Skip to content

fix(ci): govulncheck via go run; golangci-lint v2 module path + GOBIN #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
onokonem merged 1 commit into from
Aug 9, 2026
Merged

fix(ci): govulncheck via go run; golangci-lint v2 module path + GOBIN #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 14 additions & 13 deletions .github/workflows/periodic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,15 +35,11 @@ jobs:
experimental: true

# govulncheck: known vulnerabilities in dependencies (call-graph aware,
# fewer false positives than naive scanning).
- name: Install govulncheck
run: go install golang.org/x/vuln/cmd/govulncheck@latest
# `go install` drops the binary in GOPATH/bin, which is not on the
# runner's PATH — export it so govulncheck resolves.
# fewer false positives than naive scanning). go run so the tool needs
# no PATH wiring — mise redirects GOBIN away from GOPATH/bin on the
# runner, which made `go install` + PATH unresolvable.
- name: Run govulncheck
run: |
export PATH="$(go env GOPATH)/bin:$PATH"
govulncheck ./...
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

# go list -m -u all: surface outdated modules (informational, non-fatal).
- name: List outdated modules
Expand All @@ -60,14 +56,19 @@ jobs:

# Install the LATEST golangci-lint (not the pinned version) to surface
# newly-added lints. Distinct from pr.yml which uses the pinned version
# for deterministic gating. go install instead of the upstream master
# install.sh, whose embedded checksums keep failing to verify against
# the release assets (seen with 2.12.2 on linux and darwin).
# for deterministic gating. go install from source instead of the
# upstream master install.sh, whose embedded checksums keep failing to
# verify against the release assets (seen with 2.12.2 on linux and
# darwin). Note the /v2 module path: without it @latest resolves to the
# last v1, which rejects this repo's v2 config.
- name: Install latest golangci-lint
run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
- name: Run latest golangci-lint
run: |
export PATH="$(go env GOPATH)/bin:$PATH"
# mise redirects GOBIN away from GOPATH/bin on the runner; honor it.
bin_dir="$(go env GOBIN)"
[ -z "$bin_dir" ] && bin_dir="$(go env GOPATH)/bin"
export PATH="$bin_dir:$PATH"
golangci-lint run ./...

open-issue-on-failure:
Expand Down
Loading