sneak/upaas
1
0
Fork 1
Code Issues 7 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Bump Dockerfile lint stage golangci-lint pin from v2.10.1 to current v2.12.x #179

New Issue
Closed
opened 2026-08-07 18:40:59 +02:00 by clawbot · 1 comment
clawbot commented 2026-08-07 18:40:59 +02:00
Collaborator
Copy Link

Surveyed 2026-08-07: the Dockerfile lint stage pins
golangci/golangci-lint v2.10.1 by digest, while local development
uses golangci-lint 2.12.2. The newer linter reports 94 findings
(noctx 47, gosec 23, goconst 24) that v2.10.1 does not — verified
today: script/cibuild (docker build, pinned v2.10.1) passes on
main while local make check fails with those 94. CI is therefore
green while main is out of compliance with the "main always passes
make check" policy under the current toolchain.

Once #175, #176, #177, and #178 land and local make check is clean,
bump the pin so CI enforces the current lint set and this divergence
cannot reopen.

Steps:

  • update the FROM golangci/golangci-lint@sha256:... line in
    Dockerfile to the digest of the current v2.12.x image
  • update the version/date comment above it (# golangci/golangci-lint:v2.12.x, YYYY-MM-DD) per REPO_POLICIES.md
  • digest-pinned only — never a mutable tag

Definition of done:

  • blocked on #175, #176, #177, #178 (bumping earlier turns CI red)
  • script/cibuild passes with the new pin (lint stage runs the
    v2.12.x linter and finds zero issues)
  • comment above the pin states the exact version and date
  • lands via PR from a feature branch off main
Surveyed 2026-08-07: the `Dockerfile` lint stage pins `golangci/golangci-lint` v2.10.1 by digest, while local development uses golangci-lint 2.12.2. The newer linter reports 94 findings (`noctx` 47, `gosec` 23, `goconst` 24) that v2.10.1 does not — verified today: `script/cibuild` (docker build, pinned v2.10.1) passes on `main` while local `make check` fails with those 94. CI is therefore green while `main` is out of compliance with the "main always passes `make check`" policy under the current toolchain. Once #175, #176, #177, and #178 land and local `make check` is clean, bump the pin so CI enforces the current lint set and this divergence cannot reopen. Steps: - update the `FROM golangci/golangci-lint@sha256:...` line in `Dockerfile` to the digest of the current v2.12.x image - update the version/date comment above it (`# golangci/golangci-lint:v2.12.x, YYYY-MM-DD`) per `REPO_POLICIES.md` - digest-pinned only — never a mutable tag Definition of done: - blocked on #175, #176, #177, #178 (bumping earlier turns CI red) - `script/cibuild` passes with the new pin (lint stage runs the v2.12.x linter and finds zero issues) - comment above the pin states the exact version and date - lands via PR from a feature branch off `main`
clawbot added this to the 1.1.0 milestone 2026-08-07 18:40:59 +02:00
clawbot commented 2026-09-03 18:28:14 +02:00
Author
Collaborator
Copy Link

Verified against main @ 7a34fc9 — already done, closing.

PR #187 (merged 2026-08-07) bumped the pin. The Dockerfile lint stage now reads:

# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint

Digest-pinned, with the version/date comment above it per REPO_POLICIES.md. script/bootstrap was pinned to the matching 2.12.2 release archives in the same PR.

Confirmed empirically just now: docker build . on main passes end to end (exit 0) with the lint stage reporting 0 issues. — so the CI-vs-local divergence described here is closed, not merely re-hidden.

One follow-on surfaced by the new linter, not blocking this issue: golangci-lint v2.12 warns that gomodguard is deprecated in favour of gomodguard_v2. That belongs in the canonical config upstream, per the note in PR #187.

Verified against `main` @ 7a34fc9 — **already done**, closing. [PR #187](https://git.eeqj.de/sneak/upaas/pulls/187) (merged 2026-08-07) bumped the pin. The `Dockerfile` lint stage now reads: ``` # golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07 FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint ``` Digest-pinned, with the version/date comment above it per `REPO_POLICIES.md`. `script/bootstrap` was pinned to the matching 2.12.2 release archives in the same PR. Confirmed empirically just now: `docker build .` on `main` passes end to end (exit 0) with the lint stage reporting **`0 issues.`** — so the CI-vs-local divergence described here is closed, not merely re-hidden. One follow-on surfaced by the new linter, not blocking this issue: golangci-lint v2.12 warns that `gomodguard` is deprecated in favour of `gomodguard_v2`. That belongs in the canonical config upstream, per the note in [PR #187](https://git.eeqj.de/sneak/upaas/pulls/187).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 merge-ready
All checks pass, reviewed, rebased, ready for merge
 needs-checks
make check does not pass cleanly
 needs-rebase
PR has merge conflicts or is behind main
 needs-review
Code review not yet done
 needs-rework
Code review found issues to fix
 notplanned
question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone 1.1.0
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/upaas#179
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?