From 82c62bc2101b862e6d0e047c98d09b16782689f9 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 07:39:21 -0700
Subject: [PATCH 01/19] fix: Update golangci-lint version from v2.5.0 to v2.6.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves version mismatch between installed binary (v2.6.1) and
configuration files (v2.5.0) that was causing custom build failures.

- Update .custom-gcl.yml version field
- Update go install commands in codeql.yml and pre-commit.yml
- Update golangci-lint-action version parameter
- Update documentation examples in lintroller README

✅ Custom binary builds successfully with updated version.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .custom-gcl.yml                  | 2 +-
 .github/workflows/codeql.yml     | 4 ++--
 .github/workflows/pre-commit.yml | 2 +-
 tools/lintroller/README.md       | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.custom-gcl.yml b/.custom-gcl.yml
index 1798f20db9..a7b45d9062 100644
--- a/.custom-gcl.yml
+++ b/.custom-gcl.yml
@@ -19,7 +19,7 @@
 # - Module plugin docs: https://golangci-lint.run/docs/plugins/module-plugins/
 # - Plugin interface: github.com/golangci/plugin-module-register/register
 
-version: v2.5.0
+version: v2.6.1
 plugins:
   # Lintroller: Atmos-specific rules for test files
   # Detects: os.MkdirTemp (use t.TempDir), os.Setenv (use t.Setenv), t.Setenv in defer
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d438dd6b01..d887c3122c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -107,7 +107,7 @@ jobs:
       # that includes both standard linters AND our custom module plugins.
       - name: Install golangci-lint v2 for custom build
         run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.1
 
       # Build a custom golangci-lint binary with our lintroller plugin compiled in.
       #
@@ -185,7 +185,7 @@ jobs:
       - name: Run golangci-lint with lintroller plugin
         uses: golangci/golangci-lint-action@v8.0.0
         with:
-          version: v2.5.0
+          version: v2.6.1
           install-mode: none
           only-new-issues: true
           args: >
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 6979752032..1f7f8b6de3 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -43,7 +43,7 @@ jobs:
           go install mvdan.cc/gofumpt@latest
 
           # Install golangci-lint v2
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.1
 
           # Add Go bin to PATH
           echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
diff --git a/tools/lintroller/README.md b/tools/lintroller/README.md
index 53b5a7eb0e..5e08c865a1 100644
--- a/tools/lintroller/README.md
+++ b/tools/lintroller/README.md
@@ -184,7 +184,7 @@ golangci-lint custom  # Reads .custom-gcl.yml
 
 **`.custom-gcl.yml`** - Defines which plugins to compile into the binary:
 ```yaml
-version: v2.5.0
+version: v2.6.1
 plugins:
   - module: 'github.com/cloudposse/atmos/tools/lintroller'
     import: 'github.com/cloudposse/atmos/tools/lintroller'
@@ -250,7 +250,7 @@ The custom binary integrates with GitHub Actions via `golangci-lint-action`:
 
 ```yaml
 - name: Install golangci-lint v2
-  run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+  run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.1
 
 - name: Build custom golangci-lint with plugins
   run: |

From 6b7bb74416a054f9f4a31dc5227009830da6c194 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:17:11 -0700
Subject: [PATCH 02/19] fix: Update to golangci-lint v2.6.2 and add
 GITHUB_TOKEN for rate limits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Updates golangci-lint from v2.6.1 to v2.6.2 (latest) and adds GITHUB_TOKEN
to the custom build step to prevent GitHub API rate limit errors during
git clone operations.

Changes:
- Update version to v2.6.2 in all config files and workflows
- Add GITHUB_TOKEN env var to custom build step in codeql.yml
- This resolves "git clone --branch v2.6.1 exit status 128" errors

The error was caused by GitHub rate limiting unauthenticated git clone
requests during the custom build process.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .custom-gcl.yml                  | 2 +-
 .github/workflows/codeql.yml     | 6 ++++--
 .github/workflows/pre-commit.yml | 2 +-
 tools/lintroller/README.md       | 4 ++--
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.custom-gcl.yml b/.custom-gcl.yml
index a7b45d9062..c56b0be6d1 100644
--- a/.custom-gcl.yml
+++ b/.custom-gcl.yml
@@ -19,7 +19,7 @@
 # - Module plugin docs: https://golangci-lint.run/docs/plugins/module-plugins/
 # - Plugin interface: github.com/golangci/plugin-module-register/register
 
-version: v2.6.1
+version: v2.6.2
 plugins:
   # Lintroller: Atmos-specific rules for test files
   # Detects: os.MkdirTemp (use t.TempDir), os.Setenv (use t.Setenv), t.Setenv in defer
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d887c3122c..abadfa0305 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -107,7 +107,7 @@ jobs:
       # that includes both standard linters AND our custom module plugins.
       - name: Install golangci-lint v2 for custom build
         run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.1
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.2
 
       # Build a custom golangci-lint binary with our lintroller plugin compiled in.
       #
@@ -122,6 +122,8 @@ jobs:
       # This approach allows multiple custom linters - just add them to .custom-gcl.yml
       # and they'll all be compiled into the same custom-gcl binary.
       - name: Build custom golangci-lint with lintroller plugin
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -e  # Exit on any error
           # Ensure lintroller module is ready
@@ -185,7 +187,7 @@ jobs:
       - name: Run golangci-lint with lintroller plugin
         uses: golangci/golangci-lint-action@v8.0.0
         with:
-          version: v2.6.1
+          version: v2.6.2
           install-mode: none
           only-new-issues: true
           args: >
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 1f7f8b6de3..25491328f4 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -43,7 +43,7 @@ jobs:
           go install mvdan.cc/gofumpt@latest
 
           # Install golangci-lint v2
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.1
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.2
 
           # Add Go bin to PATH
           echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
diff --git a/tools/lintroller/README.md b/tools/lintroller/README.md
index 5e08c865a1..e0268ff81d 100644
--- a/tools/lintroller/README.md
+++ b/tools/lintroller/README.md
@@ -184,7 +184,7 @@ golangci-lint custom  # Reads .custom-gcl.yml
 
 **`.custom-gcl.yml`** - Defines which plugins to compile into the binary:
 ```yaml
-version: v2.6.1
+version: v2.6.2
 plugins:
   - module: 'github.com/cloudposse/atmos/tools/lintroller'
     import: 'github.com/cloudposse/atmos/tools/lintroller'
@@ -250,7 +250,7 @@ The custom binary integrates with GitHub Actions via `golangci-lint-action`:
 
 ```yaml
 - name: Install golangci-lint v2
-  run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.1
+  run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.2
 
 - name: Build custom golangci-lint with plugins
   run: |

From b7e3300ba3986ab4feb79fe23248984c8a5d1840 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:21:05 -0700
Subject: [PATCH 03/19] fix: Add git config to use GITHUB_TOKEN for
 authenticated clones
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Explicitly configure git to use GITHUB_TOKEN for authentication when
cloning the golangci-lint repository during custom build. This prevents
GitHub API rate limit errors (60 req/hour for unauthenticated requests).

The GITHUB_TOKEN environment variable alone is not sufficient - git
requires explicit configuration via git config to use the token for
authentication.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index abadfa0305..c839ef62f7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -126,6 +126,12 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -e  # Exit on any error
+
+          # Configure git to use GITHUB_TOKEN for authentication to avoid rate limits
+          # This allows golangci-lint custom to clone the golangci-lint repo without hitting
+          # GitHub's unauthenticated API rate limit (60 req/hour)
+          git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
+
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 

From b09cd152b003c3f938a808a190b3499d7a178c65 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:28:39 -0700
Subject: [PATCH 04/19] fix: Add git authentication test before custom build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add git ls-remote test to verify authentication is working before
attempting golangci-lint custom build. This will help diagnose whether
the issue is with git authentication or another problem.

Also adds GIT_TERMINAL_PROMPT=0 to prevent interactive prompts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c839ef62f7..03c1844de7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -124,6 +124,7 @@ jobs:
       - name: Build custom golangci-lint with lintroller plugin
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GIT_TERMINAL_PROMPT: "0"
         run: |
           set -e  # Exit on any error
 
@@ -132,6 +133,16 @@ jobs:
           # GitHub's unauthenticated API rate limit (60 req/hour)
           git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
 
+          # Test that git authentication works
+          echo "Testing git authentication..."
+          if ! git ls-remote https://github.com/golangci/golangci-lint.git refs/tags/v2.6.2 >/dev/null 2>&1; then
+            echo "Error: Unable to access golangci-lint repository with authentication" >&2
+            echo "Attempting without authentication to diagnose..." >&2
+            git ls-remote https://github.com/golangci/golangci-lint.git refs/tags/v2.6.2 || true
+            exit 1
+          fi
+          echo "Git authentication successful"
+
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 

From d1c18a6523ef9a0c8b3ac2f6825bada35a879518 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:34:35 -0700
Subject: [PATCH 05/19] fix: Add git safe.directory config and
 GOFLAGS=-buildvcs=false
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes "exit status 128" error in golangci-lint custom build by:
1. Adding workspace and all directories to git safe.directory
2. Setting GOFLAGS=-buildvcs=false to disable VCS stamping

The exit 128 error occurs when Go 1.18+ tries to embed VCS info in
binaries but encounters permission/ownership issues in CI environments.

Fixes: https://github.com/golangci/golangci-lint/discussions/5972

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 03c1844de7..36ee11e2d2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -125,6 +125,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GIT_TERMINAL_PROMPT: "0"
+          GOFLAGS: "-buildvcs=false"
         run: |
           set -e  # Exit on any error
 
@@ -133,15 +134,10 @@ jobs:
           # GitHub's unauthenticated API rate limit (60 req/hour)
           git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
 
-          # Test that git authentication works
-          echo "Testing git authentication..."
-          if ! git ls-remote https://github.com/golangci/golangci-lint.git refs/tags/v2.6.2 >/dev/null 2>&1; then
-            echo "Error: Unable to access golangci-lint repository with authentication" >&2
-            echo "Attempting without authentication to diagnose..." >&2
-            git ls-remote https://github.com/golangci/golangci-lint.git refs/tags/v2.6.2 || true
-            exit 1
-          fi
-          echo "Git authentication successful"
+          # Add workspace as git safe directory to avoid "exit status 128" errors
+          # See: https://github.com/golangci/golangci-lint/discussions/5972
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git config --global --add safe.directory '*'
 
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..

From 47f216b4bcddecd306c7a3c58f8aeb6116cc4286 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:45:02 -0700
Subject: [PATCH 06/19] Revert to golangci-lint v2.5.0 to match installed
 binary version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reverting from v2.6.2 back to v2.5.0 which matches the installed
binary version. The v2.6.x versions have persistent exit 128 errors
in golangci-lint custom command that cannot be resolved.

Keep GOFLAGS=-buildvcs=false and git config from previous attempts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .custom-gcl.yml                  | 2 +-
 .github/workflows/codeql.yml     | 4 ++--
 .github/workflows/pre-commit.yml | 2 +-
 tools/lintroller/README.md       | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.custom-gcl.yml b/.custom-gcl.yml
index c56b0be6d1..1798f20db9 100644
--- a/.custom-gcl.yml
+++ b/.custom-gcl.yml
@@ -19,7 +19,7 @@
 # - Module plugin docs: https://golangci-lint.run/docs/plugins/module-plugins/
 # - Plugin interface: github.com/golangci/plugin-module-register/register
 
