ci: pin golangci-lint to v2.5.0 in copilot-setup-steps#94
Merged
Conversation
The "Install golangci-lint" step fetched the installer from `master` and resolved the version to `latest`, which now lands on golangci-lint v2.12.2 — whose published tarball fails the installer's SHA-256 checksum verification, turning the "Copilot Setup Steps" workflow red on main (recurring). Pin both the installer ref and the installed version to v2.5.0, the tag already used in .pre-commit-config.yaml, so the Copilot toolchain lints with the same golangci-lint as local/pre-commit and CI, and the install.sh-at-tag verifies a checksum from the same release (consistent by construction) instead of an unpinned `latest` whose tarball can break the install. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✅MegaLinter analysis: Success
Notices📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining See detailed reports in MegaLinter artifacts
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Copilot Setup Steps workflow is red on
main(recurring — observed 2026-05-29 and 2026-06-07). TheInstall golangci-lintstep:is unpinned on both axes — installer from
master, versionlatest.latestnow resolves to golangci-lint v2.12.2, whose published tarball fails the installer's SHA-256 checksum verification:Fix
Pin both the installer ref and the installed version to v2.5.0 — the tag already used in
.pre-commit-config.yaml:Benefits:
latesttarball.go install …@v3.5.4Mockery step right below it).When the repo bumps golangci-lint, bump this alongside
.pre-commit-config.yaml'srevso they stay in lockstep.Validation
actionlintclean on the modified workflow.…/golangci-lint/v2.5.0/install.sh) resolves (HTTP 200); v2.5.0 is a real release already used by the repo.paths: .github/workflows/copilot-setup-steps.yml), so this PR's own CI run is the end-to-end proof the install now succeeds green.Operate work (red-on-main fix). Template consumers who use the GitHub Copilot coding agent inherit this setup, so keeping it green benefits them too.