ci: derive Go version from go.mod and bump to Go 1.25.9#31
Open
marcusburghardt wants to merge 5 commits intocomplytime:mainfrom
Open
ci: derive Go version from go.mod and bump to Go 1.25.9#31marcusburghardt wants to merge 5 commits intocomplytime:mainfrom
marcusburghardt wants to merge 5 commits intocomplytime:mainfrom
Conversation
Replace the hardcoded GO_VERSION env variable with go-version-file pointing to go.mod. This makes go.mod the single source of truth for the Go version used in CI, so dependency updates that change the Go version requirement no longer require a separate CI workflow change. Also bump golangci-lint from v2.1 to v2.11 to ensure compatibility with Go 1.25+, since v2.1 was built with Go 1.24 and cannot target newer Go versions. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
Update the go directive from 1.24.0 to 1.25.9 to resolve 19 known stdlib vulnerabilities in Go 1.25.0 (GO-2025-4006 through GO-2026-4947) flagged by OSV-Scanner. This also unblocks dependabot PR complytime#24 (gin-contrib/requestid v1.0.6) which transitively requires Go 1.25 via gin-gonic/gin v1.12.0. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
Revert kin-openapi from v0.135.0 to v0.133.0 and pin oasdiff/yaml to matching pseudo-versions. The v0.135.0 upgrade (merged in PR complytime#26) introduced a breaking API change (Ref changed from string to MappingRef) that is incompatible with oapi-codegen v2.6.0, causing the verify-codegen CI job to fail on main. This restores the dependency set that oapi-codegen v2.6.0 was built against, fixing the pre-existing verify-codegen failure. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
G122 (config.go): Replace filepath.Walk + os.ReadFile with os.OpenRoot and root-scoped fs.WalkDir + root.ReadFile. This prevents symlink TOCTOU traversal by confining all filesystem operations to the evaluations directory via Go 1.25 os.Root. G706 (jwtauth.go): Add nolint directive for structured slog.Debug call in the DNS bypass dialer. The address values come from the Go net package dial callback and are logged as structured attributes, which prevents log injection. Consistent with existing nolint directives on lines 54 and 116 for the same pattern. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
Update the gaze baseline to reflect the minor complexity increase in NewMapperFromDir (8 -> 9) caused by the os.Root security hardening. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
go.modinstead of hardcodingGO_VERSIONinci_local.yml. Usesgo-version-file: go.modwithactions/setup-go, makinggo.modthe single source of truth. Future dependency updates that change the Go version requirement will automatically work in CI without manual workflow changes.verify-codegenCI failure onmain. The v0.135.0 upgrade (PR chore(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 #26) introduced a breaking API change (Refchanged fromstringtoMappingRef) incompatible withoapi-codegen v2.6.0.Motivation
Dependabot PR #24 is blocked because:
verify-codegenwas already failing onmain(pre-existing, from PR chore(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 #26)This PR resolves all four issues. After merging, rebasing PR #24 (
@dependabot rebase) should allow it to pass CI.Verification
All tests pass, build succeeds, and
make api-codegenproduces no diffs (verified locally with Go 1.25.9).