From 88b66512301ba24f733da63e084d3a0a3c9f4971 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 7 Jun 2026 21:16:48 +0200 Subject: [PATCH] ci: pin golangci-lint to v2.5.0 in copilot-setup-steps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "Install golangci-lint" step fetched the installer from `master` and resolved the version to `latest`, which now lands on golangci-lint v2.12.2 — whose published tarball fails the installer's SHA-256 checksum verification, turning the "Copilot Setup Steps" workflow red on main (recurring). Pin both the installer ref and the installed version to v2.5.0, the tag already used in .pre-commit-config.yaml, so the Copilot toolchain lints with the same golangci-lint as local/pre-commit and CI, and the install.sh-at-tag verifies a checksum from the same release (consistent by construction) instead of an unpinned `latest` whose tarball can break the install. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/copilot-setup-steps.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index c8d602e..6a905cc 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -44,7 +44,10 @@ jobs: node-version: "22" - name: Install golangci-lint - run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "$HOME/go/bin" latest + # Pin both the installer ref and the version to the tag used in .pre-commit-config.yaml so the + # Copilot toolchain lints with the same golangci-lint as local/CI, and never resolves to an + # unpinned `latest` whose tarball checksum can break the install (e.g. the v2.12.2 mismatch). + run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.5.0/install.sh | sh -s -- -b "$HOME/go/bin" v2.5.0 - name: Install mega-linter-runner run: npm install mega-linter-runner -g