Repository navigation
ci: fix golangci-lint install failure and pin tool versions - #14
Merged
Merged
Conversation
The pre-commit workflow failed while installing golangci-lint, with a checksum mismatch that had nothing to do with the change under test: want df5b9676864cd25a50ef840fcb2644e1627bbce1636d5bf422758e7c3934e7e1 got 2277d43b98ec0054280f2ac26b53268bae97682444678a59a657dd565da021d6 Those hashes are both published for the 2.13.2 release, but they belong to different assets. 2277d43b is the linux-amd64 tarball, the file actually downloaded. df5b9676 is that tarball's .sbom.json sidecar. Upstream's install.sh looks the checksum up by matching the asset filename without anchoring, so golangci-lint-2.13.2-linux-amd64.tar.gz also matches golangci-lint-2.13.2-linux-amd64.tar.gz.sbom.json and it reads the wrong line. Any release shipping an SBOM alongside the tarball trips this. Install golangci-lint with go install instead. Verification moves to the module proxy and checksum database rather than a hand-rolled hash check in a shell script fetched from master, and the curl-pipe-to-shell step leaves CI entirely. Pin both tool versions while here. Requesting latest meant an upstream release could break CI on a pull request that changed nothing related, which is exactly what happened. Note that go install builds without release ldflags, so the version string carries "(unknown, modified: ?)" build metadata. The reported version number is still correct. Assisted-by: Kiro <noreply@kiro.dev> (1.0.116)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Pre-commit workflow is failing on unrelated pull requests while installing
golangci-lint. It is an upstream installer bug, not a corrupt download and not a
supply-chain problem.
install-go-tools.shpipes golangci-lint'sinstall.shfrommasterand asksfor
latest, which currently resolves to 2.13.2. That script looks up therelease checksum by matching the asset filename without anchoring, so
golangci-lint-2.13.2-linux-amd64.tar.gzalso matchesgolangci-lint-2.13.2-linux-amd64.tar.gz.sbom.json, and it reads the SBOM'schecksum instead of the tarball's.
Both hashes in the CI error are genuine, published, and belong to different
assets:
2277d43b…golangci-lint-2.13.2-linux-amd64.tar.gz(what was downloaded)df5b9676…golangci-lint-2.13.2-linux-amd64.tar.gz.sbom.json(what it compared against)Any release that ships an SBOM beside the tarball trips this.
Changes
go installfrom the module proxy rather thancurl | sh. Verification moves to the proxy and checksum database instead ofa hand-rolled hash check in a script fetched from
master.golangci-linttov2.13.2andgoimportstov0.50.0. Floating onlatestis what allowed an upstream release to break CI on a pull requestthat changed nothing related.
Testing
go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2installs cleanly and the binary reports
2.13.2.shellcheck --shell=sh .github/scripts/install-go-tools.shis clean.sh -n .github/scripts/install-go-tools.shparses.The real verification is this PR's own Pre-commit run, which exercises the
changed installer.
Notes for review
go installbuilds without release ldflags, sogolangci-lint --versionreports
2.13.2with(unknown, modified: ?)build metadata. Cosmetic forlinting, but worth knowing if anything parses that output.
v2.13.2is whatlatesthappened to resolve to. If CI was previously passingagainst an older golangci-lint, this pin may surface new findings — worth a look
before merge, and easy to pin lower instead.
Unblocks
#13, which is red purely because of this installer failure.