	yes		no	no	1.83s
✅ REPOSITORY	secretlint	yes		no	no	1.09s
✅ REPOSITORY	syft	yes		no	no	1.77s
✅ REPOSITORY	trivy	yes		no	no	11.62s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.23s
✅ REPOSITORY	trufflehog	yes		no	no	4.16s
✅ SPELL	lychee	16		0	0	0.92s
✅ YAML	prettier	10	0	0	0	0.76s
✅ YAML	v8r	10		0	0	12.22s
✅ YAML	yamllint	10		0	0	0.87s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository