From abb167bf02a8a6d399b9794c19e32d7bc7ed503a Mon Sep 17 00:00:00 2001 From: Harsh Rawat Date: Mon, 24 Aug 2026 23:39:02 +0530 Subject: [PATCH 1/2] update dependabot to keep golang test base images current Signed-off-by: Harsh Rawat --- .github/dependabot.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bfdce4f199..bb9b154aa3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -45,8 +45,8 @@ updates: cooldown: default-days: 7 - # Keep the Windows base images (nanoserver/servercore) on their latest digest: scans - # every Dockerfile (except vendored), bumps the digest only (tag kept), one grouped PR. + # Keep the test base images (nanoserver/servercore + golang) current: scans every + # Dockerfile (except vendored), digest/patch bumps only (major/minor ignored), one grouped PR. - package-ecosystem: "docker" directories: - "/**/*" @@ -57,6 +57,8 @@ updates: # image names exactly as they appear in the PR (e.g. "Updates windows/nanoserver ..."). - dependency-name: "windows/nanoserver" - dependency-name: "windows/servercore" + # golang toolchain base image used by the test images (Docker Hub official image) + - dependency-name: "golang" ignore: # keep the tag stable and only bump the digest / patch level. - dependency-name: "*" From d9db3cbf3b9f5f9dd4e1ca7612ec0e7f9506fa02 Mon Sep 17 00:00:00 2001 From: Harsh Rawat Date: Tue, 25 Aug 2026 00:09:36 +0530 Subject: [PATCH 2/2] ci: run golangci-lint against the go.mod Go version The lint job used the newest stable Go while golangci-lint is pinned, so a new Go release could outpace the linter and break CI. Install Go for the lint job from go.mod so the linter's toolchain stays aligned with the version the module targets. Build/test jobs still use the latest Go. Signed-off-by: Harsh Rawat --- .github/actions/setup-go/action.yml | 4 ++++ .github/workflows/ci.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/actions/setup-go/action.yml b/.github/actions/setup-go/action.yml index c229c45c3b..2a0d6188d7 100644 --- a/.github/actions/setup-go/action.yml +++ b/.github/actions/setup-go/action.yml @@ -9,6 +9,9 @@ inputs: go-version: description: The Go version to download. default: stable + go-version-file: + description: go.mod/go.work file to read the Go version from (takes precedence over go-version when set). + default: "" cache: description: Enable caching Go modules and build outputs, default: "true" @@ -35,6 +38,7 @@ runs: uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ inputs.go-version }} + go-version-file: ${{ inputs.go-version-file }} check-latest: true cache: ${{ inputs.cache }} cache-dependency-path: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0a3e29268c..f01e8290ad 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,6 +41,10 @@ jobs: with: # sometimes go cache causes issues when linting cache: false + # Lint with the module's target Go (go.mod), not the newest "stable" Go: a new + # Go release otherwise outpaces the pinned golangci-lint and breaks linting. + go-version: "" + go-version-file: go.mod - name: Run golangci-lint uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0