From f9808920266447fbd39c32215c119cb8b0a1dd6a Mon Sep 17 00:00:00 2001 From: Snider Date: Sat, 8 Aug 2026 15:25:53 +0100 Subject: [PATCH] ci: pin golangci-lint instead of inheriting latest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lint gate ran `version: latest`, which means it can go red on a day nobody touched the code — a golangci-lint release that enables a linter by default, or tightens an existing one, is enough. It then reads as "your PR broke lint" to whoever is next, and costs them the bisect to find out it was drift. "Merge on green" only works if green is a property of the repo rather than of the calendar. Pinned to v2.12.2, which is what `latest` resolved to for the run that took this repo to 0 findings — so the pin is the version actually verified, not a guess. Policy in the comment for the next reader: bump the pin when we choose a new linter, never inherit one. Co-Authored-By: Virgil --- .github/workflows/ci.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fcfb145c..ce577107 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -122,7 +122,18 @@ jobs: go-version: '1.26' - uses: golangci/golangci-lint-action@v9 with: - version: latest + # Pinned, not `latest`. "Merge on green" only means something if + # green is a property of this repo rather than of the calendar: with + # `latest`, a golangci-lint release that enables a linter by default + # or tightens an existing one turns this gate red on a commit that + # touched nothing, and it reads as "your PR broke lint" to whoever is + # unlucky enough to be next. Bump this pin when we choose a new + # linter; never inherit one. + # + # v2.12.2 is what `latest` resolved to for the run that took this + # repo to 0 findings, so the pin is the version that was actually + # verified, not a guess. + version: v2.12.2 working-directory: go # Tests are linted, not skipped. --tests=false was hiding two things # at once: it reported 21 production symbols as unused because the