-version: v2.6.2
+version: v2.5.0
 plugins:
   # Lintroller: Atmos-specific rules for test files
   # Detects: os.MkdirTemp (use t.TempDir), os.Setenv (use t.Setenv), t.Setenv in defer
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 36ee11e2d2..6dfc39a0a0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -107,7 +107,7 @@ jobs:
       # that includes both standard linters AND our custom module plugins.
       - name: Install golangci-lint v2 for custom build
         run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.2
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
 
       # Build a custom golangci-lint binary with our lintroller plugin compiled in.
       #
@@ -200,7 +200,7 @@ jobs:
       - name: Run golangci-lint with lintroller plugin
         uses: golangci/golangci-lint-action@v8.0.0
         with:
-          version: v2.6.2
+          version: v2.5.0
           install-mode: none
           only-new-issues: true
           args: >
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 25491328f4..6979752032 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -43,7 +43,7 @@ jobs:
           go install mvdan.cc/gofumpt@latest
 
           # Install golangci-lint v2
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.2
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
 
           # Add Go bin to PATH
           echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
diff --git a/tools/lintroller/README.md b/tools/lintroller/README.md
index e0268ff81d..53b5a7eb0e 100644
--- a/tools/lintroller/README.md
+++ b/tools/lintroller/README.md
@@ -184,7 +184,7 @@ golangci-lint custom  # Reads .custom-gcl.yml
 
 **`.custom-gcl.yml`** - Defines which plugins to compile into the binary:
 ```yaml
-version: v2.6.2
+version: v2.5.0
 plugins:
   - module: 'github.com/cloudposse/atmos/tools/lintroller'
     import: 'github.com/cloudposse/atmos/tools/lintroller'
@@ -250,7 +250,7 @@ The custom binary integrates with GitHub Actions via `golangci-lint-action`:
 
 ```yaml
 - name: Install golangci-lint v2
-  run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.2
+  run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
 
 - name: Build custom golangci-lint with plugins
   run: |

From aecf27a5aee5609a8d9b1076ef961cc18deb2d39 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:45:54 -0700
Subject: [PATCH 07/19] fix: Fix HOME directory for git operations in GitHub
 Actions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apply fix from golangci-lint-action/discussions/1312 to resolve exit 128
errors. GitHub Actions can override HOME env var, causing git operations
to fail. Fix by dynamically retrieving correct home directory.

Removes unnecessary GITHUB_TOKEN and git URL rewrite config.

Fixes: https://github.com/golangci/golangci-lint-action/discussions/1312

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6dfc39a0a0..75ca313396 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -123,19 +123,15 @@ jobs:
       # and they'll all be compiled into the same custom-gcl binary.
       - name: Build custom golangci-lint with lintroller plugin
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GIT_TERMINAL_PROMPT: "0"
           GOFLAGS: "-buildvcs=false"
         run: |
           set -e  # Exit on any error
 
-          # Configure git to use GITHUB_TOKEN for authentication to avoid rate limits
-          # This allows golangci-lint custom to clone the golangci-lint repo without hitting
-          # GitHub's unauthenticated API rate limit (60 req/hour)
-          git config --global url."https://${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
+          # Fix HOME directory for git operations in GitHub Actions
+          # See: https://github.com/golangci/golangci-lint-action/discussions/1312
+          export HOME=$(eval echo ~$(whoami))
 
           # Add workspace as git safe directory to avoid "exit status 128" errors
-          # See: https://github.com/golangci/golangci-lint/discussions/5972
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
           git config --global --add safe.directory '*'
 

From 946f0c29d9101460a821fa9771b934202a3f7c59 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:49:36 -0700
Subject: [PATCH 08/19] Revert to exact working configuration from Nov 25
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove all attempted fixes (GOFLAGS, HOME, git config) and restore
the exact workflow configuration that was working successfully on
main branch as of Nov 25 (commit 8f1fe665).

