Repository navigation
ci: setup-golangci-lint, a cached and verified golangci-lint install - #14
Merged
Merged
Conversation
golangci-lint-action downloads the binary from GitHub Releases on every job, and the runner images do not ship golangci-lint. On 2026-11-08 the v2.15.0 linux-amd64 archive returned HTTP 504 for at least 15 minutes while other assets of the same release downloaded, which failed lint in gogpu/gogpu. This composite action keeps the release archive in the Actions cache, keyed by version, platform and sha256, so a cache hit makes no network request. The archive is checked against the pinned sha256 on every run, hit or miss, and on a miss it is downloaded with retries and checked with gh attestation verify against golangci-lint's build provenance. Lint steps then run golangci-lint-action with install-mode none. The test workflow proves a cold install on linux amd64/arm64 and macOS, a warm install with the download host unreachable, and that a poisoned cache entry is rejected with nothing on PATH. Also ignore /tmp/.
kolkov
force-pushed
the
ci/setup-golangci-lint
branch
from
November 8, 2026 09:10
9873a7c to
0fa9aad
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A shared composite action that installs a pinned golangci-lint for CI without depending on GitHub Releases being reachable on every job.
golangci-lint-actiondownloads the binary on every job, and the runner images don't ship golangci-lint. Today the v2.15.0 linux-amd64 archive returned HTTP 504 for at least 15 minutes while other assets of the same release downloaded fine, which failed the new lint legs on gogpu/gogpu main (gogpu/gogpu#525).What the action does:
PATH;gh attestation verify --repo golangci/golangci-lintagainst the build provenance golangci-lint publishes;PATH, sogolangci-lint-actionruns withinstall-mode: none.Every action it uses is pinned by commit SHA. The README covers usage and how to bump the version.
The test workflow runs the three cases that matter:
PATH.Each run deletes its own cache entries at the end. Also adds
/tmp/to.gitignore.