Repository navigation
Test against Go stable/oldstable, upgrade staticcheck to 2026.2.2, let Renovate keep it current - #76
Merged
andygrunwald merged 4 commits intoOct 16, 2026
Conversation
The CI matrix pinned explicit Go versions that had to be bumped by hand and regularly fell behind the Go release policy. setup-go's `stable` and `oldstable` aliases always resolve to the current and previous Go release (today 1.27.x and 1.26.x), so CI keeps testing both supported versions without manual or Renovate-driven bumps. Patch releases are picked up automatically too. go.mod is left untouched on purpose: it states the minimum version we require from users, not the versions CI tests against. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026.2 is the first staticcheck release that supports Go 1.27; older releases abort on a Go 1.27 toolchain. 2026.2.2 is the latest patch release. The Makefile now installs exactly the version CI runs, via a single STATICCHECK_VERSION variable. Before, `make staticcheck` ran an unpinned `go get -u` (which no longer installs binaries), `@latest`, or a stale pin, so local results could differ from CI. Both pins carry a `# renovate:` annotation so Renovate can bump them together. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Renovate becomes the single source of dependency updates. Running both bots produces duplicate pull requests for the same update (one from each bot), which have to be reviewed and closed twice. Renovate covers everything Dependabot was configured for here and also updates version pins Dependabot cannot see, like the staticcheck release in the workflow and Makefile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This repository had no Renovate configuration. Dependabot, removed in the previous commit, never updated the staticcheck release passed to dominikh/staticcheck-action or installed by the Makefile, so it only ever moved by hand and fell behind. Two regex custom managers read the annotated pins in the workflows and the Makefile. Both use depName dominikh/go-tools, so Renovate treats them as one dependency and bumps CI and the Makefile in the same pull request; local runs cannot drift from CI. Releases are looked up in dominikh/go-tools; the `regex:` versioning admits stable CalVer tags (2026.2.2) and skips release candidates and the stray v0.3.3 tag. The base config matches go-gerrit: config:best-practices, a weekly Monday schedule (Europe/Berlin), grouped GitHub Actions updates, semanticCommits disabled, and gomodTidy after Go module updates. Go itself needs no rule: CI uses setup-go's stable/oldstable aliases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
andygrunwald
deleted the
andygrunwald/go-stable-staticcheck-2026.2.2-renovate
branch
October 16, 2026 07:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CI should test against Go 1.27, and staticcheck must move with it: releases before 2026.2 abort on a Go 1.27 toolchain. Both should stay current without manual bumps, and
make staticcheckshould run exactly the staticcheck version CI runs.What
[ '1.20', '1.19' ]becomes[stable, oldstable], today 1.27.x and 1.26.x. go.mod is left untouched; it states the minimum Go version, not what CI tests.STATICCHECK_VERSION) instead ofgo get -u honnef.co/go/tools/cmd/staticcheck.renovate.json, the same config as go-gerrit (config:best-practices, Monday schedule, grouped GitHub Actions updates,gomodTidy), plus two regex managers for the staticcheck pins in the workflow and the Makefile. Both managers usedepName dominikh/go-tools, so one Renovate PR bumps both pins.Go in CI needs no Renovate rule: setup-go's aliases follow every Go release automatically.
Verification
make vet,make testandmake staticcheckpass with go1.27.2 and go1.26.9. The Redis tests ran against a temporaryredis:7container.renovate-config-validator --strict(Renovate 44.164.7) passes.renovate --platform=local --dry-run=lookupdetectsdominikh/go-toolsat2026.2.2in every annotated pin. On a scratch copy of go-gerrit with both pins reverted to 2026.2.1, it proposes 2026.2.2 for the workflow and the Makefile on the same branch (renovate/dominikh-go-tools-2026.x), so a single PR updates both.🤖 Generated with Claude Code