From bb5179c1b428fbff690edae7efe5b7aeccb25c16 Mon Sep 17 00:00:00 2001 From: Andy Grunwald Date: Fri, 16 Oct 2026 08:27:31 +0200 Subject: [PATCH 1/4] Test against Go stable and oldstable The CI matrix pinned explicit Go versions that had to be bumped by hand and regularly fell behind the Go release policy. setup-go's `stable` and `oldstable` aliases always resolve to the current and previous Go release (today 1.27.x and 1.26.x), so CI keeps testing both supported versions without manual or Renovate-driven bumps. Patch releases are picked up automatically too. go.mod is left untouched on purpose: it states the minimum version we require from users, not the versions CI tests against. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/testing.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml index e46635a..1efd23d 100644 --- a/.github/workflows/testing.yml +++ b/.github/workflows/testing.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-22.04 strategy: matrix: - go: [ '1.20', '1.19' ] + go: [stable, oldstable] steps: - uses: actions/checkout@v6 @@ -32,7 +32,7 @@ jobs: runs-on: ubuntu-22.04 strategy: matrix: - go: [ '1.20', '1.19' ] + go: [stable, oldstable] steps: - uses: actions/checkout@v6 @@ -48,7 +48,7 @@ jobs: runs-on: ubuntu-22.04 strategy: matrix: - go: [ '1.20', '1.19' ] + go: [stable, oldstable] steps: - uses: actions/checkout@v6 @@ -68,7 +68,7 @@ jobs: runs-on: ubuntu-22.04 strategy: matrix: - go: [ '1.20', '1.19' ] + go: [stable, oldstable] # See https://docs.github.com/en/actions/using-containerized-services/creating-redis-service-containers services: From 90220a8f44cd9ab6d5e176e23713313ec255c0c8 Mon Sep 17 00:00:00 2001 From: Andy Grunwald Date: Fri, 16 Oct 2026 08:29:49 +0200 Subject: [PATCH 2/4] Upgrade staticcheck to 2026.2.2 2026.2 is the first staticcheck release that supports Go 1.27; older releases abort on a Go 1.27 toolchain. 2026.2.2 is the latest patch release. The Makefile now installs exactly the version CI runs, via a single STATICCHECK_VERSION variable. Before, `make staticcheck` ran an unpinned `go get -u` (which no longer installs binaries), `@latest`, or a stale pin, so local results could differ from CI. Both pins carry a `# renovate:` annotation so Renovate can bump them together. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/testing.yml | 3 ++- Makefile | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml index 1efd23d..cc66503 100644 --- a/.github/workflows/testing.yml +++ b/.github/workflows/testing.yml @@ -59,7 +59,8 @@ jobs: - name: Run staticcheck uses: dominikh/staticcheck-action@v1.4.0 with: - version: "2023.1.3" + # renovate: datasource=github-releases depName=dominikh/go-tools + version: "2026.2.2" install-go: false cache-key: ${{ matrix.go }} diff --git a/Makefile b/Makefile index 902ffc1..f631d4a 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,8 @@ .DEFAULT_GOAL := help +# renovate: datasource=github-releases depName=dominikh/go-tools +STATICCHECK_VERSION := 2026.2.2 + .PHONY: help help: ## Outputs the help. @grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' @@ -18,7 +21,7 @@ fmt: ## Runs go fmt (to check for go coding guidelines). .PHONY: staticcheck staticcheck: ## Runs static analysis to prevend bugs, foster code simplicity, performance and editor integration. - go get -u honnef.co/go/tools/cmd/staticcheck + go install honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION) staticcheck ./... .PHONY: all From 92446ada0cbf7d21513f9e5698edc869b2bfdbd7 Mon Sep 17 00:00:00 2001 From: Andy Grunwald Date: Fri, 16 Oct 2026 08:29:55 +0200 Subject: [PATCH 3/4] Remove Dependabot in favor of Renovate Renovate becomes the single source of dependency updates. Running both bots produces duplicate pull requests for the same update (one from each bot), which have to be reviewed and closed twice. Renovate covers everything Dependabot was configured for here and also updates version pins Dependabot cannot see, like the staticcheck release in the workflow and Makefile. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index d433f2d..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,14 +0,0 @@ -# Please see the documentation for all configuration options: -# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates - -version: 2 -updates: - - package-ecosystem: "gomod" - directory: "/" - schedule: - interval: "monthly" - - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "monthly" From d4a5f2cccd2b75eafb9b02b0bda46f716cc53a8b Mon Sep 17 00:00:00 2001 From: Andy Grunwald Date: Fri, 16 Oct 2026 08:31:54 +0200 Subject: [PATCH 4/4] Configure Renovate to keep dependencies and staticcheck up to date This repository had no Renovate configuration. Dependabot, removed in the previous commit, never updated the staticcheck release passed to dominikh/staticcheck-action or installed by the Makefile, so it only ever moved by hand and fell behind. Two regex custom managers read the annotated pins in the workflows and the Makefile. Both use depName dominikh/go-tools, so Renovate treats them as one dependency and bumps CI and the Makefile in the same pull request; local runs cannot drift from CI. Releases are looked up in dominikh/go-tools; the `regex:` versioning admits stable CalVer tags (2026.2.2) and skips release candidates and the stray v0.3.3 tag. The base config matches go-gerrit: config:best-practices, a weekly Monday schedule (Europe/Berlin), grouped GitHub Actions updates, semanticCommits disabled, and gomodTidy after Go module updates. Go itself needs no rule: CI uses setup-go's stable/oldstable aliases. Co-Authored-By: Claude Opus 5.5 --- renovate.json | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 renovate.json diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..4402ed4 --- /dev/null +++ b/renovate.json @@ -0,0 +1,46 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:best-practices" + ], + "timezone": "Europe/Berlin", + "schedule": [ + "* 0-4 * * 1" + ], + "semanticCommits": "disabled", + "postUpdateOptions": [ + "gomodTidy" + ], + "customManagers": [ + { + "customType": "regex", + "description": "Update the staticcheck release passed to dominikh/staticcheck-action, which the github-actions manager does not read", + "managerFilePatterns": [ + "/^\\.github/workflows/.+\\.ya?ml$/" + ], + "matchStrings": [ + "# renovate: datasource=(?[a-z-]+?) depName=(?[^\\s]+?)\\s+version: \"(?[^\"]+)\"" + ], + "versioningTemplate": "regex:^(?\\d+)\\.(?\\d+)(\\.(?\\d+))?$" + }, + { + "customType": "regex", + "description": "Update the staticcheck release installed by the Makefile, so local runs always match CI", + "managerFilePatterns": [ + "/^Makefile$/" + ], + "matchStrings": [ + "# renovate: datasource=(?[a-z-]+?) depName=(?[^\\s]+?)\\s+STATICCHECK_VERSION := (?\\S+)" + ], + "versioningTemplate": "regex:^(?\\d+)\\.(?\\d+)(\\.(?\\d+))?$" + } + ], + "packageRules": [ + { + "description": "Batch routine GitHub Actions updates into one weekly pull request, but keep major bumps separate because they usually need workflow changes", + "matchManagers": ["github-actions"], + "matchUpdateTypes": ["minor", "patch", "digest", "pin"], + "groupName": "GitHub Actions" + } + ] +}