From d5184b709c946cda1d6123347c3257773edd823e Mon Sep 17 00:00:00 2001 From: Renovate Date: Thu, 29 Oct 2026 19:03:18 +0000 Subject: [PATCH 1/2] :arrow_up: chore(deps): update pinned build tools --- .github/actions/kind-e2e-setup/action.yml | 2 +- .github/workflows/changelog-sync.yaml | 2 +- .github/workflows/ci.yaml | 18 +++++++++--------- .github/workflows/docs.yaml | 2 +- .github/workflows/e2e-nightly.yaml | 8 ++++---- .github/workflows/mutation.yaml | 2 +- .github/workflows/preflight.yaml | 2 +- .github/workflows/release.yaml | 2 +- .github/workflows/sonarcloud.yaml | 2 +- .github/workflows/test-shuffle.yaml | 2 +- Taskfile.yml | 4 ++-- hack/verify-changelog.sh | 2 +- mise.toml | 2 +- 13 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/actions/kind-e2e-setup/action.yml b/.github/actions/kind-e2e-setup/action.yml index 0b0aaf0a7..ec6bfb25b 100644 --- a/.github/actions/kind-e2e-setup/action.yml +++ b/.github/actions/kind-e2e-setup/action.yml @@ -42,7 +42,7 @@ runs: - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Restore kind binary cache id: kind-cache diff --git a/.github/workflows/changelog-sync.yaml b/.github/workflows/changelog-sync.yaml index 8628b95d7..54387659d 100644 --- a/.github/workflows/changelog-sync.yaml +++ b/.github/workflows/changelog-sync.yaml @@ -92,7 +92,7 @@ jobs: persist-credentials: false - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Regenerate CHANGELOG.md run: task changelog:write env: diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 4507ee31f..0e6fd482c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -242,7 +242,7 @@ jobs: - uses: ./.github/actions/go-cache - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Verify generated artifacts run: task verify env: @@ -275,7 +275,7 @@ jobs: - uses: ./.github/actions/go-cache - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: govulncheck run: task vulncheck @@ -297,7 +297,7 @@ jobs: - uses: ./.github/actions/go-cache - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Check formatting run: task format:check - name: Install ShellCheck @@ -745,7 +745,7 @@ jobs: envtest: true - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Unit tests and coverage floor run: task coverage env: @@ -785,7 +785,7 @@ jobs: - uses: ./.github/actions/go-cache - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Build manager run: task build @@ -802,7 +802,7 @@ jobs: - uses: ./.github/actions/go-cache - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Verify Forgejo pre-pull safeguards run: bash test/ci/forgejo_prepull_test.sh - name: Pre-pull Forgejo image @@ -828,7 +828,7 @@ jobs: persist-credentials: false - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Install Helm env: HELM_VERSION: v3.22.1 @@ -854,7 +854,7 @@ jobs: envtest: true - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Performance snapshot (optional gate) run: task perf-report env: @@ -969,7 +969,7 @@ jobs: - uses: ./.github/actions/go-cache - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Build controller image run: task docker:build diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 99aed42ba..cd92c8da3 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -108,7 +108,7 @@ jobs: cache-dependency-path: docs/package-lock.json - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod diff --git a/.github/workflows/e2e-nightly.yaml b/.github/workflows/e2e-nightly.yaml index db1098f01..49a4dbf9d 100644 --- a/.github/workflows/e2e-nightly.yaml +++ b/.github/workflows/e2e-nightly.yaml @@ -108,7 +108,7 @@ jobs: - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Micro-benchmarks run: task bench @@ -140,7 +140,7 @@ jobs: - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Unit + envtest under -race id: race @@ -206,7 +206,7 @@ jobs: - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Extractor hot-path budget (micro-benchmark, not a scale tier) run: task extract-budget @@ -231,7 +231,7 @@ jobs: - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Extended envtest scale (10k) run: go test -run TestEngine_ScaleEnvtestOptIn -count=1 -timeout=35m ./internal/collect/... diff --git a/.github/workflows/mutation.yaml b/.github/workflows/mutation.yaml index 47a36e96e..9eca3c22d 100644 --- a/.github/workflows/mutation.yaml +++ b/.github/workflows/mutation.yaml @@ -33,7 +33,7 @@ jobs: - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Mutation measurement (report only) id: mutation diff --git a/.github/workflows/preflight.yaml b/.github/workflows/preflight.yaml index 817e87424..a17d0606d 100644 --- a/.github/workflows/preflight.yaml +++ b/.github/workflows/preflight.yaml @@ -31,7 +31,7 @@ jobs: - uses: ./.github/actions/go-cache - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "22" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 64291c621..50029b1ee 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -417,7 +417,7 @@ jobs: id: cliff uses: orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff # v4.9.1 with: - version: v2.13.1 + version: v2.14.2 config: hack/release/cliff.toml args: --latest --strip header github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/sonarcloud.yaml b/.github/workflows/sonarcloud.yaml index ea1574488..a0efc8c54 100644 --- a/.github/workflows/sonarcloud.yaml +++ b/.github/workflows/sonarcloud.yaml @@ -25,7 +25,7 @@ jobs: envtest: true - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Unit tests and coverage run: task coverage env: diff --git a/.github/workflows/test-shuffle.yaml b/.github/workflows/test-shuffle.yaml index d2609fc92..93e4a8d0d 100644 --- a/.github/workflows/test-shuffle.yaml +++ b/.github/workflows/test-shuffle.yaml @@ -36,7 +36,7 @@ jobs: - uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0 with: - version: 3.52.0 + version: 3.54.0 - name: Shuffled, repeated unit tests (seed printed first) run: task test:shuffle diff --git a/Taskfile.yml b/Taskfile.yml index 9ef6df114..24f983d78 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -19,14 +19,14 @@ vars: # Packages whose integration-tagged tests make up the L3 tier (task test-integration). INTEGRATION_PACKAGES: ./internal/sink/... ./internal/pipeline/... # renovate: datasource=github-releases depName=orhun/git-cliff - GIT_CLIFF_VERSION: v2.13.1 + GIT_CLIFF_VERSION: v2.14.2 GIT_CLIFF_BIN: "{{.BIN_DIR}}/git-cliff" CLIFF_CONFIG: hack/release/cliff.toml GO_ARCH_LINT_CONFIG: .go-arch-lint.yml GO_ARCH_LINT_GRAPH: docs/architecture-graph.svg MARKDOWNLINT_CONFIG: hack/tooling/markdownlint-cli2.yaml # renovate: datasource=github-releases depName=fe3dback/go-arch-lint - GO_ARCH_LINT_VERSION: v1.19.0 + GO_ARCH_LINT_VERSION: v1.19.1 # renovate: datasource=go depName=golang.org/x/vuln GOVULNCHECK_VERSION: v1.9.0 # renovate: datasource=go depName=github.com/go-gremlins/gremlins diff --git a/hack/verify-changelog.sh b/hack/verify-changelog.sh index ac2b3f163..880210663 100755 --- a/hack/verify-changelog.sh +++ b/hack/verify-changelog.sh @@ -8,7 +8,7 @@ cd "${ROOT}" CLIFF="${GIT_CLIFF_BIN:-${ROOT}/bin/git-cliff}" if [[ ! -x "${CLIFF}" ]]; then echo "verify-changelog: installing git-cliff into bin/" >&2 - bash hack/install-git-cliff.sh v2.13.1 bin/git-cliff + bash hack/install-git-cliff.sh v2.14.2 bin/git-cliff CLIFF="${ROOT}/bin/git-cliff" fi diff --git a/mise.toml b/mise.toml index 09428035f..d841bfed5 100644 --- a/mise.toml +++ b/mise.toml @@ -52,7 +52,7 @@ idiomatic_version_file_enable_tools = ["go"] [tools] # Task runs the whole gate matrix (Taskfile.yml). Matches the `version:` input of every # `go-task/setup-task` step under .github/ (workflows and composite actions). -task = "3.52.0" +task = "3.54.0" # Node runs markdownlint-cli2 for `task lint:markdown` (pinned in docs/package.json). # Matches `node-version: "22"` in .github/workflows/docs.yaml and From 68dca2cee4f75c83ab9fec6105dc451463f7b336 Mon Sep 17 00:00:00 2001 From: Konrad Heimel Date: Fri, 30 Oct 2026 01:30:25 +0100 Subject: [PATCH 2/2] :wrench: build: follow the Task 3.54.0 pin in the mutation W1 mutant The W1 self-test mutant rewrites mutation.yaml's setup-task version by literal, and still looked for 3.52.0 after the pin moved to 3.54.0, so the mutation step failed before anything was tested and the lint job went red. --- hack/test/mutation_signal_test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hack/test/mutation_signal_test.sh b/hack/test/mutation_signal_test.sh index f598fddb9..000c34463 100644 --- a/hack/test/mutation_signal_test.sh +++ b/hack/test/mutation_signal_test.sh @@ -1323,7 +1323,7 @@ done' 'measure aggregate "${ROOT}" ./internal/... ./internal/...' judge W1 "a pull_request trigger (W1)" "W1: on: is" lit "${W}" ' workflow_dispatch:' " workflow_dispatch:${nl} pull_request:" judge W1 "permissions widened (W1)" "W1: permissions: is" lit "${W}" ' contents: read' ' contents: write' judge W1 "setup-task at a version no other workflow uses (W1)" "W1: setup-task version: 99.0.0 is used by no other workflow" \ - lit "${W}" ' version: 3.52.0' ' version: 99.0.0' + lit "${W}" ' version: 3.54.0' ' version: 99.0.0' judge 'W1|C1' "the workflow deleted (absence)" "W1: absence: .github/workflows/mutation.yaml is missing" rm -f "${W}" judge C1 "the workflow renamed (C1)" "C1: the reporter's 'Mutation testing' does not equal" \ lit "${W}" 'name: Mutation testing' 'name: Mutation testing (nightly)'