chore(deps): update golangci/golangci-lint-action action to v9

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
golangci/golangci-lint-action	action	major	v8 -> v9

---

Release Notes

golangci/golangci-lint-action (golangci/golangci-lint-action)

v9

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Code Review: Update golangci-lint-action to v9

Thank you for the automated dependency update from Renovate. I've reviewed this PR and have the following feedback:

Critical Issue: Missing Matrix Configuration ❌

The workflow file references matrix.lint on line 23 (.github/workflows/build.yml:23):

- name: Linting
  if: matrix.lint
  uses: golangci/golangci-lint-action@v8

However, there is no matrix strategy defined in the build job. This means:

• The matrix.lint condition will always be undefined/falsy
• The linting step is currently never executed
• Upgrading the action version won't fix this underlying issue

Recommendations

Before merging this PR, please:

1. Fix the missing matrix configuration by either:

   • Adding a proper matrix strategy, e.g.:

     strategy:
       matrix:
         lint: [true]

   • Or removing the conditional entirely if linting should always run:

     - name: Linting
       uses: golangci/golangci-lint-action@v9
       with:
         version: v1.41

2. Update golangci-lint version - The workflow pins to v1.41 which is quite old (from 2021). The latest version is 1.62+. Consider updating to a recent version to benefit from:

   • Better performance
   • Support for newer Go versions (currently using Go 1.25.4)
   • Bug fixes and new linters
   • Better compatibility with golangci-lint-action v9

Action Version Upgrade (v8 → v9)

The golangci-lint-action v9 upgrade itself appears safe as a minor version bump. However, it provides value only if the linting step is actually executed.

Additional Observations

• The .golangci.yml configuration is comprehensive with 40+ linters enabled
• Some deprecated linters are still referenced in the config (deadcode, structcheck, varcheck, maligned - these were removed in golangci-lint 1.49+)
• The old golangci-lint v1.41 won't support many of the configured linters

Suggested Actions

1. Create a separate issue to fix the matrix configuration bug
2. Update this PR to also bump the golangci-lint version to latest (v1.62 or newer)
3. Test the workflow after fixing the matrix issue
4. Clean up deprecated linters from .golangci.yml

---

Current Status: ⚠️ Do not merge - The linting step is not executing due to missing matrix configuration. This needs to be fixed first.

[claude]

PR Review: Update golangci-lint-action to v9

Summary

This PR updates the golangci/golangci-lint-action from v8 to v9. While the dependency update itself is straightforward, there are critical issues that need to be addressed.

---

🚨 Critical Issues

1. Severely Outdated golangci-lint Version

Location: .github/workflows/build.yml:26

The workflow is currently using golangci-lint v1.41, which was released in 2021 and is over 3 years old. This is a major problem:

• Go 1.24+ Incompatibility: The project uses Go 1.24 (with toolchain 1.25.4), but golangci-lint v1.41 was designed for Go 1.16-1.17 era
• Missing Modern Linters: Many valuable linters have been added since v1.41
• Security: Older versions may miss security issues that newer linters detect
• Deprecated Linters: The .golangci.yml configuration uses deprecated linters (deadcode, structcheck, varcheck, maligned) that have been removed in modern versions

Recommendation: Update to the latest golangci-lint version (currently v1.61+). Change line 26 from:

version: v1.41

to:

version: latest  # or specify v1.61.0 or newer

2. Configuration File Needs Update

Location: .golangci.yml:164-211

The linter configuration uses several deprecated linters:

• deadcode → replaced by unused
• structcheck → replaced by unused
• varcheck → replaced by unused
• maligned → replaced by govet: fieldalignment
• scopelint → replaced by exportloopref (already done on line 203)

These will cause warnings or errors with modern golangci-lint versions.

3. Workflow Matrix Strategy Missing

Location: .github/workflows/build.yml:23

The workflow references if: matrix.lint but there's no matrix strategy defined in the job. This means the linting step will never run because matrix.lint will always be false/undefined.

