From d658020746122e3717e5a737ce2b557907464603 Mon Sep 17 00:00:00 2001 From: Daniel Podolsky Date: Sun, 9 Aug 2026 16:18:38 +0300 Subject: [PATCH] fix(ci): govulncheck via go run; golangci-lint v2 module path + GOBIN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first live dispatch showed the PR #2 fix was incomplete: - dependency-check: mise-action sets GOBIN to the mise toolchain dir (~/.local/share/mise/installs/go//bin), so 'go install' + a GOPATH/bin PATH export still left govulncheck unresolvable (127). Use 'go run ...govulncheck@latest' instead — no PATH wiring needed. - latest-linter: go install without the /v2 module path resolves to the last golangci-lint v1 (@latest follows the module, and v2 lives at github.com/golangci/golangci-lint/v2), which rejects the repo's v2 config ('configuration file for golangci-lint v2 with v1'). Verified: installing with the /v2 path yields 2.12.2. PATH export now honors GOBIN (falls back to GOPATH/bin). --- .github/workflows/periodic.yml | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/.github/workflows/periodic.yml b/.github/workflows/periodic.yml index abc9fe5..5e9fdd9 100644 --- a/.github/workflows/periodic.yml +++ b/.github/workflows/periodic.yml @@ -35,15 +35,11 @@ jobs: experimental: true # govulncheck: known vulnerabilities in dependencies (call-graph aware, - # fewer false positives than naive scanning). - - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@latest - # `go install` drops the binary in GOPATH/bin, which is not on the - # runner's PATH — export it so govulncheck resolves. + # fewer false positives than naive scanning). go run so the tool needs + # no PATH wiring — mise redirects GOBIN away from GOPATH/bin on the + # runner, which made `go install` + PATH unresolvable. - name: Run govulncheck - run: | - export PATH="$(go env GOPATH)/bin:$PATH" - govulncheck ./... + run: go run golang.org/x/vuln/cmd/govulncheck@latest ./... # go list -m -u all: surface outdated modules (informational, non-fatal). - name: List outdated modules @@ -60,14 +56,19 @@ jobs: # Install the LATEST golangci-lint (not the pinned version) to surface # newly-added lints. Distinct from pr.yml which uses the pinned version - # for deterministic gating. go install instead of the upstream master - # install.sh, whose embedded checksums keep failing to verify against - # the release assets (seen with 2.12.2 on linux and darwin). + # for deterministic gating. go install from source instead of the + # upstream master install.sh, whose embedded checksums keep failing to + # verify against the release assets (seen with 2.12.2 on linux and + # darwin). Note the /v2 module path: without it @latest resolves to the + # last v1, which rejects this repo's v2 config. - name: Install latest golangci-lint - run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest + run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest - name: Run latest golangci-lint run: | - export PATH="$(go env GOPATH)/bin:$PATH" + # mise redirects GOBIN away from GOPATH/bin on the runner; honor it. + bin_dir="$(go env GOBIN)" + [ -z "$bin_dir" ] && bin_dir="$(go env GOPATH)/bin" + export PATH="$bin_dir:$PATH" golangci-lint run ./... open-issue-on-failure: