NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.11.3#2046
NO-ISSUE: Update module github.com/golangci/golangci-lint to v2.11.3#2046red-hat-konflux[bot] wants to merge 1 commit intomasterfrom
Conversation
red-hat-konflux
bot
added
approved
openshift-ci-robot
added
the
jira/valid-reference
|
@red-hat-konflux[bot]: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThe Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
openshift-ci
bot
added
the
size/XS
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile.assisted-installer-build`:
- Line 5: The Dockerfile RUN that downloads and executes the golangci-lint
installer uses the mutable master branch URL (the curl | sh pipeline) while
installing v2.11.1; change the download URL in that RUN line to a pinned,
immutable release URL for v2.11.1 (e.g., the raw file or releases/download path
for tag v2.11.1) so the installer script matches the version being installed
(and optionally add a checksum verification step), keeping the rest of the
invocation (-s -- -b $(go env GOPATH)/bin v2.11.1) unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 8b390c51-39dc-4adb-9e60-50a3092d3146
📒 Files selected for processing (1)
Dockerfile.assisted-installer-build
Dockerfile.assisted-installer-build
Outdated
| ENV GOFLAGS="" | ||
|
|
||
| RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.8.0 && \ | ||
| RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.1 && \ |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Run the verification script from the review comment
for ref in master v2.11.1; do
url="https://raw.githubusercontent.com/golangci/golangci-lint/${ref}/install.sh"
http_code="$(curl -sS -o "/tmp/golangci-${ref}.sh" -w "%{http_code}" "$url")"
sha="$(sha256sum "/tmp/golangci-${ref}.sh" 2>/dev/null | awk '{print $1}' || echo 'N/A')"
echo "${ref} HTTP_CODE=${http_code} SHA256=${sha}"
doneRepository: openshift/assisted-installer
Length of output: 136
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Download and hash the install scripts
echo "=== Downloading install scripts ==="
for ref in master v2.11.1; do
url="https://raw.githubusercontent.com/golangci/golangci-lint/${ref}/install.sh"
echo "Fetching: ${ref}"
if curl -sS -o "/tmp/golangci-${ref}.sh" "$url"; then
if [ -f "/tmp/golangci-${ref}.sh" ]; then
size=$(wc -c < "/tmp/golangci-${ref}.sh")
sha=$(sha256sum "/tmp/golangci-${ref}.sh" | awk '{print $1}')
echo "${ref}: HTTP 200, size=${size} bytes, sha256=${sha}"
fi
else
echo "${ref}: Download failed"
fi
done
echo ""
echo "=== Comparing scripts ==="
if [ -f "/tmp/golangci-master.sh" ] && [ -f "/tmp/golangci-v2.11.1.sh" ]; then
if cmp -s "/tmp/golangci-master.sh" "/tmp/golangci-v2.11.1.sh"; then
echo "Scripts are IDENTICAL"
else
echo "Scripts are DIFFERENT"
diff -u "/tmp/golangci-master.sh" "/tmp/golangci-v2.11.1.sh" | head -20
fi
fi
echo ""
echo "=== Checking Dockerfile ==="
if [ -f "Dockerfile.assisted-installer-build" ]; then
echo "Line 5 content:"
sed -n '5p' Dockerfile.assisted-installer-build
fiRepository: openshift/assisted-installer
Length of output: 192
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 << 'EOF'
import urllib.request
import hashlib
import os
def get_file_hash(url):
try:
with urllib.request.urlopen(url, timeout=10) as response:
content = response.read()
hash_obj = hashlib.sha256(content)
return content, hash_obj.hexdigest(), len(content)
except Exception as e:
return None, None, str(e)
print("=== Downloading install scripts ===")
for ref in ['master', 'v2.11.1']:
url = f"https://raw.githubusercontent.com/golangci/golangci-lint/{ref}/install.sh"
print(f"Fetching: {ref}")
content, sha256, result = get_file_hash(url)
if content is not None:
print(f" {ref}: HTTP 200, size={len(content)} bytes, sha256={sha256}")
with open(f"/tmp/golangci-{ref}.sh", "wb") as f:
f.write(content)
else:
print(f" {ref}: Error - {result}")
print("\n=== Comparing scripts ===")
if os.path.exists("/tmp/golangci-master.sh") and os.path.exists("/tmp/golangci-v2.11.1.sh"):
with open("/tmp/golangci-master.sh", "rb") as f1:
master = f1.read()
with open("/tmp/golangci-v2.11.1.sh", "rb") as f2:
v2111 = f2.read()
if master == v2111:
print("Scripts are IDENTICAL")
else:
print("Scripts are DIFFERENT")
print(f" master size: {len(master)} bytes")
print(f" v2.11.1 size: {len(v2111)} bytes")
EOF
echo ""
echo "=== Checking Dockerfile ==="
if [ -f "Dockerfile.assisted-installer-build" ]; then
echo "File exists. Line 5:"
sed -n '5p' Dockerfile.assisted-installer-build
echo ""
echo "Lines 1-10 for context:"
head -10 Dockerfile.assisted-installer-build
fiRepository: openshift/assisted-installer
Length of output: 1236
Pin the installer script to an immutable ref before executing it.
Line 5 fetches install.sh from master and pipes it to sh, which is mutable and differs from the pinned version v2.11.1 being installed (verified: master and v2.11.1 scripts differ by ~500 bytes). This inconsistency weakens reproducibility and supply-chain safety.
🔧 Proposed hardening
-RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.1 && \
+RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.11.1/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.11.1 && \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.1 && \ | |
| RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.11.1/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.11.1 && \ |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile.assisted-installer-build` at line 5, The Dockerfile RUN that
downloads and executes the golangci-lint installer uses the mutable master
branch URL (the curl | sh pipeline) while installing v2.11.1; change the
download URL in that RUN line to a pinned, immutable release URL for v2.11.1
(e.g., the raw file or releases/download path for tag v2.11.1) so the installer
script matches the version being installed (and optionally add a checksum
verification step), keeping the rest of the invocation (-s -- -b $(go env
GOPATH)/bin v2.11.1) unchanged.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2046 +/- ##
=======================================
Coverage 48.48% 48.48%
=======================================
Files 20 20
Lines 4333 4333
=======================================
Hits 2101 2101
Misses 2011 2011
Partials 221 221 🚀 New features to boost your workflow:
|
red-hat-konflux
bot
changed the title
red-hat-konflux
bot
changed the title
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/linter
branch
2 times, most recently
from
3463ba0 to
c5e8ea7
Compare
|
New changes are detected. LGTM label has been removed. |
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/linter
branch
from
c5e8ea7 to
4ebd824
Compare
red-hat-konflux
bot
changed the title
There was a problem hiding this comment.
♻️ Duplicate comments (1)
Dockerfile.assisted-installer-build (1)
5-5:⚠️ Potential issue | 🟠 MajorPin
install.shto the same golangci-lint tag.Line 5 still downloads the installer from
masterwhile installingv2.11.2. That keeps the build non-reproducible and weakens supply-chain guarantees because the script can change independently of the versioned artifact.🔧 Proposed hardening
-RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.2 && \ +RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.11.2/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.11.2 && \#!/bin/bash set -euo pipefail echo "=== Dockerfile line ===" sed -n '5p' Dockerfile.assisted-installer-build echo echo "=== Compare installer scripts ===" for ref in master v2.11.2; do url="https://raw.githubusercontent.com/golangci/golangci-lint/${ref}/install.sh" curl -fsSL "$url" -o "/tmp/golangci-${ref}.sh" printf '%s sha256=%s size=%s\n' \ "$ref" \ "$(sha256sum "/tmp/golangci-${ref}.sh" | awk '{print $1}')" \ "$(wc -c < "/tmp/golangci-${ref}.sh")" done echo if cmp -s /tmp/golangci-master.sh /tmp/golangci-v2.11.2.sh; then echo "master and v2.11.2 install.sh are identical" else echo "master and v2.11.2 install.sh differ" diff -u /tmp/golangci-v2.11.2.sh /tmp/golangci-master.sh | sed -n '1,40p' fi🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile.assisted-installer-build` at line 5, The Dockerfile downloads the golangci-lint installer from master while installing v2.11.2, which makes the build non-reproducible; update the curl invocation that currently fetches "https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh" so it references the matching tag (v2.11.2) instead of master (e.g., use the URL with the v2.11.2 ref) so the installer script and the installed version are pinned together in the RUN line that calls install.sh and sh -s -- -b $(go env GOPATH)/bin v2.11.2.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@Dockerfile.assisted-installer-build`:
