Skip to content

Fix broken golangci-lint installation in go feature#1632

Open
max06 wants to merge 2 commits intodevcontainers:mainfrom
max06:fix-golangci-lint
Open

Fix broken golangci-lint installation in go feature#1632
max06 wants to merge 2 commits intodevcontainers:mainfrom
max06:fix-golangci-lint

Conversation

@max06
Copy link
Copy Markdown
Contributor

@max06 max06 commented May 2, 2026

Currently using the go-feature in devcontainers without specifying an older version to install breaks building devcontainers.

After investigating, 2 reasons were identified for breaking:

  • golangci-lint now releases sbom-files with their binary releases. The install-script now finds 2 hashes matching the filename, which was corrected by the maintainers yesterday (and released today, 3 hours ago in fix: install.sh script golangci/golangci-lint#6539).
  • The golangci-lint project switched their primary branch from master to main, date irrelevant. Their fix for the first issue was properly merged into main, but the installation script for this container-feature was never updated, still pointing to master - missing the fix.

This should be merged quickly.

Potential workaround: Using v2.11.4 as version for golangci-lint should work since sbom-files were added in v2.12 for the first time.

@max06 max06 requested a review from a team as a code owner May 2, 2026 14:38
Copy link
Copy Markdown

@ldez ldez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We (golangci-lint maintainers) recommend using https://golangci-lint.run/install.sh instead of an URL based of a branch.

https://golangci-lint.run/docs/welcome/install/local/#binaries

This is for several reasons:

  • GitHub applies new rate limits
  • Referencing a branch can be brittle

Comment thread src/go/install.sh Outdated
Comment thread src/go/install.sh Outdated
Use official url for the install-script

Co-authored-by: Ludovic Fernandez <ldez@users.noreply.github.com>
@rjchien728
Copy link
Copy Markdown

Confirming this hits us on linux/arm64 via ghcr.io/devcontainers/features/go with golangciLintVersion: latest (resolves to v2.12.1). Same hash_sha256_verify failure caused by the SBOM line in checksums.txt being matched alongside the tarball.
I tested the workaround curl -sSfL https://golangci-lint.run/install.sh | sh directly in our devcontainer — it works and produces the correct binary. So this PR's approach LGTM from a downstream user's perspective.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants