From b910a1e808b53730578a94d9ea974d3a6045c741 Mon Sep 17 00:00:00 2001 From: sneak Date: Sun, 1 Nov 2026 16:40:35 -0800 Subject: [PATCH] Move the canonical golangci-lint to v2.15.0 and bring back canonicalheader v2.15.0 (released 2026-10-16, built with go1.27.0 like v2.14.0) bundles canonicalheader with its upstream fix for non-deterministic results, the defect behind issue 105. Linted 20 times each on a scratch package with two planted findings beside a ResponseWriter.Header() call, v2.14.0 reported them on 8 runs and nothing on 12; v2.15.0 reported them on all 20. REPO_POLICIES.md names the new digest; .golangci.yml no longer disables canonicalheader and is otherwise unchanged, since it verifies against v2.15.0 as it was and default: all switches on no new linter. --- .golangci.yml | 2 -- TODO.md | 9 +++++++++ prompts/REPO_POLICIES.md | 8 ++++---- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index 1d6b3c6..62cb26a 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -25,8 +25,6 @@ linters: # silenced by disabling that name, not by enabling the successor. - wsl # Deprecated, replaced by wsl_v5 - gomodguard # Deprecated, replaced by gomodguard_v2 - # Misses findings at random in v2.14.0; back once a pinned release fixes it - - canonicalheader settings: lll: line-length: 88 diff --git a/TODO.md b/TODO.md index 950d6fc..b5a6e47 100644 --- a/TODO.md +++ b/TODO.md @@ -21,6 +21,15 @@ fmt-check, and commit. # Completed Steps +- 2026-11-01: Moved the canonical golangci-lint to v2.15.0 (released + 2026-10-16), still built with go1.27.0, so the `go` directive rule is + unchanged. The canonical `.golangci.yml` passes `golangci-lint config verify` + on v2.15.0, and `default: all` switches on no new linter. `canonicalheader` is + enabled again (issue 105): v2.15.0 carries the upstream commit "fix: + non-deterministic results", and on a scratch package with two planted findings + beside a `ResponseWriter.Header()` call, linted 20 times with each pinned + image, v2.14.0 reported them on 8 runs and nothing on 12, while v2.15.0 + reported them on all 20. - 2026-10-27: Added `prompts/API_POLICIES.md` (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API diff --git a/prompts/REPO_POLICIES.md b/prompts/REPO_POLICIES.md index 3e8c97f..f6ef369 100644 --- a/prompts/REPO_POLICIES.md +++ b/prompts/REPO_POLICIES.md @@ -1,6 +1,6 @@ --- title: Repository Policies -last_modified: 2026-10-27 +last_modified: 2026-11-01 --- This document covers repository structure, tooling, and workflow standards. Code @@ -658,10 +658,10 @@ style conventions are in separate documents: `test-support` depguard rule, where a repo names its own test-support packages by full import path. A repo adds entries there and changes nothing else, and a re-vendor carries its entries forward. The canonical golangci-lint version is - v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base + v2.15.0 (released 2026-10-16), pinned as the digest of the lint phase's base image - (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`, - which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go` + (`golangci/golangci-lint@sha256:fbfcfd12a6f8d7f1b97b3362ca80fc2a244d46863148c73cb88e7793af96c481`, + which reports `2.15.0 built with go1.27.0 from 25c5369a`). A module's `go` directive must not name a newer Go minor version than the one golangci-lint was built with, or golangci-lint refuses to lint it: this release lints `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo