From cea4b712d057df000a108640c75643a8b43ed870 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 16:36:35 +0000 Subject: [PATCH 1/3] Pin CI actions to commit SHAs and fix golangci-lint version Unpinned major-version tags (@v4, @v5, @v6) let a compromised or force-moved upstream tag run arbitrary code in CI, and the release workflow holds contents: write. golangci-lint-action's version: latest also let lint rules change under the project without a commit. Pin actions/checkout, actions/setup-go, golangci-lint-action, and goreleaser-action to full commit SHAs (tag noted in a trailing comment), and pin golangci-lint itself to v2.5.0, the version already verified to lint this repo cleanly. Closes #73 --- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/release.yml | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d9e04b3..0ac04fb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,9 +13,9 @@ jobs: build-test-lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod cache: true @@ -30,9 +30,9 @@ jobs: run: go test ./... -race -cover - name: Lint - uses: golangci/golangci-lint-action@v6 + uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2 with: - version: latest + version: v2.5.0 cross-compile: runs-on: ubuntu-latest @@ -46,9 +46,9 @@ jobs: goarch: arm goarm: "6" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7b7abdf..6f1275e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,16 +12,16 @@ jobs: goreleaser: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod cache: true - - uses: goreleaser/goreleaser-action@v6 + - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 with: distribution: goreleaser version: latest From 5893ab2200e5bf82e784e7170a7e2dce641bd2c3 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 16:40:41 +0000 Subject: [PATCH 2/3] Pin golangci-lint to a v1.x release compatible with the action golangci-lint-action@v6 (pinned in the previous commit) rejects any v2.x version string outright ("golangci-lint v2 is not supported by golangci-lint-action v6, you must update to golangci-lint-action v7"), which broke CI. Use v1.64.8 instead, the latest v1.x release, verified locally to lint this repo with 0 issues. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0ac04fb..0725cd1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: - name: Lint uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2 with: - version: v2.5.0 + version: v1.64.8 cross-compile: runs-on: ubuntu-latest From 21c13052a140e0d09710eeda5aac812d7344c3f7 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 16:44:30 +0000 Subject: [PATCH 3/3] Move to golangci-lint-action v7 and golangci-lint v2.12.2 golangci-lint's v1 line is no longer where new releases land upstream (latest is v1.64.8, several versions behind current v2.x), so pinning to it would mean starting this fix already on an aging branch. golangci-lint-action v7 supports v2 exclusively (v6 only supported v1), with no other breaking changes per its changelog. Verified v2.12.2 lints this repo with 0 issues locally via `go install`. --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0725cd1..bb0aa40 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,9 +30,9 @@ jobs: run: go test ./... -race -cover - name: Lint - uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2 + uses: golangci/golangci-lint-action@9fae48acfc02a90574d7c304a1758ef9895495fa # v7.0.1 with: - version: v1.64.8 + version: v2.12.2 cross-compile: runs-on: ubuntu-latest