From f4b35694418d80b462105023eeb588beb2ed9557 Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Thu, 23 Jul 2026 12:17:13 +0800
Subject: [PATCH 1/2] ci: bump pinned actions to current majors and go to
 1.26.5

The pinned action versions had drifted apart across the org; this pins
each to the major that is current today. go.mod follows the fleet to
1.26.5, which CI picks up through go-version-file.
---
 .github/workflows/build.yml      | 6 +++---
 .github/workflows/goreleaser.yml | 4 ++--
 .github/workflows/lint.yml       | 4 ++--
 .github/workflows/test.yml       | 6 +++---
 go.mod                           | 2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8463fbc..7349c14 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,12 +23,12 @@ jobs:
             goarch: amd64
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
 
@@ -42,7 +42,7 @@ jobs:
         run: make build
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: cocoon-agent-${{ matrix.goos }}-${{ matrix.goarch }}
           path: cocoon-agent-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.goos == 'windows' && '.exe' || '' }}
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index ba2d30c..adb64f0 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -21,7 +21,7 @@ jobs:
         run: echo "VERSION=$(git describe --tags --always)" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 105ca05..52d4eb0 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1bb131e..4b0b889 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
 
@@ -28,7 +28,7 @@ jobs:
 
       - name: Upload coverage artifact
         continue-on-error: true
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: coverage
           path: coverage.out
diff --git a/go.mod b/go.mod
index e488960..133b8f6 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/cocoonstack/cocoon-agent
 
-go 1.25.6
+go 1.26.5
 
 require (
 	github.com/mdlayher/vsock v1.2.1

From 3a1ed6c276a97313994381b8f1328d901cc92fd6 Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Thu, 23 Jul 2026 12:38:42 +0800
Subject: [PATCH 2/2] build: pin golangci-lint to v2.12.2 and install it via go
 install

The upstream install.sh picks the .sbom.json checksum on v2.12.x releases
and fails verification; go install resolves through the module checksum
database instead, and drops the dependency on a script fetched from a
moving branch.
---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 23ab06e..f90560c 100644
--- a/Makefile
+++ b/Makefile
@@ -30,7 +30,7 @@ $(LOCALBIN):
 	mkdir -p $(LOCALBIN)
 
 ## Tool versions
-GOLANGCILINT_VERSION ?= v2.9.0
+GOLANGCILINT_VERSION ?= v2.12.2
 GOLANGCILINT_ROOT := $(LOCALBIN)/golangci-lint-$(GOLANGCILINT_VERSION)
 GOLANGCILINT := $(GOLANGCILINT_ROOT)/golangci-lint
 
@@ -44,7 +44,7 @@ GOOSES ?= linux darwin windows
 .PHONY: golangci-lint
 golangci-lint: $(GOLANGCILINT)
 $(GOLANGCILINT):
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/$(GOLANGCILINT_VERSION)/install.sh | sh -s -- -b $(GOLANGCILINT_ROOT) $(GOLANGCILINT_VERSION)
+	GOBIN=$(GOLANGCILINT_ROOT) go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION)
 
 .PHONY: gofumpt
 gofumpt: $(GOFMT)