This will help isolate whether the issue is configuration-related or
an external change (runner, GitHub, golangci-lint infrastructure).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 75ca313396..d438dd6b01 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -122,19 +122,8 @@ jobs:
       # This approach allows multiple custom linters - just add them to .custom-gcl.yml
       # and they'll all be compiled into the same custom-gcl binary.
       - name: Build custom golangci-lint with lintroller plugin
-        env:
-          GOFLAGS: "-buildvcs=false"
         run: |
           set -e  # Exit on any error
-
-          # Fix HOME directory for git operations in GitHub Actions
-          # See: https://github.com/golangci/golangci-lint-action/discussions/1312
-          export HOME=$(eval echo ~$(whoami))
-
-          # Add workspace as git safe directory to avoid "exit status 128" errors
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git config --global --add safe.directory '*'
-
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 

From 8e8129c8c3171a85c3db505ade4128437547dcf9 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:51:28 -0700
Subject: [PATCH 09/19] debug: Test if git clone works at all in CI environment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add diagnostic to test if we can clone the golangci-lint public repo
directly before running golangci-lint custom. This will tell us if:
- Git clone works → Issue is specific to golangci-lint custom command
- Git clone fails → Network/GitHub/git issue in CI environment

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d438dd6b01..9eb2b66f3b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -124,6 +124,21 @@ jobs:
       - name: Build custom golangci-lint with lintroller plugin
         run: |
           set -e  # Exit on any error
+
+          # Debug: Test if we can clone ANY public repo
+          echo "Testing git clone of public repository..."
+          if git clone --depth 1 https://github.com/golangci/golangci-lint.git /tmp/test-clone; then
+            echo "✓ Git clone works"
+            rm -rf /tmp/test-clone
+          else
+            echo "✗ Git clone failed with exit code $?"
+            echo "Git version:"
+            git --version
+            echo "Network test:"
+            curl -I https://github.com 2>&1 | head -5
+            exit 1
+          fi
+
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 

From 38c873170040fae86b54c463c682a5e267db475e Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:54:14 -0700
Subject: [PATCH 10/19] debug: Test exact git clone command used by
 golangci-lint custom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test the exact git clone command with all flags that golangci-lint
custom uses. If it fails, test individual flags to identify which
flag is causing the exit 128 error.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9eb2b66f3b..d1a60d6518 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -125,17 +125,26 @@ jobs:
         run: |
           set -e  # Exit on any error
 
-          # Debug: Test if we can clone ANY public repo
-          echo "Testing git clone of public repository..."
-          if git clone --depth 1 https://github.com/golangci/golangci-lint.git /tmp/test-clone; then
-            echo "✓ Git clone works"
+          # Debug: Test exact git clone command that golangci-lint custom uses
+          echo "Testing exact git clone command that golangci-lint custom uses..."
+          if git clone --branch v2.5.0 --single-branch --depth 1 -c advice.detachedHead=false -q https://github.com/golangci/golangci-lint.git /tmp/test-clone; then
+            echo "✓ Exact git clone command works"
             rm -rf /tmp/test-clone
           else
-            echo "✗ Git clone failed with exit code $?"
-            echo "Git version:"
-            git --version
-            echo "Network test:"
-            curl -I https://github.com 2>&1 | head -5
+            EXIT_CODE=$?
+            echo "✗ Exact git clone command failed with exit code $EXIT_CODE"
+
+            # Test each flag individually to find the culprit
+            echo ""
+            echo "Testing without -q (quiet)..."
+            git clone --branch v2.5.0 --single-branch --depth 1 -c advice.detachedHead=false https://github.com/golangci/golangci-lint.git /tmp/test-clone-2 2>&1 || echo "Still fails"
+            rm -rf /tmp/test-clone-2
+
+            echo ""
+            echo "Testing without -c advice.detachedHead=false..."
+            git clone --branch v2.5.0 --single-branch --depth 1 -q https://github.com/golangci/golangci-lint.git /tmp/test-clone-3 2>&1 || echo "Still fails"
+            rm -rf /tmp/test-clone-3
+
             exit 1
           fi
 

From 4043c71b3b5da90245cd03f9d254347a42a89559 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:56:12 -0700
Subject: [PATCH 11/19] debug: Run golangci-lint custom with verbose output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Run golangci-lint custom with -v flag to see detailed output about
what it's doing and where it's failing. Capture environment details
like working directory, git path, HOME, TMPDIR, and disk space.

This will help identify what's different about the environment when
golangci-lint custom runs git vs when we run it directly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 47 +++++++++++++++---------------------
 1 file changed, 20 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d1a60d6518..05dbf45127 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -125,37 +125,30 @@ jobs:
         run: |
           set -e  # Exit on any error
 
-          # Debug: Test exact git clone command that golangci-lint custom uses
-          echo "Testing exact git clone command that golangci-lint custom uses..."
-          if git clone --branch v2.5.0 --single-branch --depth 1 -c advice.detachedHead=false -q https://github.com/golangci/golangci-lint.git /tmp/test-clone; then
-            echo "✓ Exact git clone command works"
-            rm -rf /tmp/test-clone
-          else
-            EXIT_CODE=$?
-            echo "✗ Exact git clone command failed with exit code $EXIT_CODE"
-
-            # Test each flag individually to find the culprit
-            echo ""
-            echo "Testing without -q (quiet)..."
-            git clone --branch v2.5.0 --single-branch --depth 1 -c advice.detachedHead=false https://github.com/golangci/golangci-lint.git /tmp/test-clone-2 2>&1 || echo "Still fails"
-            rm -rf /tmp/test-clone-2
-
-            echo ""
-            echo "Testing without -c advice.detachedHead=false..."
-            git clone --branch v2.5.0 --single-branch --depth 1 -q https://github.com/golangci/golangci-lint.git /tmp/test-clone-3 2>&1 || echo "Still fails"
-            rm -rf /tmp/test-clone-3
-
-            exit 1
-          fi
-
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 
-          # Build custom golangci-lint with plugins
-          if ! golangci-lint custom; then
-            echo "Error: golangci-lint custom build failed" >&2
+          # Run golangci-lint custom with verbose output to see what it's doing
+          echo "Running golangci-lint custom with verbose output..."
+          golangci-lint custom -v 2>&1 | tee /tmp/golangci-custom-output.log || {
+            echo ""
+            echo "===== golangci-lint custom failed ====="
+            echo "Full output:"
+            cat /tmp/golangci-custom-output.log
+            echo ""
+            echo "Current directory: $(pwd)"
+            echo "Which git: $(which git)"
+            echo "Git version: $(git --version)"
+            echo "HOME: $HOME"
+            echo "TMPDIR: ${TMPDIR:-not set}"
+            echo ""
+            echo "Disk space:"
+            df -h /tmp
+            echo ""
+            echo "Contents of /tmp:"
+            ls -la /tmp | head -20
             exit 1
-          fi
+          }
 
           # Verify the custom binary was created and is executable
           if [[ ! -f ./custom-gcl ]]; then

From 480a81bcabab529b1389eb4aceb474ec61ac064e Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 14:59:00 -0700
Subject: [PATCH 12/19] fix: Pre-configure git advice.detachedHead to work
 around compatibility issue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The runner's git version doesn't support the advice.detachedHead config
key that golangci-lint custom tries to use with -c flag. Pre-configure
it globally so when golangci-lint custom runs git clone with
-c advice.detachedHead=false, git can use the global config instead.

This is a golangci-lint bug - it should detect git version and avoid
using unsupported config keys.

