From 89759b08ca81016aed56f9cb4675eaa3fd46a2bf Mon Sep 17 00:00:00 2001 From: kycheng Date: Mon, 12 Oct 2026 14:20:29 +0800 Subject: [PATCH 1/2] ci: build golangci-lint and gosec against x/tools v0.52.0 for Go 1.27 golangci-lint v2.11.2 and gosec v2.29.0 pin golang.org/x/tools <= v0.49.0, which cannot decode Go 1.27 export data, so the Build job failed with "export data version 5 is greater than maximum supported version" on every package. Co-Authored-By: Claude Opus 5.5 --- scripts/devtools.sh | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/scripts/devtools.sh b/scripts/devtools.sh index cab32ad63c..4786ea4c96 100755 --- a/scripts/devtools.sh +++ b/scripts/devtools.sh @@ -5,8 +5,24 @@ set -ex # This avoids prebuilt golangci-lint binaries being built by an older Go version. GOLANGCI_LINT_VERSION=v2.11.2 GOSEC_VERSION=v2.29.0 +# golangci-lint v2.11.2 and gosec v2.29.0 pin golang.org/x/tools <= v0.49.0, +# which cannot decode Go 1.27 export data ("export data version 5 is greater +# than maximum supported version"), so every package fails to type-check. +# Build both against a newer x/tools until upstream releases catch up. +X_TOOLS_VERSION=v0.52.0 -go mod download golang.org/x/tools@latest -go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION} +# go_install_with_x_tools @ +go_install_with_x_tools() { + build_dir="$(mktemp -d)" + ( + cd "${build_dir}" + go mod init devtools-build + go get "$1" "golang.org/x/tools@${X_TOOLS_VERSION}" + go install "$2" + ) + rm -rf "${build_dir}" +} + +go_install_with_x_tools github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION} github.com/golangci/golangci-lint/v2/cmd/golangci-lint # Build gosec from source with the active toolchain (prebuilt binaries lag). -go install github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION} # cspell:disable-line +go_install_with_x_tools github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION} github.com/securego/gosec/v2/cmd/gosec # cspell:disable-line From e968cf2eaf92feb5ee90bb7d9f3822378484d9e7 Mon Sep 17 00:00:00 2001 From: kycheng Date: Mon, 12 Oct 2026 14:33:17 +0800 Subject: [PATCH 2/2] ci: golangci-lint v2.14.0 for Go 1.27 v2.11.2 panics analysing Go 1.27's internal/poll on linux ("buildir: unexpected expr: *ast.KeyValueExpr"), so build v2.14.0 instead. Its revive adds unexported-return, which flags two long-standing public constructors; exclude it like var-naming. Co-Authored-By: Claude Opus 5.5 --- .golangci.yml | 5 +++++ scripts/devtools.sh | 37 +++++++++++++++++-------------------- 2 files changed, 22 insertions(+), 20 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index 2a303b8fe8..8586ec6112 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -35,6 +35,11 @@ linters: - linters: - revive text: var-naming + # Added to revive's defaults after golangci-lint v2.11; the flagged + # constructors are long-standing public API. + - linters: + - revive + text: unexported-return paths: - third_party$ - builtin$ diff --git a/scripts/devtools.sh b/scripts/devtools.sh index 4786ea4c96..3d50176383 100755 --- a/scripts/devtools.sh +++ b/scripts/devtools.sh @@ -3,26 +3,23 @@ set -ex # Keep tooling installation deterministic and aligned with the active Go toolchain. # This avoids prebuilt golangci-lint binaries being built by an older Go version. -GOLANGCI_LINT_VERSION=v2.11.2 +# v2.11.x panics while analysing Go 1.27's internal/poll package +# ("unexpected expr: *ast.KeyValueExpr"); v2.14.0 handles Go 1.27. +GOLANGCI_LINT_VERSION=v2.14.0 GOSEC_VERSION=v2.29.0 -# golangci-lint v2.11.2 and gosec v2.29.0 pin golang.org/x/tools <= v0.49.0, -# which cannot decode Go 1.27 export data ("export data version 5 is greater -# than maximum supported version"), so every package fails to type-check. -# Build both against a newer x/tools until upstream releases catch up. -X_TOOLS_VERSION=v0.52.0 +# gosec v2.29.0 pins golang.org/x/tools v0.49.0, which cannot decode Go 1.27 +# export data ("export data version 5 is greater than maximum supported +# version"), so every package fails to type-check. Build it against a newer +# x/tools until a gosec release catches up. +GOSEC_X_TOOLS_VERSION=v0.52.0 -# go_install_with_x_tools @ -go_install_with_x_tools() { - build_dir="$(mktemp -d)" - ( - cd "${build_dir}" - go mod init devtools-build - go get "$1" "golang.org/x/tools@${X_TOOLS_VERSION}" - go install "$2" - ) - rm -rf "${build_dir}" -} - -go_install_with_x_tools github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION} github.com/golangci/golangci-lint/v2/cmd/golangci-lint +go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${GOLANGCI_LINT_VERSION} # Build gosec from source with the active toolchain (prebuilt binaries lag). -go_install_with_x_tools github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION} github.com/securego/gosec/v2/cmd/gosec # cspell:disable-line +GOSEC_BUILD_DIR="$(mktemp -d)" +( + cd "${GOSEC_BUILD_DIR}" + go mod init devtools-build + go get github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION} golang.org/x/tools@${GOSEC_X_TOOLS_VERSION} # cspell:disable-line + go install github.com/securego/gosec/v2/cmd/gosec # cspell:disable-line +) +rm -rf "${GOSEC_BUILD_DIR}"