Skip to content

action-allowlist-review: bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 in /.github/actions/for-dependabot-triggered-reviews#878

Merged
potiuk merged 1 commit into
mainfrom
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/golangci/golangci-lint-action-9.2.1
May 24, 2026
Merged

action-allowlist-review: bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 in /.github/actions/for-dependabot-triggered-reviews#878
potiuk merged 1 commit into
mainfrom
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/golangci/golangci-lint-action-9.2.1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 22, 2026 •
edited
Loading

Bumps golangci/golangci-lint-action from 9.2.0 to 9.2.1.

Release notes

Sourced from golangci/golangci-lint-action's releases.

v9.2.1

What's Changed

IMPORTANT: this is the first immutable release.

Changes

Dependencies

Full Changelog: golangci/golangci-lint-action@v9.2.0...v9.2.1

Commits
  • 82606bf chore: prepare release v9.2.1
  • 97c8387 chore: improve workflows (#1394)
  • 28d0a19 build(deps): bump the dependencies group across 1 directory with 2 updates
  • 633fbc7 build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#1391)
  • 59f43e2 build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#1389)
  • 9eb174e build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 (#1386)
  • 4f52504 build(deps): bump github/codeql-action from 4 to 4.35.2 (#1384)
  • 6f87dfd docs: update examples
  • c9500d7 chore: improve workflows
  • 03b1faa chore: improve issue templates
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 22, 2026
@dependabot dependabot Bot requested a review from dfoulks1 as a code owner May 22, 2026 13:48
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label May 22, 2026
@dependabot dependabot Bot requested review from potiuk and ppkarwasz as code owners May 22, 2026 13:48
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 22, 2026
@potiuk
Copy link
Copy Markdown
Member

potiuk commented May 22, 2026

@dependabot rebase

@dependabot
action-allowlist-review: bump golangci/golangci-lint-action
2c11f11 
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.2.0 to 9.2.1.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@1e7e51e...82606bf)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-version: 9.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/golangci/golangci-lint-action-9.2.1 branch from 762781e to 2c11f11 Compare May 22, 2026 18:59
@potiuk potiuk mentioned this pull request May 24, 2026
Closed
potiuk
potiuk approved these changes May 24, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@potiuk potiuk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM — pinned SHA bump (v9.2.0 → v9.2.1) with clean source-diff and reproducible JS bundle. The Binary download verification ✗ finding is a pre-existing action-design pattern (downloads golangci-lint at runtime without in-source checksum check), unchanged from approved v9.2.0. Filed upstream as golangci/golangci-lint-action#1396 to address the underlying gap.

@potiuk potiuk merged commit f0a8225 into main May 24, 2026
11 of 12 checks passed
@potiuk potiuk deleted the dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/golangci/golangci-lint-action-9.2.1 branch May 24, 2026 15:16
@potiuk
Copy link
Copy Markdown
Member

potiuk commented May 24, 2026

Resolution follow-up: the verify pipeline now accepts GitHub release immutability + Sigstore attestation as an equivalent trust anchor for the runtime-download finding (per maintainer @ldez's explanation in golangci/golangci-lint-action#1396).

Implemented in #887: TRUSTED_DOWNLOAD_PROVENANCE config + scan-time verification (release.immutable: true + gh attestation verify). Bootstrap entry includes golangci/golangci-lint-action so the next bump of this action will pass verify cleanly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@potiuk potiuk potiuk approved these changes

@dfoulks1 dfoulks1 Awaiting requested review from dfoulks1 dfoulks1 is a code owner

@ppkarwasz ppkarwasz Awaiting requested review from ppkarwasz ppkarwasz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@potiuk