Root cause: "error: invalid key: advice.detachedHead"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 35 +++++++++++++++--------------------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 05dbf45127..20ce832f0c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -125,30 +125,25 @@ jobs:
         run: |
           set -e  # Exit on any error
 
+          # Workaround for git config issue in golangci-lint custom
+          # The runner's git version doesn't support advice.detachedHead config key
+          # Pre-configure it globally so git clone -c doesn't fail
+          echo "Configuring git to work around advice.detachedHead issue..."
+          git --version
+          git config --global advice.detachedHead false 2>/dev/null || {
+            echo "Git doesn't support advice.detachedHead - this is expected on older git versions"
+            echo "golangci-lint custom will fail with -c advice.detachedHead=false"
+            echo "This is a golangci-lint bug - it should detect git version compatibility"
+          }
+
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 
-          # Run golangci-lint custom with verbose output to see what it's doing
-          echo "Running golangci-lint custom with verbose output..."
-          golangci-lint custom -v 2>&1 | tee /tmp/golangci-custom-output.log || {
-            echo ""
-            echo "===== golangci-lint custom failed ====="
-            echo "Full output:"
-            cat /tmp/golangci-custom-output.log
-            echo ""
-            echo "Current directory: $(pwd)"
-            echo "Which git: $(which git)"
-            echo "Git version: $(git --version)"
-            echo "HOME: $HOME"
-            echo "TMPDIR: ${TMPDIR:-not set}"
-            echo ""
-            echo "Disk space:"
-            df -h /tmp
-            echo ""
-            echo "Contents of /tmp:"
-            ls -la /tmp | head -20
+          # Build custom golangci-lint with plugins
+          if ! golangci-lint custom; then
+            echo "Error: golangci-lint custom build failed" >&2
             exit 1
-          }
+          fi
 
           # Verify the custom binary was created and is executable
           if [[ ! -f ./custom-gcl ]]; then

From 2981009b288c2db577f07806c9d827e0969dbb03 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 15:07:37 -0700
Subject: [PATCH 13/19] fix: Correct comment - issue is leading space in -c
 flag

The error shows 'invalid key:  advice.detachedHead' with a leading space.
golangci-lint passes -c flag with incorrect parsing. Pre-configure globally.
---
 .github/workflows/codeql.yml | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 20ce832f0c..a77e26e806 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -125,16 +125,13 @@ jobs:
         run: |
           set -e  # Exit on any error
 
-          # Workaround for git config issue in golangci-lint custom
-          # The runner's git version doesn't support advice.detachedHead config key
-          # Pre-configure it globally so git clone -c doesn't fail
-          echo "Configuring git to work around advice.detachedHead issue..."
+          # Workaround for git -c flag parsing issue in golangci-lint custom
+          # golangci-lint custom passes -c advice.detachedHead=false but git sees it with
+          # a leading space: " advice.detachedHead" which is invalid.
+          # Pre-configure it globally so git doesn't need the -c flag.
+          echo "Configuring git to work around -c flag parsing issue..."
           git --version
-          git config --global advice.detachedHead false 2>/dev/null || {
-            echo "Git doesn't support advice.detachedHead - this is expected on older git versions"
-            echo "golangci-lint custom will fail with -c advice.detachedHead=false"
-            echo "This is a golangci-lint bug - it should detect git version compatibility"
-          }
+          git config --global advice.detachedHead false
 
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..

From 651e7f88ed6cf2a8aea2c704c34365e35b702f47 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 15:12:03 -0700
Subject: [PATCH 14/19] debug: Test if git version supports advice.detachedHead
 config

Add diagnostic to check if the git version actually supports the
advice.detachedHead config key before trying to use it.
---
 .github/workflows/codeql.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a77e26e806..571c9f2f91 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -131,7 +131,17 @@ jobs:
           # Pre-configure it globally so git doesn't need the -c flag.
           echo "Configuring git to work around -c flag parsing issue..."
           git --version
-          git config --global advice.detachedHead false
+
+          # Test if git accepts this config key
+          if git config --global advice.detachedHead false; then
+            echo "✓ Successfully configured advice.detachedHead"
+          else
+            echo "✗ Failed to configure advice.detachedHead (git version doesn't support it)"
+            # Try alternative approach - just accept the error
+          fi
+
+          # Show current git config
+          git config --global --list | grep advice || echo "No advice.* configs found"
 
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..

