Skip to content

chore(deps): bump tool deps and pin, update golangci-lint#37574

Merged
silverwind merged 4 commits into
go-gitea:mainfrom
silverwind:pin-go-tools-makefile
May 8, 2026
Merged

chore(deps): bump tool deps and pin, update golangci-lint#37574
silverwind merged 4 commits into
go-gitea:mainfrom
silverwind:pin-go-tools-makefile

Conversation

@silverwind
Copy link
Copy Markdown
Member

@silverwind silverwind commented May 7, 2026

  1. Pin all makefile go deps to exact version, renovate will bump them in the future
  2. Bump all deps and golangci-lint and fix all new issues, most are from modernize

This PR was written with the help of Claude Opus 4.7

Locks all `_PACKAGE` entries in the Makefile to fully-pinned `vX.Y.Z`
versions so reproducible builds don't drift between runs. Bumps the
ones that were already stale to current latest:

- air: v1 → v1.65.1
- editorconfig-checker: v3 → v3.6.1
- golangci-lint: v2.11.4 → v2.12.2
- swagger: v0.33.1 → v0.33.2
- xgo: latest → v1.9.0
- govulncheck: v1 → v1.3.0
- actionlint: v1.7.11 → v1.7.12

golangci-lint v2.12.2 introduces new govet `inline` and modernize
`slicesbackward` checks; the auto-fixable issues are addressed in
this commit (replace deprecated reflect.Ptr with reflect.Pointer,
use slices.Backward for reverse iteration).

Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label May 7, 2026
@silverwind silverwind changed the title chore(deps): pin Makefile go tools to exact patch versions refactor(deps): pin Makefile go tools to exact patch versions May 7, 2026
Comment thread modules/web/handler.go Outdated
Signed-off-by: silverwind <me@silverwind.io>
@silverwind silverwind changed the title refactor(deps): pin Makefile go tools to exact patch versions refactor(deps): bump Makefile deps and pin them May 7, 2026
@silverwind
Copy link
Copy Markdown
Member Author

@techknowlogick fyi i'm pinning xgo here too, @latest is a supply-chain risk.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR modernizes several reverse-iteration patterns across the codebase by using slices.Backward, and updates tooling dependencies in the Makefile to be pinned to exact versions (supporting renovate-driven upgrades).

Changes:

  • Replace manual reverse index loops with slices.Backward(...) in multiple services/modules.
  • Update reflection pointer-kind checks to use reflect.Pointer.
  • Pin and bump Makefile Go tool dependencies (including golangci-lint, xgo, govulncheck, actionlint).

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file
File Description
services/repository/gitgraph/parser.go Use slices.Backward when parsing glyphs in reverse order.
services/pull/pull.go Use slices.Backward to iterate commits oldest→newest for squash message construction.
services/issue/commit.go Use slices.Backward for reverse commit processing.
services/gitdiff/highlightdiff.go Use slices.Backward to close tags in reverse stack order.
services/cron/tasks.go Switch pointer-kind check to reflect.Pointer.
modules/web/middleware/binding.go Switch pointer-kind checks/loops to reflect.Pointer.
modules/web/handler.go Use slices.Backward to apply middleware in reverse order.
modules/packages/rubygems/marshal.go Switch pointer-kind check to reflect.Pointer.
models/unittest/reflection.go Switch pointer-kind check to reflect.Pointer.
models/auth/source.go Switch pointer-kind check to reflect.Pointer in config registration.
Makefile Pin and bump Go tool dependencies to exact versions with renovate annotations.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@lunny
Copy link
Copy Markdown
Member

lunny commented May 7, 2026

Official release doesn't need xgo any more. The makefile needs some changes.

@silverwind
Copy link
Copy Markdown
Member Author

silverwind commented May 7, 2026

That xgo drop should be done in another PR, keep this one focused.

@silverwind silverwind changed the title refactor(deps): bump Makefile deps and pin them refactor(deps): bump Makefile deps and pin them, update go lint May 7, 2026
@silverwind silverwind changed the title refactor(deps): bump Makefile deps and pin them, update go lint refactor(deps): bump tool deps and pin, update golangci-lint May 7, 2026
@silverwind silverwind requested a review from bircni May 7, 2026 18:03
@silverwind silverwind changed the title refactor(deps): bump tool deps and pin, update golangci-lint chore(deps): bump tool deps and pin, update golangci-lint May 7, 2026
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 7, 2026
@bircni bircni added the skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features. label May 7, 2026
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 8, 2026
* origin/main:
  chore(renovate): detect Makefile tools, enable `go` bumps (go-gitea#37595)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  [skip ci] Updated translations via Crowdin

# Conflicts:
#	services/pull/pull.go
@silverwind silverwind enabled auto-merge (squash) May 8, 2026 03:54
@silverwind silverwind added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label May 8, 2026
@silverwind silverwind merged commit 82d4029 into go-gitea:main May 8, 2026
23 checks passed
@silverwind silverwind deleted the pin-go-tools-makefile branch May 8, 2026 04:49
@GiteaBot GiteaBot added this to the 1.27.0 milestone May 8, 2026
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label May 8, 2026
zjjhot added a commit to zjjhot/gitea that referenced this pull request May 8, 2026
* main:
  chore(deps): bump tool deps and pin, update `golangci-lint` (go-gitea#37574)
  build: update pnpm to v11 (go-gitea#37591)
  chore(renovate): detect Makefile tools, enable `go` bumps (go-gitea#37595)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  [skip ci] Updated translations via Crowdin
  refactor: use modernc sqlite driver as default (go-gitea#37562)
  refactor(templates): remove ctxData from tmpl files, use ctx.RootData instead (go-gitea#37567)
  ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (go-gitea#37565)

# Conflicts:
#	models/user/user.go
silverwind added a commit to mohammad-rj/gitea that referenced this pull request May 8, 2026
* origin/main: (82 commits)
  build(deps): bump fast-uri from 3.1.0 to 3.1.2 (go-gitea#37616)
  fix: make clone URL respect public URL detection setting (go-gitea#37615)
  chore(deps): bump go-git/go-git/v5 to 5.19.0 (go-gitea#37608)
  chore(deps): update action dependencies (go-gitea#37603)
  fix(actions): fix blank lines after `::endgroup::` (go-gitea#37597)
  fix: treat email addresses case-insensitively (go-gitea#37600)
  fix(git): Fix smart http request scope bug (go-gitea#37583)
  chore(deps): update dependency go to v1.26.3 (go-gitea#37601)
  chore(deps): bump tool deps and pin, update `golangci-lint` (go-gitea#37574)
  build: update pnpm to v11 (go-gitea#37591)
  chore(renovate): detect Makefile tools, enable `go` bumps (go-gitea#37595)
  refactor: only reset a database table when the table's data was changed (go-gitea#37573)
  refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (go-gitea#37543)
  fix(actions): report individual step status in workflow job API response (go-gitea#37592)
  ci: allow `chore` type in PR title lint (go-gitea#37575)
  refactor: remove obsolete export (go-gitea#37579)
  fix: Invalid UTF-8 commit messages in JSON API responses (go-gitea#37542)
  fix: use consistent GetUser family functions (go-gitea#37553)
  fix(api): return 409 message instead of empty JSON for wrong commit id (go-gitea#37572)
  fix(actions): prevent panic when workflow contains null jobs (go-gitea#37570)
  ...

# Conflicts:
#	tests/e2e/events.test.ts
#	tests/integration/eventsource_test.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. skip-changelog This PR is irrelevant for the (next) changelog, for example bug fixes for unreleased features.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants