golangci-lint warns on every run: gomodguard deprecated, replaced by gomodguard_v2 #38

New Issue

clawbot · 2026-08-09T09:11:36+02:00

clawbot commented

2026-08-09 09:11:36 +02:00

Noticed while working #32; filing rather than fixing drive-by, since it
is outside that issue's scope.

Every make lint and every make check run, locally and inside the
Dockerfile gates, emits:

level=warning msg="The linter 'gomodguard' is deprecated (since v2.12.0) due to: new major version. Replaced by gomodguard_v2."
level=warning msg="Suggested new configuration:\nlinters:\n  enable:\n    - gomodguard_v2\n"

.golangci.yml sets linters.default: all, so gomodguard is pulled
in implicitly rather than named anywhere — the deprecation arrived with
the v2.12.2 bump from #3 and nothing in the repo config mentions it.

Not currently harmful: it is a warning, the exit status is unaffected,
and make check is green. But it is noise on top of every gate run,
which is exactly the kind of thing reviewers learn to scroll past, and
a deprecated linter will eventually be removed.

Definition of done

make lint and make check produce no deprecation warnings.
Whatever the fix is (explicitly enabling gomodguard_v2, or
disabling gomodguard under linters.disable if the v2 linter is
not wanted), it is a deliberate choice recorded in a comment in
.golangci.yml rather than a silent config edit — the file already
carries a comment explaining the v2 schema layout.
make check and make docker green.

Worth checking whether the canonical .golangci.yml upstream in
prompts has already dealt with this; prefer re-vendoring over a local
divergence if so.

Noticed while working #32; filing rather than fixing drive-by, since it is outside that issue's scope. Every `make lint` and every `make check` run, locally and inside the `Dockerfile` gates, emits: ``` level=warning msg="The linter 'gomodguard' is deprecated (since v2.12.0) due to: new major version. Replaced by gomodguard_v2." level=warning msg="Suggested new configuration:\nlinters:\n enable:\n - gomodguard_v2\n" ``` `.golangci.yml` sets `linters.default: all`, so `gomodguard` is pulled in implicitly rather than named anywhere — the deprecation arrived with the v2.12.2 bump from #3 and nothing in the repo config mentions it. Not currently harmful: it is a warning, the exit status is unaffected, and `make check` is green. But it is noise on top of every gate run, which is exactly the kind of thing reviewers learn to scroll past, and a deprecated linter will eventually be removed. ## Definition of done - `make lint` and `make check` produce no deprecation warnings. - Whatever the fix is (explicitly enabling `gomodguard_v2`, or disabling `gomodguard` under `linters.disable` if the v2 linter is not wanted), it is a deliberate choice recorded in a comment in `.golangci.yml` rather than a silent config edit — the file already carries a comment explaining the v2 schema layout. - `make check` and `make docker` green. Worth checking whether the canonical `.golangci.yml` upstream in `prompts` has already dealt with this; prefer re-vendoring over a local divergence if so.

clawbot referenced this issue

2026-08-09 09:12:00 +02:00

Bust the Docker layer cache for the gate steps (closes #32) #37

clawbot commented

2026-08-09 09:12:51 +02:00

Duplicate of #26 — closing in favour of it. This is the third independent rediscovery of the same warning (#26 from the review of PR #2, #35 during #24, and now this one), which is itself a useful signal: it is unmissable noise on every gate run.

#26 is assigned to sneak with both options written out and a recommendation, because the fix belongs in the canonical .golangci.yml in the prompts repo and REPO_POLICIES.md forbids agents from editing that file in-repo.

To answer the suggested next step directly: enabling gomodguard_v2 explicitly here is not an available option, even with a comment recording the choice. This repo's .golangci.yml is byte-identical to the canonical file (sha256 021cc83f...346bcb) and must stay that way — a local edit would both violate the policy and silently drift the repo off the org standard, which is exactly the class of problem #20 exists to clean up. The only correct sequence is: canonical file updated upstream, then re-vendored here wholesale.

Nothing to do in this repo until that happens. Follow #26.

Duplicate of #26 — closing in favour of it. This is the third independent rediscovery of the same warning (#26 from the review of PR #2, #35 during #24, and now this one), which is itself a useful signal: it is unmissable noise on every gate run. #26 is assigned to `sneak` with both options written out and a recommendation, because the fix belongs in the canonical `.golangci.yml` in the `prompts` repo and `REPO_POLICIES.md` forbids agents from editing that file in-repo. To answer the suggested next step directly: enabling `gomodguard_v2` explicitly here is **not** an available option, even with a comment recording the choice. This repo's `.golangci.yml` is byte-identical to the canonical file (sha256 `021cc83f...346bcb`) and must stay that way — a local edit would both violate the policy and silently drift the repo off the org standard, which is exactly the class of problem #20 exists to clean up. The only correct sequence is: canonical file updated upstream, then re-vendored here wholesale. Nothing to do in this repo until that happens. Follow #26.

clawbot closed this issue

2026-08-09 09:13:16 +02:00

clawbot referenced this issue

2026-08-09 09:46:11 +02:00

Bust the Docker layer cache for the gate steps (closes #32) #37

clawbot referenced this issue

2026-08-09 09:47:50 +02:00

Bust the Docker layer cache for the gate steps (closes #32) #37

clawbot referenced this issue

2026-08-09 09:52:39 +02:00

README: drop the tooling attribution, document the entrypoints (closes #21) #40

Sign in to join this conversation.