From 3e37150c0a6358df228386b5ae4f24c66f0b060a Mon Sep 17 00:00:00 2001 From: whg517 Date: Thu, 20 Aug 2026 00:20:24 +0800 Subject: [PATCH 1/2] build: pin golangci-lint to v2.12.1 and bump chainsaw to v0.2.14 Two version gaps against the org baseline: - golangci-lint was on v2.5.0, seven minor versions behind the version the other operators use. More importantly, golangci-lint-action was invoked without a `version:` input, so CI always installed the newest release. That makes the pipeline fail on an upstream release with no change here, and it silently diverges from what `make lint` runs locally. Pin both to v2.12.1. - chainsaw was on v0.2.13; v0.2.14 is the baseline. `make lint` reports 0 issues after the upgrade - the seven-version jump introduced no new findings. Co-Authored-By: Claude Opus 5 --- .github/workflows/lint.yml | 5 +++++ .github/workflows/release.yml | 5 +++++ Makefile | 4 ++-- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index cffb994..9119a4e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -37,3 +37,8 @@ jobs: - name: Run linter uses: golangci/golangci-lint-action@v9 + with: + # Pin the linter version so a new upstream release cannot break the + # pipeline without a code change. Keep in sync with the Makefile's + # GOLANGCI_LINT_VERSION. + version: v2.12.1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 29cf441..a237c50 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,6 +40,11 @@ jobs: - name: Run linter uses: golangci/golangci-lint-action@v9 + with: + # Pin the linter version so a new upstream release cannot break the + # pipeline without a code change. Keep in sync with the Makefile's + # GOLANGCI_LINT_VERSION. + version: v2.12.1 golang-test: diff --git a/Makefile b/Makefile index b279874..c95b5da 100644 --- a/Makefile +++ b/Makefile @@ -213,7 +213,7 @@ ENVTEST_K8S_VERSION ?= $(shell v='$(call gomodver,k8s.io/api)'; \ [ -n "$$v" ] || { echo "Set ENVTEST_K8S_VERSION manually (k8s.io/api replace has no tag)" >&2; exit 1; }; \ printf '%s\n' "$$v" | sed -E 's/^v?[0-9]+\.([0-9]+).*/1.\1/') -GOLANGCI_LINT_VERSION ?= v2.5.0 +GOLANGCI_LINT_VERSION ?= v2.12.1 .PHONY: kustomize kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary. @@ -288,7 +288,7 @@ helm-chart-publish: helm-chart-package ## Publish helm chart for the operator. ##@ Chainsaw E2E CHAINSAW ?= $(LOCALBIN)/chainsaw -CHAINSAW_VERSION ?= v0.2.13 +CHAINSAW_VERSION ?= v0.2.14 CHAINSAW_CLUSTER ?= ${PROJECT_NAME}-$(KIND_K8S_VERSION) CHAINSAW_KUBECONFIG ?= .kubeconfig # KIND_K8S_VERSION refers to the version of Kubernetes to be used by kind node image. From 6e65371a2e11bef700e6493987aa81f9f73e95a3 Mon Sep 17 00:00:00 2001 From: whg517 Date: Thu, 20 Aug 2026 00:20:25 +0800 Subject: [PATCH 2/2] ci: allow publish.yml to be run manually publish.yml could only be triggered by a push to main, so the credentials it needs could not be verified on demand. An expired HELM_CHARTS_REPO_TOKEN went unnoticed for weeks because nothing happened to land on main during that window, and it only surfaced when an unrelated change did. workflow_dispatch makes the publish path exercisable before a release rather than discovering a dead credential at tag time, when the tag cannot be recut. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b208e9b..c32681b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -4,6 +4,10 @@ on: push: branches: - main + # Allow a manual run so the publish credentials can be verified on demand. + # Without this the only way to exercise them is to land a commit on main, + # which is how an expired HELM_CHARTS_REPO_TOKEN went unnoticed for weeks. + workflow_dispatch: jobs: