fix: Pin golangci-lint to commit with -c flag fix for Git v2.52+

[osterman]

what

• Pin golangci-lint to commit 101ccaca which fixes the -c advice.detachedHead=false bug
• Remove git wrapper workaround (~80 lines of hacky code)
• Clean, simple build step for custom golangci-lint with lintroller plugin
• Pin AWS provider to v5.x for LocalStack compatibility

why

golangci-lint fix

The golangci-lint custom command was failing with exit status 128 on CI runners using Git v2.52+.

Root cause: golangci-lint passes "-c advice.detachedHead=false" as a single argument, but Git v2.52+ became stricter and rejects this (expects two separate arguments: "-c" and "advice.detachedHead=false").

Fix: PR #6206 was merged Nov 19, 2025 but not yet released. We pin to the fix commit until v2.6.3+ is released.

LocalStack fix

The LocalStack CI job was failing with MalformedXML error when creating S3 buckets.

Root cause: AWS Terraform provider v6.x has breaking changes in S3 bucket creation that LocalStack 1.4.0 does not support. The providers.tf had no version constraints, so Terraform installed v6.23.0.

Fix: Pin AWS provider to ~> 5.0 in examples/demo-localstack/components/terraform/bucket/providers.tf.

references

• golangci-lint fix PR: fix: clone args used by custom command golangci/golangci-lint#6206
• Related issue: invalid key: advice.detachedHead golangci/golangci-lint#6205

[mergify]

Important

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

None

[coderabbitai]

Caution

Review failed

The head commit changed during the review from 8321543 to 7369a5a.

📝 Walkthrough

Walkthrough

Introduces a git-wrapper workaround in .github/workflows/codeql.yml for the "Build custom golangci-lint with lintroller plugin" step: creates a wrapper script that logs args, strips -c flags, delegates to the real /usr/bin/git, and runs tests; the same block is duplicated in two locations.

Changes

Cohort / File(s)	Summary
Git-wrapper added to CodeQL workflow \.github/workflows/codeql\.yml	Added steps that build/install a git wrapper: back up /usr/bin/git, create a wrapper script that logs original args, strips -c flags and their values, delegates to the real git binary, and restores/tests the wrapper. The pre-configuration block is duplicated in two occurrences of the same build step.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant CI as GitHub Actions Runner
  participant FS as /usr/bin
  participant Build as golangci-lint build step
  Note over CI,Build: Pre-build: install git-wrapper
  CI->>FS: mv /usr/bin/git -> /usr/bin/git.real (backup)
  CI->>FS: write /usr/bin/git (wrapper script)
  Note over FS: wrapper: log args -> strip `-c` flags -> exec /usr/bin/git.real
  CI->>Build: run "Build custom golangci-lint" (invokes `git`)
  Build->>FS: call /usr/bin/git (wrapper)
  FS->>FS: wrapper strips `-c` args, forwards to /usr/bin/git.real
  FS->>Build: git responds
  Note over CI,Build: Post-build: optional restore/validation of original git

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• Attention areas:
  • Verify wrapper correctly strips -c flags in all git invocation patterns (short/combined args).
  • Confirm atomicity and permission safety when moving /usr/bin/git and writing the wrapper in the runner environment.
  • Confirm duplication across the two workflow locations is intentional and consistent.

Possibly related PRs

• fix: isolate golangci-lint custom build to prevent git corruption #1666 — Also targets preventing git corruption when building custom golangci-lint; uses an isolation/hook approach.
• Use official golangci action together with CodeQL #1137 — Adjusts golangci-lint-related steps in the CodeQL workflow; likely touches the same build area.

Suggested labels

patch

Suggested reviewers

• aknysh

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately reflects the main changes: updating golangci-lint to v2.6.2 and addressing rate limiting issues via GITHUB_TOKEN.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.97%. Comparing base (8f1fe66) to head (7369a5a).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1815      +/-   ##
==========================================
- Coverage   71.98%   71.97%   -0.02%     
==========================================
  Files         471      471              
  Lines       45222    45222              
==========================================
- Hits        32554    32549       -5     
- Misses      10070    10078       +8     
+ Partials     2598     2595       -3     

Flag	Coverage Δ
unittests	71.97% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mergify]

This pull request was automatically closed as it no longer contains any changes.

This typically happens when another merged pull request has already included this request's
proposed modifications into the default branch.

[mergify]

Important

Cloud Posse Engineering Team Review Required

This pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes.

To expedite this process, reach out to us on Slack in the #pr-reviews channel.

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

.github/workflows/codeql.yml (1)

136-136: Consider permission and portability implications of modifying /usr/bin/git.

The wrapper uses sudo to modify the system git binary. This approach works in the CI environment but is fragile and could break if runner permissions or setup change. If the root cause (the malformed -c flag) is fixed in v2.6.2, this complexity can be removed entirely.

Also applies to: 165-165

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 651e7f8 and a774560.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

.github/workflows/*.{yml,yaml}

📄 CodeRabbit inference engine (.cursor/rules/atmos-rules.mdc)

Configure CI to run unit tests, integration tests, golangci-lint, and coverage reporting on all pull requests

Files:

• .github/workflows/codeql.yml

🧠 Learnings (7)

📓 Common learnings

Learnt from: aknysh
Repo: cloudposse/atmos PR: 944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.

Learnt from: Listener430
Repo: cloudposse/atmos PR: 934
File: tests/fixtures/scenarios/docs-generate/README.md.gotmpl:99-118
Timestamp: 2025-01-25T03:51:57.689Z
Learning: For the cloudposse/atmos repository, changes to template contents should be handled in dedicated PRs and are typically considered out of scope for PRs focused on other objectives.

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to .github/workflows/*.{yml,yaml} : Configure CI to run unit tests, integration tests, golangci-lint, and coverage reporting on all pull requests

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*.go : All code must pass golangci-lint checks

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*.go : Follow standard Go coding style: use `gofmt` and `goimports` to format code, prefer short descriptive variable names, use kebab-case for command-line flags, and snake_case for environment variables

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to .github/workflows/*.{yml,yaml} : Configure CI to run unit tests, integration tests, golangci-lint, and coverage reporting on all pull requests

Applied to files:

• .github/workflows/codeql.yml

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Applies to **/*.go : All code must pass golangci-lint checks

Applied to files:

• .github/workflows/codeql.yml

📚 Learning: 2025-03-25T12:23:42.649Z

Learnt from: Listener430
Repo: cloudposse/atmos PR: 1149
File: internal/exec/go_getter_utils.go:104-104
Timestamp: 2025-03-25T12:23:42.649Z
Learning: Listener430 plans to add a test for verifying that token injection is skipped for unsupported hosts in a future review or refactoring iteration. This relates to the CustomGitDetector.Detect method in internal/exec/go_getter_utils.go.

Applied to files:

• .github/workflows/codeql.yml

📚 Learning: 2024-11-18T13:59:10.824Z

Learnt from: aknysh
Repo: cloudposse/atmos PR: 768
File: internal/exec/vendor_model_component.go:3-20
Timestamp: 2024-11-18T13:59:10.824Z
Learning: When replacing significant dependencies like `go-getter` that require extensive changes, prefer to address them in separate PRs.

Applied to files:

• .github/workflows/codeql.yml

📚 Learning: 2024-12-02T21:26:32.337Z

Learnt from: osterman
Repo: cloudposse/atmos PR: 808
File: pkg/config/config.go:478-483
Timestamp: 2024-12-02T21:26:32.337Z
Learning: In the 'atmos' project, when reviewing Go code like `pkg/config/config.go`, avoid suggesting file size checks after downloading remote configs if such checks aren't implemented elsewhere in the codebase.

Applied to files:

• .github/workflows/codeql.yml

📚 Learning: 2025-11-24T17:35:37.209Z

Learnt from: CR
Repo: cloudposse/atmos PR: 0
File: .cursor/rules/atmos-rules.mdc:0-0
Timestamp: 2025-11-24T17:35:37.209Z
Learning: Ensure all tests pass, verify code coverage meets targets, run golangci-lint and fix any issues, and update documentation before submitting pull requests

Applied to files:

• .github/workflows/codeql.yml

⏰ Context from checks skipped due to timeout of 900000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Summary

🔇 Additional comments (3)

.github/workflows/codeql.yml (3)

124-183: Verify that GITHUB_TOKEN environment variable is configured.

Per the PR objectives, a GITHUB_TOKEN should be added to prevent GitHub API rate limit errors during the custom binary build. The git wrapper workaround (lines 127–174) addresses a symptom, but the stated fix requires setting the GITHUB_TOKEN env var. Confirm this is configured on the step or job level.

---

127-174: Git wrapper is a workaround; evaluate whether the root cause is resolved in v2.6.2.

The wrapper strips -c flags to work around a malformed git config flag issue in golangci-lint v2.5.0. Since the PR claims to update to v2.6.2, verify whether this issue is fixed upstream. If v2.6.2 resolves the -c flag problem, this entire wrapper block may be unnecessary and should be removed to keep CI logic clean.

---

110-110: I'll verify the concerns raised in this review comment by examining the workflow file and checking the actual state of the code.
<function_calls>


#!/bin/bash

First, check the file size and read the relevant sections of the codeql.yml file

wc -l .github/workflows/codeql.yml


</function_calls>

I'll now read the workflow file to verify the version strings and check for GITHUB_TOKEN:
<function_calls>


#!/bin/bash

Read the full codeql.yml file to examine version strings and GITHUB_TOKEN

cat -n .github/workflows/codeql.yml


</function_calls>

Let me search for all golangci-lint version references and GITHUB_TOKEN usage:
<function_calls>


#!/bin/bash

Search for golangci-lint version references

echo "=== golangci-lint version references ==="
rg -n "golangci-lint" .github/workflows/codeql.yml
echo ""
echo "=== GITHUB_TOKEN references ==="
rg -n "GITHUB_TOKEN" .github/workflows/codeql.yml
echo ""
echo "=== env: section ==="
rg -n -A5 "^[[:space:]]*env:" .github/workflows/codeql.yml


</function_calls>

Now let me check the PR context and look for any version-related changes or objectives:
<function_calls>


#!/bin/bash

Check recent git history for this file

echo "=== Recent commits for codeql.yml ==="
git log --oneline -10 .github/workflows/codeql.yml 2>/dev/null || echo "Git history not available"
echo ""

Check for v2.6.2 references anywhere in the repo

echo "=== All v2.6.2 references in the repo ==="
rg -n "v2.6.2" . 2>/dev/null | head -20
echo ""

Check for current golangci-lint version in use

echo "=== All golangci-lint version references ==="
rg -n "golangci-lint.*@v2." . 2>/dev/null | head -20


</function_calls>

I need to see the results of these shell commands to verify the version strings and GITHUB_TOKEN presence. Let me wait for the execution results.

I need to see the actual content to verify the issues. Let me try a more direct approach:
<function_calls>


#!/bin/bash

Extract lines around 110 and 236 to verify version strings

echo "=== Lines 100-120 (around line 110) ==="
sed -n '100,120p' .github/workflows/codeql.yml
echo ""
echo "=== Lines 225-245 (around line 236) ==="
sed -n '225,245p' .github/workflows/codeql.yml


</function_calls>