NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.12.2 - autoclosed#692
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.12.2 - autoclosed#692red-hat-konflux[bot] wants to merge 1 commit into
Conversation
red-hat-konflux
Bot
added
approved
openshift-ci-robot
added
the
jira/valid-reference
|
@red-hat-konflux[bot]: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
size/XS
Codecov Report✅ All modified and coverable lines are covered by tests. Please upload reports for the commit 4f39ac9 to get more accurate results. Additional details and impacted files@@ Coverage Diff @@
## main #692 +/- ##
=======================================
Coverage 61.74% 61.74%
=======================================
Files 27 27
Lines 1767 1767
=======================================
Hits 1091 1091
Misses 510 510
Partials 166 166 🚀 New features to boost your workflow:
|
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/linter
branch
2 times, most recently
from
dd45bc8 to
1a02523
Compare
|
New changes are detected. LGTM label has been removed. |
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/linter
branch
3 times, most recently
from
64c3f16 to
730c8d4
Compare
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/linter
branch
2 times, most recently
from
e2eebe9 to
d66f421
Compare
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/linter
branch
2 times, most recently
from
d66f421 to
a613ac8
Compare
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/linter
branch
2 times, most recently
from
a613ac8 to
e2cfa9d
Compare
openshift-ci
Bot
removed
the
approved
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/linter
branch
2 times, most recently
from
e2cfa9d to
e915fb5
Compare
red-hat-konflux
Bot
changed the title
red-hat-konflux
Bot
changed the title
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughUpdated the Docker build stage to install Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile.image-service-build`:
- Line 5: Replace the unofficial GitHub raw installer URL in the Dockerfile RUN
that invokes golangci-lint (the line using curl and sh with version v2.11.4)
with the official installer URL https://golangci-lint.run/install.sh, leaving
the existing flags (-sSfL ... sh -s -- -b $(go env GOPATH)/bin v2.11.4)
unchanged so version pinning and installation destination remain the same.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2ffd4cd8-c6d0-42e7-8973-756b3b347f3b
📒 Files selected for processing (1)
Dockerfile.image-service-build
| ENV GOFLAGS="" | ||
|
|
||
| RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.8.0 && \ | ||
| RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.4 && \ |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
golangci-lint GitHub install.sh v2.11.4 tag pinned reference
💡 Result:
To install golangci-lint v2.11.4 using the official install.sh, you pin the release tag by passing it as the last argument to the script. Command (install into $GOPATH/bin): curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.4 Command (install into ./bin): curl -sSfL https://golangci-lint.run/install.sh | sh -s v2.11.4 Why this pins the version: - The install.sh script accepts an optional argument and uses it to resolve the corresponding GitHub release (tag_to_version / github_release in the script), then downloads the release assets from GitHub releases/download for that tag. - The official docs explicitly show passing v2.11.4 to install.sh. The relevant release tag exists on GitHub: v2.11.4.
Citations:
- 1: https://golangci-lint.run/docs/welcome/install/local/
- 2: https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh
- 3: https://github.com/golangci/golangci-lint/releases/tag/v2.11.4
- 4: https://github.com/golangci/golangci-lint/blob/master/install.sh
🌐 Web query:
golangci-lint official installation verification checksum signed releases
💡 Result:
golangci-lint official installation verification (2026-04-28) 1) Official installation method and what it verifies - The official binary installer is provided as a shell script: https://golangci-lint.run/install.sh (documented in the official “Local Installation” docs). - That installer downloads two artifacts for the chosen version from GitHub Releases: the tarball/zip itself and a checksums file named like golangci-lint--checksums.txt. - It verifies the downloaded tarball/zip by computing its SHA-256 hash and comparing it against the expected SHA-256 value found in the downloaded checksums file. The install script will fail if the hash does not match. Evidence: installer docs and the install.sh implementation show it downloads TARBALL and CHECKSUM and runs hash_sha256_verify before extracting/installing. 2) Signed releases / signature verification - golangci-lint GitHub releases include checksums files (e.g., golangci-lint-2.11.4-checksums.txt is listed as a release asset for v2.11.4). - However, from the authoritative sources found here, there is no documented/implemented user-facing verification step in the install script for cryptographic signatures (e.g., cosign signature files) of the release binaries themselves. - There are in-repo proposals/PRs about using cosign to sign release artifacts and about verifying installer downloads with cosign, but the evidence available here does not show that the current public install.sh verifies cosign signatures. - What is verifiable from the sources: Git tags/commits are GPG-verified on GitHub (e.g., v2.11.4 tag is “Verified” and “This commit was signed with the committer’s verified signature”), which authenticates the repository state/commit, but it is not the same thing as verifying a cosign signature on the downloadable binary artifacts. 3) Practical “verification” you can do today (checksum-based) To independently verify a downloaded release archive the same way the official installer does: - Download the release archive for your platform and golangci-lint--checksums.txt from the official GitHub Release. - Verify the SHA-256 of the archive matches the line in the checksums file (the checksums file contains entries keyed by the archive filename). Example (replace version + filename): - wget <TARBALL_URL> - wget <CHECKSUMS_URL> - grep '<TARBALL_FILENAME>' <CHECKSUMS_FILE> | cut -d' ' -f1 # expected sha - sha256sum <TARBALL_FILENAME> # computed sha - compare expected vs computed (must match) Evidence for checksum verification logic: install.sh’s hash_sha256_verify and execute show the exact flow (download tarball + checksum file, then verify sha256 before extracting). Bottom line - Official verification provided by the install script is SHA-256 checksum verification against the release’s checksums file. - The evidence found here does not confirm that the current official install process verifies cryptographic signatures (such as cosign signatures) for the release binaries; it may be discussed in PRs, and repository commits/tags are verified, but artifact-signature verification is not shown in the current install.sh logic.
Citations:
- 1: https://golangci-lint.run/docs/welcome/install/local/
- 2: https://golangci-lint.run/docs/welcome/install/
- 3: https://github.com/golangci/golangci-lint/blob/master/install.sh
- 4: https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh
- 5: https://github.com/golangci/golangci-lint/releases/tag/v2.11.4
- 6: https://github.com/golangci/golangci-lint/tags
- 7: feat: verify installer downloads with cosign golangci/golangci-lint#5806
- 8: feat: sign release artifacts with cosign golangci/golangci-lint#5793
🏁 Script executed:
#!/bin/bash
# Check the golangci-lint repository structure for install.sh availability
# and verify v2.11.4 is a valid tag
# Search for information about golangci-lint releases and installation methods
echo "=== Checking golangci-lint GitHub releases and tags ==="
curl -s https://api.github.com/repos/golangci/golangci-lint/releases/tags/v2.11.4 | jq -r '.tag_name, .assets[].name' 2>/dev/null | head -20
echo ""
echo "=== Checking available installation methods in recent releases ==="
curl -s https://api.github.com/repos/golangci/golangci-lint/releases?per_page=5 | jq -r '.[0] | .tag_name, .assets[].name' 2>/dev/nullRepository: openshift/assisted-image-service
Length of output: 2954
Use the official golangci-lint installer distribution instead of the GitHub master branch.
The Dockerfile currently fetches install.sh from https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh, which is an unofficial distribution point. The official installer is available at https://golangci-lint.run/install.sh and is the recommended distribution method. The official installer already verifies downloaded artifacts via SHA-256 checksums (golangci-lint-2.11.4-checksums.txt), so integrity verification is automatic—no additional checksum validation step is needed.
The version pinning via v2.11.4 argument is already correct and will resolve to the corresponding GitHub release. Simply switch to the official distribution URL to ensure consistent, maintained installation behavior:
Suggested fix
-RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.4 && \
+RUN curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.4 && \
go install golang.org/x/tools/cmd/goimports@v0.34.0 && \
go install go.uber.org/mock/mockgen@v0.6.0🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile.image-service-build` at line 5, Replace the unofficial GitHub raw
installer URL in the Dockerfile RUN that invokes golangci-lint (the line using
curl and sh with version v2.11.4) with the official installer URL
https://golangci-lint.run/install.sh, leaving the existing flags (-sSfL ... sh
-s -- -b $(go env GOPATH)/bin v2.11.4) unchanged so version pinning and
installation destination remain the same.
There was a problem hiding this comment.
♻️ Duplicate comments (1)
Dockerfile.image-service-build (1)
5-5:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUse the supported golangci-lint installer endpoint.
This still pulls
install.shfromraw.githubusercontent.com/.../master, which is a moving target. Please switch to the official installer URL so the build stays on the supported distribution path while keeping the pinnedv2.12.1argument.Suggested fix
-RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.12.1 && \ +RUN curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.12.1 && \ go install golang.org/x/tools/cmd/goimports@v0.34.0 && \ go install go.uber.org/mock/mockgen@v0.6.0To verify the endpoint and installed version, run:
#!/bin/bash set -euo pipefail rg -n 'raw\.githubusercontent\.com/golangci/golangci-lint/master/install\.sh|golangci-lint\.run/install\.sh' Dockerfile.image-service-build curl -fsSL https://golangci-lint.run/docs/welcome/install/local/ | rg -n 'install\.sh|golangci-lint\.run/install\.sh'🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile.image-service-build` at line 5, The Dockerfile RUN line currently downloads the installer from raw.githubusercontent.com (the moving master branch); update that to use the official golangci-lint installer endpoint (https://golangci-lint.run/install.sh) while preserving the pinned version argument v2.12.1 and the same install destination ($(go env GOPATH)/bin) used in the RUN command; modify the RUN invocation that invokes curl and sh so it uses golangci-lint.run/install.sh and still passes the "-s -- -b $(go env GOPATH)/bin v2.12.1" arguments to sh (refer to the RUN line in Dockerfile.image-service-build to locate the change).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@Dockerfile.image-service-build`:
