sneak/upaas
1
0
Fork 1
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

Bump Dockerfile lint stage golangci-lint pin from v2.10.1 to current v2.12.x #179

New Issue
Closed
opened 2026-08-07 18:40:59 +02:00 by clawbot · 0 comments
clawbot commented 2026-08-07 18:40:59 +02:00
Collaborator
Copy Link
Copy Source

Surveyed 2026-08-07: the Dockerfile lint stage pins
golangci/golangci-lint v2.10.1 by digest, while local development
uses golangci-lint 2.12.2. The newer linter reports 94 findings
(noctx 47, gosec 23, goconst 24) that v2.10.1 does not — verified
today: script/cibuild (docker build, pinned v2.10.1) passes on
main while local make check fails with those 94. CI is therefore
green while main is out of compliance with the "main always passes
make check" policy under the current toolchain.

Once #175, #176, #177, and #178 land and local make check is clean,
bump the pin so CI enforces the current lint set and this divergence
cannot reopen.

Steps:

  • update the FROM golangci/golangci-lint@sha256:... line in
    Dockerfile to the digest of the current v2.12.x image
  • update the version/date comment above it (# golangci/golangci-lint:v2.12.x, YYYY-MM-DD) per REPO_POLICIES.md
  • digest-pinned only — never a mutable tag

Definition of done:

  • blocked on #175, #176, #177, #178 (bumping earlier turns CI red)
  • script/cibuild passes with the new pin (lint stage runs the
    v2.12.x linter and finds zero issues)
  • comment above the pin states the exact version and date
  • lands via PR from a feature branch off main
Surveyed 2026-08-07: the `Dockerfile` lint stage pins `golangci/golangci-lint` v2.10.1 by digest, while local development uses golangci-lint 2.12.2. The newer linter reports 94 findings (`noctx` 47, `gosec` 23, `goconst` 24) that v2.10.1 does not — verified today: `script/cibuild` (docker build, pinned v2.10.1) passes on `main` while local `make check` fails with those 94. CI is therefore green while `main` is out of compliance with the "main always passes `make check`" policy under the current toolchain. Once #175, #176, #177, and #178 land and local `make check` is clean, bump the pin so CI enforces the current lint set and this divergence cannot reopen. Steps: - update the `FROM golangci/golangci-lint@sha256:...` line in `Dockerfile` to the digest of the current v2.12.x image - update the version/date comment above it (`# golangci/golangci-lint:v2.12.x, YYYY-MM-DD`) per `REPO_POLICIES.md` - digest-pinned only — never a mutable tag Definition of done: - blocked on #175, #176, #177, #178 (bumping earlier turns CI red) - `script/cibuild` passes with the new pin (lint stage runs the v2.12.x linter and finds zero issues) - comment above the pin states the exact version and date - lands via PR from a feature branch off `main`
clawbot added this to the 1.1.0 milestone 2026-08-07 18:40:59 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 merge-ready
All checks pass, reviewed, rebased, ready for merge
 needs-checks
make check does not pass cleanly
 needs-rebase
PR has merge conflicts or is behind main
 needs-review
Code review not yet done
 needs-rework
Code review found issues to fix
 notplanned
question
More information is needed
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone 1.1.0
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/upaas#179