- Line 5: The Dockerfile downloads the golangci-lint installer from master while
installing v2.11.2, which makes the build non-reproducible; update the curl
invocation that currently fetches
"https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh" so
it references the matching tag (v2.11.2) instead of master (e.g., use the URL
with the v2.11.2 ref) so the installer script and the installed version are
pinned together in the RUN line that calls install.sh and sh -s -- -b $(go env
GOPATH)/bin v2.11.2.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: fcd259cb-b2a2-4c58-921f-c9663df4a568
📒 Files selected for processing (1)
Dockerfile.assisted-installer-build
red-hat-konflux
bot
changed the title
red-hat-konflux
bot
changed the title
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/linter
branch
2 times, most recently
from
4ebd824 to
8436634
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
bot
force-pushed
the
konflux/mintmaker/master/linter
branch
from
8436634 to
2c91dc7
Compare
red-hat-konflux
bot
changed the title
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: red-hat-konflux[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@red-hat-konflux[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
This PR contains the following updates:
v2.8.0->v2.11.3Release Notes
golangci/golangci-lint (github.com/golangci/golangci-lint)
v2.11.3Compare Source
Released on 2026-03-10
gosec: from v2.24.7 to619ce21v2.11.2Compare Source
Released on 2026-03-07
fmt: fix error when using thefmtcommand with explicit paths.v2.11.1Compare Source
Released on 2026-03-06
Due to an error related to AUR, some artifacts of the v2.11.0 release have not been published.
This release contains the same things as v2.11.0.
v2.11.0Compare Source
Released on 2026-03-06
errcheck: from 1.9.0 to 1.10.0 (excludecrypto/rand.Readby default)gosec: from 2.23.0 to 2.24.6 (new rules:G113,G118,G119,G120,G121,G122,G123,G408,G707)noctx: from 0.4.0 to 0.5.0 (new detection:httptest.NewRequestWithContext)prealloc: from 1.0.2 to 1.1.0revive: from 1.14.0 to 1.15.0 (var-namingto a new rulepackage-naming)gocognit: from 1.2.0 to 1.2.1gosec: from 2.24.6 to 2.24.7unqueryvet: from 1.5.3 to 1.5.4v2.10.1Compare Source
Released on 2026-02-17
v2.10.0Compare Source
Released on 2026-02-17
ginkgolinter: from 0.22.0 to 0.23.0gosec: from 2.22.11 to 2.23.0 (new rules:G117,G602,G701,G702,G703,G704,G705,G706)staticcheck: from 0.6.1 to 0.7.0godoclint: from 0.11.1 to 0.11.2v2.9.0Compare Source
Released on 2026-02-10
arangolint: from 0.3.1 to 0.4.0 (new rule: detect potential query injections)ginkgolinter: from 0.21.2 to 0.22.0 (support for wrappers)golines: from 0.14.0 to 0.15.0misspell: from 0.7.0 to 0.8.0revive: from v1.13.0 to v1.14.0 (new rules:epoch-naming,use-slices-sort)unqueryvet: from 1.4.0 to 1.5.3 (new options:check-n1,check-sql-injection,check-tx-leaks,allow,custom-rules)wsl_v5: from 5.3.0 to 5.6.0 (new rule:after-block)modernize: from 0.41.0 to 0.42.0prealloc: from 1.0.1 to 1.0.2protogetter: from 0.3.18 to 0.3.20Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.