Conversation
Signed-off-by: Peter Jausovec <[email protected]>
There was a problem hiding this comment.
Pull request overview
This PR removes golangci-lint from the Go module “tool” dependencies to reduce go.mod/go.sum bloat, and updates local/CI lint invocation accordingly.
Changes:
- Drop
golangci-lint(and its transitive deps) fromgo.mod/go.sum. - Update
make lintto callgolangci-lintdirectly (instead ofgo tool golangci-lint). - Switch GitHub Actions Go lint job to
golangci/golangci-lint-action@v7pinned tov2.8.0.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
go.mod |
Removes golangci-lint tool entry and prunes indirect deps that were pulled in via the tool module. |
go.sum |
Removes checksums for golangci-lint’s transitive module graph; retains only app-required sums. |
Makefile |
Updates lint command to use a standalone golangci-lint binary. |
.github/workflows/lint.yml |
Replaces make lint with golangci-lint-action pinned to v2.8.0. |
Comments suppressed due to low confidence (1)
Makefile:262
make lintnow assumesgolangci-lintis already installed and on PATH, but the repo pins a specific version in CI. This can lead to inconsistent local lint results (different golangci-lint versions) and a worse onboarding experience. Consider adding aninstall-golangci-lint(or similar) target/script that installs the pinned version, and pointGOLANGCI_LINTat that installed binary by default.
GOLANGCI_LINT ?= golangci-lint
GOLANGCI_LINT_ARGS ?= --fix
.PHONY: lint
lint: ## Run golangci-lint linter
$(GOLANGCI_LINT) run $(GOLANGCI_LINT_ARGS)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - uses: golangci/golangci-lint-action@v7 | ||
| with: | ||
| version: v2.8.0 | ||
| args: --fix |
There was a problem hiding this comment.
The workflow runs golangci-lint with --fix. In CI this can silently modify files in the runner and still pass when all issues are auto-fixed, which means lint problems may not be caught unless someone happens to run lint locally and commit the changes. Prefer running without --fix in CI, or add a follow-up step to fail the job when git diff is non-empty after linting.
| args: --fix |
timflannagan
left a comment
timflannagan
left a comment
There was a problem hiding this comment.
I'd advocate for splitting off to tools/ directory which iirc is what kgateway does today to solve this class of issue where scanners are flagging tool-related direct/indirect dependencies. LGTM for now though.
moving golangci-lint out of go tools to minimize the dependencies in go.mod ``` /kind cleanup ``` ```release-note NONE ``` Signed-off-by: Peter Jausovec <[email protected]>
Fixes agentregistry-dev#377 After PR agentregistry-dev#253 removed golangci-lint from Go tools, make lint fails with 'go: no such tool golangci-lint'. Update the GOLANGCI_LINT variable to use the system-installed binary instead of go tool, and add a pre-flight check with an install link on failure.
Description
moving golangci-lint out of go tools to minimize the dependencies in go.mod
Change Type
Changelog
Additional Notes