- Line 5: The Dockerfile RUN line currently downloads the installer from
raw.githubusercontent.com (the moving master branch); update that to use the
official golangci-lint installer endpoint (https://golangci-lint.run/install.sh)
while preserving the pinned version argument v2.12.1 and the same install
destination ($(go env GOPATH)/bin) used in the RUN command; modify the RUN
invocation that invokes curl and sh so it uses golangci-lint.run/install.sh and
still passes the "-s -- -b $(go env GOPATH)/bin v2.12.1" arguments to sh (refer
to the RUN line in Dockerfile.image-service-build to locate the change).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 79415c63-6859-4b2b-981f-22c107d25e5f
📒 Files selected for processing (1)
Dockerfile.image-service-build
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
|
@red-hat-konflux[bot]: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
This PR contains the following updates:
v2.8.0→v2.12.2Release Notes
golangci/golangci-lint (github.com/golangci/golangci-lint)
v2.12.2Compare Source
Released on 2026-05-06
gomodguard_v2: fix blocked configurationgomodguard_v2: from 2.1.0 to 2.1.3iface: from 1.4.1 to 1.4.2v2.12.1Compare Source
Released on 2026-05-01
gomodguard_v2: fix panic with migration suggestioninstall.shscript (if you are still using an URL based on the branchmaster, please update to usehttps://golangci-lint.run/install.sh)v2.12.0Compare Source
Released on 2026-05-01
clickhouselintlinter https://github.com/ClickHouse/clickhouse-go-linterdupl: fromf665c8dtoc99c5cf(extended detection)funcorder: from 0.5.0 to 0.6.0 (new option:function)goconst: add an option to ignore strings from testsgoconst: from 1.8.2 to 1.10.0 (extended detection)gomodguard_v2: from 1.4.1 to 2.1.0 (major version with new configuration)gosec: from619ce21to 2.26.1 (new checks:G124,G708,G709,G710)govet: addinlineanalyzermakezero: from 2.1.0 to 2.2.1 (support slice type aliases)paralleltest: exposecheckcleanupoptionsloglint: from 0.11.1 to 0.12.0 (new options:allowed-keys,custom-funcs)wsl_v5: from 5.6.0 to 5.8.0 (new option:cuddle-max-statements; new checks:after-decl,after-defer,after-expr,after-go,cuddle-group)forbidigo: from 2.3.0 to 2.3.1godot: from 1.5.4 to 1.5.6govet-modernize: from 0.43.0 to 0.44.0ireturn: from 0.4.0 to 0.4.1rowserrcheck: from 1.1.1 toc5f79b8customcommandv2.11.4Compare Source
Released on 2026-03-22
govet-modernize: from 0.42.0 to 0.43.0noctx: from 0.5.0 to 0.5.1sqlclosecheck: from 0.5.1 to 0.6.0v2.11.3Compare Source
Released on 2026-03-10
gosec: from v2.24.7 to619ce21v2.11.2Compare Source
Released on 2026-03-07
fmt: fix error when using thefmtcommand with explicit paths.v2.11.1Compare Source
Released on 2026-03-06
Due to an error related to AUR, some artifacts of the v2.11.0 release have not been published.
This release contains the same things as v2.11.0.
v2.11.0Compare Source
Released on 2026-03-06
errcheck: from 1.9.0 to 1.10.0 (excludecrypto/rand.Readby default)gosec: from 2.23.0 to 2.24.6 (new rules:G113,G118,G119,G120,G121,G122,G123,G408,G707)noctx: from 0.4.0 to 0.5.0 (new detection:httptest.NewRequestWithContext)prealloc: from 1.0.2 to 1.1.0revive: from 1.14.0 to 1.15.0 (var-namingto a new rulepackage-naming)gocognit: from 1.2.0 to 1.2.1gosec: from 2.24.6 to 2.24.7unqueryvet: from 1.5.3 to 1.5.4v2.10.1Compare Source
Released on 2026-02-17
v2.10.0Compare Source
Released on 2026-02-17
ginkgolinter: from 0.22.0 to 0.23.0gosec: from 2.22.11 to 2.23.0 (new rules:G117,G602,G701,G702,G703,G704,G705,G706)staticcheck: from 0.6.1 to 0.7.0godoclint: from 0.11.1 to 0.11.2v2.9.0Compare Source
Released on 2026-02-10
arangolint: from 0.3.1 to 0.4.0 (new rule: detect potential query injections)ginkgolinter: from 0.21.2 to 0.22.0 (support for wrappers)golines: from 0.14.0 to 0.15.0misspell: from 0.7.0 to 0.8.0revive: from v1.13.0 to v1.14.0 (new rules:epoch-naming,use-slices-sort)unqueryvet: from 1.4.0 to 1.5.3 (new options:check-n1,check-sql-injection,check-tx-leaks,allow,custom-rules)wsl_v5: from 5.3.0 to 5.6.0 (new rule:after-block)modernize: from 0.41.0 to 0.42.0prealloc: from 1.0.1 to 1.0.2protogetter: from 0.3.18 to 0.3.20Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.