CI pinned to Go 1.22 and golangci-lint v1.56.2 blocks all Go dependency updates
@Iamrushabhshahh is already working on this.
Since Oct 15, 2026.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 18/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- docker, github-actions, go
- Domain
- build-system, ci-cd
Research direction
Start with .github/workflows/test.yaml, e2e-test.yml, release.yaml, .golangci.yml, the Dockerfile, and go.mod, then reproduce the go vet findings in pkg/server/route/route.go and pkg/engine/operation/watch.go. Work is already under way in open PR #1466, so check with the author before starting. Done means CI and the Dockerfile run on the new Go version, lint passes under golangci-lint v2, and the Dependabot PRs can merge.
Written by the indexing model from the issue text.
Description
What happened?
Five Dependabot PRs are stuck because Golang Lint and Unit tests with coverage fail on every one of them:
- #1452 go-git 5.13.0 to 5.19.2 (run https://github.com/KusionStack/kusion/actions/runs/32545277078)
- #1454 x/crypto 0.31.0 to 0.52.0 (run https://github.com/KusionStack/kusion/actions/runs/32545284802)
- #1457 grpc 1.69.0 to 1.83.1 (run https://github.com/KusionStack/kusion/actions/runs/33594898558)
- #1459 oras-go 2.5.0 to 2.6.2 (run https://github.com/KusionStack/kusion/actions/runs/35257493310)
- #1460 containerd 1.7.23 to 1.7.36 (run https://github.com/KusionStack/kusion/actions/runs/36183219532)
Several of these are security-relevant (x/crypto, grpc, containerd).
What did you expect to happen?
Dependabot PRs that raise go.mod to go 1.25.0 should pass CI and be mergeable.
Why it fails
The new dependency versions need Go 1.25, so each PR raises go.mod from go 1.22.1 to go 1.25.0. The #1451 description already pointed this out for go-git v5.19.2.
CI is pinned to Go 1.22 (actions/setup-go@v2, go-version: 1.22) and golangci-lint v1.56.2 in .github/workflows/test.yaml, e2e-test.yml and release.yaml, and the Dockerfile uses golang:1.22.
With go 1.25.0 in go.mod:
- golangci-lint v1 cannot type check the code:
Even the last v1 release, v1.64.8, refuses:could not import k8s.io/apimachinery/pkg/types (-: could not load export data: internal error in importing "k8s.io/apimachinery/pkg/types" (unsupported version: 2); please report an issue) (typecheck)the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0). go vetunder the newer toolchain reports slog calls with a missing key (pkg/server/route/route.go,pkg/server/handler/endpoint/endpoint.go) and non-constant format strings (pkg/engine/operation/watch.go,tfops/tferrors.go,models/change.go,third_party/dyff/output_human.go).- After that, test binaries fail to link on Go 1.23 and later, because mockey v1.2.10 uses a blocked
go:linkname:link: github.com/bytedance/mockey/internal/monkey/common: invalid reference to runtime.sysAllocOS
The workflows also use actions/checkout@v2/v3, actions/setup-go@v2 and golangci-lint-action@v3. The runner already warns that their Node 20 runtime is deprecated and is forced onto Node 24.
How can we reproduce it?
Open any of the PRs above and look at the Golang Lint and Unit tests with coverage jobs, or check out #1460 locally and run golangci-lint v1.56.2 or v1.64.8.
Proposed fix
- Move CI and the Dockerfile to Go 1.26 (the oldest Go release that still gets security fixes, and at least the 1.25 the dependencies need).
- Move to golangci-lint v2 and migrate
.golangci.yml, keeping the current rule set. - Fix the vet and lint findings, which are small and mechanical.
- Bump mockey to v1.4.6.
- Update the GitHub actions to their current majors.
I have a branch ready that does this and passes lint and unit tests on my fork, both on its own and with #1460 applied on top. I am happy to open the PR.
@ruquanzhao, you merged #1451, which first noted the Go 1.25 requirement. Would this approach work for you?
Kusion version
main at 7524b14
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 110
- Avg merge
- 10h 43m
- Merged PRs (30d)
- 1
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from KusionStack/kusion
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
KusionStack/kusion#1450 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 30/100
KusionStack/kusion#1467 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
KusionStack/kusion#1448 ·
-
Feat: AI-coding/vibe-coding support for writing Kusion modulesMay be free again @ruquanzhao claimed this 466 days ago, and no pull request is open. Openkind/feature
KusionStack/kusion#1436 · 1 reaction · 1 assignee ·
-
kind/feature
Difficulty 5/5 Over a week Newbie friendliness 25/100
KusionStack/kusion#1431 ·
All issues in KusionStack/kusion
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 81/100
apache/rocketmq-dashboard#6895 ·
Maintainers usually reply within 3 days
-
Difficulty 1/5 Under an hour Newbie friendliness 87/100
777genius/agent-notifications#490 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
devantler-tech/ksail#7836 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
keyxmakerx/Chronicle#1469 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
Maintainers usually reply within 1 day