Recommendation: Either:

• Remove the if: matrix.lint condition (lint on every run), or
• Add a proper matrix strategy to the build job

---

✅ Positive Aspects

1. Action Update is Safe: The golangci-lint-action v8→v9 update itself is non-breaking
2. Automated Dependency Management: Using Renovate bot for dependency updates is a good practice
3. Minimal Change Scope: The PR is appropriately focused on a single dependency update

---

🔍 Testing Recommendations

Before merging, please:

1. Test locally with the updated action version
2. Update golangci-lint version to latest and run locally:

   golangci-lint run

3. Fix deprecation warnings from the configuration file
4. Verify the linting step actually runs in CI (currently it appears to be skipped)

---

📝 Suggested Action Plan

1. Merge this PR (the action update itself is fine)
2. Immediately follow up with:
   • Update version: v1.41 to version: latest or version: v1.61.0
   • Fix .golangci.yml to remove deprecated linters
   • Fix or remove the if: matrix.lint condition
3. Monitor the next CI run to ensure linting actually executes and passes

---

Security Considerations

Using such an outdated linting version (v1.41 from 2021) means you're missing 3+ years of security-focused linter improvements. The gosec linter has had numerous enhancements since then for detecting security vulnerabilities in Go code.

---

Verdict

✅ Approve with strong recommendation for immediate follow-up work

The action version update itself is fine, but the underlying golangci-lint version issue needs urgent attention. This PR can be merged, but should be immediately followed by a PR to update the actual linter version and configuration.

[claude]

Code Review: chore(deps): update golangci/golangci-lint-action action to v9

Summary

This PR updates the golangci-lint-action from v8 to v9 in the build workflow.

---

✅ Strengths

1. Keeping Tooling Current: Updating linter actions ensures access to latest features and bug fixes.

2. Minimal Change: Single-line change reduces risk of issues.

3. Automated Management: Renovate bot handles dependency tracking systematically.

---

🔍 Review Findings

1. Major Version Upgrade: v8 → v9 is a major version bump. Key changes typically include:

   • Updated to Node.js 20 runtime
   • Potential improvements to caching
   • Bug fixes and new features

2. Outdated golangci-lint Version: The workflow pins golangci-lint to v1.41 (line 26), which is significantly outdated. Current stable version is v1.62+.

   • v1.41 was released in 2021
   • Missing 3+ years of linter improvements, bug fixes, and new linters
   • May have compatibility issues with Go 1.25.5 (line 32)

3. Compatibility Check: The action version (v9) and golangci-lint version (v1.41) are independent. The action v9 should support running v1.41, but this is not optimal.

---

⚠️ Critical Issue Found

Outdated golangci-lint version (v1.41) - This is a separate issue from the PR but impacts code quality:

# Current (problematic):
with:
  version: v1.41  # Released 2021, very outdated

# Recommended:
with:
  version: latest  # Or pin to v1.62+ for stability

---

🔒 Security Considerations

• ✅ Updating action to v9 provides latest security patches
• ⚠️ Using outdated golangci-lint v1.41 means missing security-related linters and checks
• Recommendation: Update golangci-lint version separately

---

⚡ Performance Considerations

• ✅ v9 action may have better caching and performance
• ⚠️ Old golangci-lint version may not leverage modern Go toolchain optimizations

---

📋 Recommendations

For THIS PR (v9 action update):

1. ✅ Approve - The action update itself is fine
2. ✅ Verify linting passes with v9 action

For FOLLOW-UP (separate PR or issue):

1. 🔴 IMPORTANT: Update golangci-lint version from v1.41 to latest (v1.62+)

   - name: Linting
     uses: golangci/golangci-lint-action@v9
     with:
       version: latest  # or v1.62

2. Review and update .golangci.yml configuration for compatibility with newer version

3. Address any new linting issues that appear with updated linters

---

🧪 Testing Recommendations

1. ✅ Verify linting job passes with v9 action
2. ⚠️ Check for deprecation warnings
3. 🔴 After golangci-lint version update: Run full linting locally before merge

---

✅ Overall Assessment

The action update (v8 → v9) is straightforward and safe, but it revealed a critical technical debt issue.

Recommendation for THIS PR: ✅ Approve

• Action update is safe and necessary
• No breaking changes expected
• CI passing is sufficient validation

Recommendation for FOLLOW-UP: 🔴 High Priority

• Create issue or PR to update golangci-lint from v1.41 → latest
• This is 3+ years of missed improvements and security checks
• May reveal code quality issues that should be addressed

Code Quality: 8/10 (action update is good, but config has issues)
Priority: Low (for this PR), High (for golangci-lint version update)
Approval: ✅ LGTM for action update, but please update golangci-lint version separately