build: Check golangci-lint before make lint #61

Merged

linus merged 1 commit from ash/golangci-lint-preflight-57 into main

2026-10-18 14:56:50 +00:00

ash commented

2026-10-18 14:52:24 +00:00

Collaborator

Closes #57

Closes the gap Mira left open on #57 (issuecomment-6660): local golangci-lint now gets checked before lint runs.

GOLANGCI_LINT_VERSION ?= v2.14.0 in the Makefile, exported like GORELEASER_VERSION.
scripts/check-toolchain.sh has an env-gated golangci-lint check. It strips a leading v before adding one, because a go install-ed build reports 2.14.0. On a mismatch it prints found, required and go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0.
lint, test and test-race run check-lint first (Go plus golangci-lint, no GoReleaser), so a mismatch stops before go mod tidy. build runs check-toolchain, which checks all three. check-go had no other callers, so I removed it.
CI runs the script without the variable, so the golangci-lint action (v2.14.0) still decides there.
README build section names the golangci-lint pin and its fix.

Proof on jumpbox-ash, go1.27.2, real golangci-lint binaries:

make lint and make test with v2.13.2 stop at check-lint (found v2.13.2, required v2.14.0, plus the fix), and the tree is unchanged.
make lint with no golangci-lint on PATH stops with found: none.
make check-toolchain passes with v2.14.0 and stops with v2.13.2.
The script with no env passes (same as CI).
An edited toolchain line in go.mod is still caught.
With v2.14.0: make lint reports 0 issues, make test passes (102 tests, all packages ok), make build succeeds.

The shared forge-standards copy of this check is ready on my side, but ash can't push to forge-standards yet (see forge-standards#1).

Closes #57 Closes the gap Mira left open on #57 (issuecomment-6660): local golangci-lint now gets checked before lint runs. - `GOLANGCI_LINT_VERSION ?= v2.14.0` in the Makefile, exported like `GORELEASER_VERSION`. - `scripts/check-toolchain.sh` has an env-gated golangci-lint check. It strips a leading `v` before adding one, because a `go install`-ed build reports `2.14.0`. On a mismatch it prints found, required and `go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0`. - `lint`, `test` and `test-race` run `check-lint` first (Go plus golangci-lint, no GoReleaser), so a mismatch stops before `go mod tidy`. `build` runs `check-toolchain`, which checks all three. `check-go` had no other callers, so I removed it. - CI runs the script without the variable, so the golangci-lint action (v2.14.0) still decides there. - README build section names the golangci-lint pin and its fix. Proof on jumpbox-ash, go1.27.2, real golangci-lint binaries: - `make lint` and `make test` with v2.13.2 stop at `check-lint` (found v2.13.2, required v2.14.0, plus the fix), and the tree is unchanged. - `make lint` with no golangci-lint on PATH stops with `found: none`. - `make check-toolchain` passes with v2.14.0 and stops with v2.13.2. - The script with no env passes (same as CI). - An edited `toolchain` line in go.mod is still caught. - With v2.14.0: `make lint` reports 0 issues, `make test` passes (102 tests, all packages ok), `make build` succeeds. The shared forge-standards copy of this check is ready on my side, but ash can't push to forge-standards yet (see forge-standards#1).

ash added 1 commit

2026-10-18 14:52:24 +00:00

build: Check golangci-lint before make lint

CI / vulncheck (pull_request) Successful in 24s

Details

CI / check-and-test (pull_request) Successful in 58s

Details

9a78edfaed

make lint ran whatever golangci-lint was on PATH while CI lints with
v2.14.0, so local and CI lint could disagree with no hint why.

Pin GOLANGCI_LINT_VERSION ?= v2.14.0 and add an env-gated golangci-lint
check to scripts/check-toolchain.sh that prints found, required and the
go install fix. lint, test and test-race now run it first (check-lint,
which skips GoReleaser), so a mismatch stops before go mod tidy. build
checks all three. check-go had no other users and is gone. CI runs the
script without the variable, so the golangci-lint action still decides
there.

Closes #57

ash requested review from eva

2026-10-18 14:52:24 +00:00

ash self-assigned this

2026-10-18 14:53:42 +00:00

eva approved these changes

2026-10-18 14:56:13 +00:00

eva left a comment

APPROVE on head 9a78edfaed.

Checked against #57 and Mira's remaining-gap comment (6660):

GOLANGCI_LINT_VERSION ?= v2.14.0 is in the Makefile and exported. The preflight has an env-gated check that normalizes a leading v (go-installed builds report 2.14.0) and, on mismatch, stops with found / required / the exact go install ...@v2.14.0 fix.
lint, test and test-race run check-lint (Go plus golangci-lint, no GoReleaser) before any work. build runs the full check-toolchain. check-go had no other callers, so removing it is fine.
CI runs the script without the variable, so the golangci-lint action pin (v2.14.0) stays the CI authority. Nothing else changes for CI.
Everything else #57 asked to pin has already landed and is intact on this base: toolchain go1.27.2 in go.mod, GoReleaser v2.18.3 locally and in release-tag, goreleaser-action@v6, setup-go@v5, golangci-lint v2.14.0 in CI.
README names the pin and the fix. Diff is 3 files, +10/-8, one job.
No secrets, and no workflow or dependency changes.
CI is green on this head (check-and-test, vulncheck). Open, mergeable, based on the current main tip 2ddfda718b. Ash's proof covers mismatch, none-on-PATH, pass, go.mod tamper and a clean tree.

Nit, not blocking: this repo's script now differs from the shared forge-standards copy until the stacked forge-standards change (a4ade45) lands. Keep them byte-identical when it does.

APPROVE on head 9a78edfaedf73c33d902c7fe3966c80a653a5a7c. Checked against #57 and Mira's remaining-gap comment (6660): - `GOLANGCI_LINT_VERSION ?= v2.14.0` is in the Makefile and exported. The preflight has an env-gated check that normalizes a leading `v` (go-installed builds report 2.14.0) and, on mismatch, stops with found / required / the exact `go install ...@v2.14.0` fix. - `lint`, `test` and `test-race` run `check-lint` (Go plus golangci-lint, no GoReleaser) before any work. `build` runs the full `check-toolchain`. `check-go` had no other callers, so removing it is fine. - CI runs the script without the variable, so the golangci-lint action pin (v2.14.0) stays the CI authority. Nothing else changes for CI. - Everything else #57 asked to pin has already landed and is intact on this base: `toolchain go1.27.2` in go.mod, GoReleaser v2.18.3 locally and in release-tag, goreleaser-action@v6, setup-go@v5, golangci-lint v2.14.0 in CI. - README names the pin and the fix. Diff is 3 files, +10/-8, one job. - No secrets, and no workflow or dependency changes. - CI is green on this head (check-and-test, vulncheck). Open, mergeable, based on the current main tip 2ddfda718ba8. Ash's proof covers mismatch, none-on-PATH, pass, go.mod tamper and a clean tree. Nit, not blocking: this repo's script now differs from the shared forge-standards copy until the stacked forge-standards change (a4ade45) lands. Keep them byte-identical when it does.