Deprecated gomodguard linter in the org-standard .golangci.yml (needs an upstream decision) #98

New Issue

clawbot · 2026-08-09T05:01:01+02:00

clawbot commented

2026-08-09 05:01:01 +02:00

@sneak — this needs your call, because the fix is not in this repository's power. Assigning to you rather than acting.

The warning

Every pinned lint run (golangci-lint v2.12.2, as used by script/cibuild) emits:

The linter 'gomodguard' is deprecated (since v2.12.0) ... Replaced by gomodguard_v2

It has shown up in every PR this cycle (#91, #92, #95, #96). It is currently harmless noise, but a deprecated linter is an action item, not background noise — it will eventually be removed and the config will start failing rather than warning.

Why I am not fixing it

The setting lives in .golangci.yml, which REPO_POLICIES.md says is standardized and must NEVER be modified by an agent, only manually by the user, and which must match the canonical copy at https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml. The current file is pinned on main via #86 at sha256 021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb.

Editing it here would (a) violate that policy and (b) desynchronise this repo from the org standard, which is worse than the warning. So this is an upstream change to the prompts repo that then propagates to every repo, not a webhooker change.

Options

Update the canonical .golangci.yml in the prompts repo to use gomodguard_v2, then pull the new file into this repo and re-pin its sha256. Correct and durable; touches every repo that consumes the standard, so it wants to be done deliberately.
Drop gomodguard from the canonical config if it is not actually earning its place — it guards against blocked module imports, which may be redundant with the dependency policy in GO_PACKAGE_DEFAULTS.md.
Do nothing for now and accept the warning until golangci-lint removes the linter outright, then handle it under time pressure.

Recommendation

Option 1. It is a mechanical rename in one file, the replacement is the maintainers' own designated successor, and doing it now means it lands as a quiet no-op change rather than an emergency when a future golangci-lint version drops the old name and every repo's script/cibuild goes red at once.

Definition of done

The canonical .golangci.yml in prompts no longer references the deprecated gomodguard.
This repo's .golangci.yml is refreshed from the canonical copy, with the new sha256 recorded wherever the current one is documented.
script/cibuild green with the v2.12.2 pin unchanged, and the deprecation warning gone.

@sneak — this needs your call, because the fix is not in this repository's power. Assigning to you rather than acting. ## The warning Every pinned lint run (golangci-lint v2.12.2, as used by `script/cibuild`) emits: ``` The linter 'gomodguard' is deprecated (since v2.12.0) ... Replaced by gomodguard_v2 ``` It has shown up in every PR this cycle (#91, #92, #95, #96). It is currently harmless noise, but a deprecated linter is an action item, not background noise — it will eventually be removed and the config will start failing rather than warning. ## Why I am not fixing it The setting lives in `.golangci.yml`, which `REPO_POLICIES.md` says is standardized and **must NEVER be modified by an agent, only manually by the user**, and which must match the canonical copy at `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`. The current file is pinned on `main` via #86 at sha256 `021cc83f4e6fc7c31b95b34b846723dfcf20b66b7baeea1dc40406e643346bcb`. Editing it here would (a) violate that policy and (b) desynchronise this repo from the org standard, which is worse than the warning. So this is an upstream change to the `prompts` repo that then propagates to every repo, not a webhooker change. ## Options 1. **Update the canonical `.golangci.yml` in the `prompts` repo** to use `gomodguard_v2`, then pull the new file into this repo and re-pin its sha256. Correct and durable; touches every repo that consumes the standard, so it wants to be done deliberately. 2. **Drop `gomodguard` from the canonical config** if it is not actually earning its place — it guards against blocked module imports, which may be redundant with the dependency policy in `GO_PACKAGE_DEFAULTS.md`. 3. **Do nothing for now** and accept the warning until golangci-lint removes the linter outright, then handle it under time pressure. ## Recommendation Option 1. It is a mechanical rename in one file, the replacement is the maintainers' own designated successor, and doing it now means it lands as a quiet no-op change rather than an emergency when a future golangci-lint version drops the old name and every repo's `script/cibuild` goes red at once. ## Definition of done - The canonical `.golangci.yml` in `prompts` no longer references the deprecated `gomodguard`. - This repo's `.golangci.yml` is refreshed from the canonical copy, with the new sha256 recorded wherever the current one is documented. - `script/cibuild` green with the v2.12.2 pin unchanged, and the deprecation warning gone.

sneak was assigned by clawbot

2026-08-09 05:01:01 +02:00