From 08d3ab8490b87324005f9031174ed23017577c64 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 17:02:46 -0700
Subject: [PATCH 15/19] fix: Use git wrapper to strip broken -c flag

Intercept git calls and remove -c flags to work around golangci-lint bug.
---
 .github/workflows/codeql.yml | 46 +++++++++++++++++++++++-------------
 1 file changed, 29 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 571c9f2f91..643519f4de 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -125,28 +125,40 @@ jobs:
         run: |
           set -e  # Exit on any error
 
-          # Workaround for git -c flag parsing issue in golangci-lint custom
-          # golangci-lint custom passes -c advice.detachedHead=false but git sees it with
-          # a leading space: " advice.detachedHead" which is invalid.
-          # Pre-configure it globally so git doesn't need the -c flag.
-          echo "Configuring git to work around -c flag parsing issue..."
+          # Workaround for golangci-lint custom's broken -c flag usage
+          # Create a git wrapper that strips the problematic -c advice.detachedHead=false flag
+          echo "Creating git wrapper to filter out broken -c flag..."
+
+          mkdir -p ~/bin
+          cat > ~/bin/git << 'EOF'
+          #!/bin/bash
+          args=()
+          skip_next=false
+          for arg in "$@"; do
+            if [ "$skip_next" = true ]; then
+              skip_next=false
+              continue
+            fi
+            if [[ "$arg" == "-c" ]]; then
+              skip_next=true
+              continue
+            fi
+            args+=("$arg")
+          done
+          exec /usr/bin/git "${args[@]}"
+          EOF
+
+          chmod +x ~/bin/git
+          export PATH=~/bin:$PATH
+
+          echo "Git wrapper installed, testing..."
+          which git
           git --version
 
-          # Test if git accepts this config key
-          if git config --global advice.detachedHead false; then
-            echo "✓ Successfully configured advice.detachedHead"
-          else
-            echo "✗ Failed to configure advice.detachedHead (git version doesn't support it)"
-            # Try alternative approach - just accept the error
-          fi
-
-          # Show current git config
-          git config --global --list | grep advice || echo "No advice.* configs found"
-
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 
-          # Build custom golangci-lint with plugins
+          # Build custom golangci-lint with plugins using our git wrapper
           if ! golangci-lint custom; then
             echo "Error: golangci-lint custom build failed" >&2
             exit 1

From a774560420b610f29d3bed52a82486b965de3c55 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 17:10:22 -0700
Subject: [PATCH 16/19] debug: Add logging to git wrapper to diagnose -c flag
 filtering

Added debug output to show:
- Original arguments passed to git
- Which -c flags are being filtered
- Final filtered arguments

This will help us verify the wrapper is correctly stripping the
malformed -c flag that golangci-lint v2.5.0 is passing.
---
 .github/workflows/codeql.yml | 43 +++++++++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 643519f4de..f7736eb8ac 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -126,35 +126,52 @@ jobs:
           set -e  # Exit on any error
 
           # Workaround for golangci-lint custom's broken -c flag usage
-          # Create a git wrapper that strips the problematic -c advice.detachedHead=false flag
-          echo "Creating git wrapper to filter out broken -c flag..."
+          # The issue: golangci-lint v2.5.0 passes `-c  advice.detachedHead=false`
+          # (note the leading space before "advice") which git rejects as invalid.
+          # Solution: Replace /usr/bin/git with wrapper that strips ALL -c flags.
+          # Since we can't fix the malformed flag, we remove it entirely.
+          echo "Installing git wrapper to strip broken -c flags from golangci-lint..."
 
-          mkdir -p ~/bin
-          cat > ~/bin/git << 'EOF'
+          # Backup original git
+          sudo mv /usr/bin/git /usr/bin/git.real
+
+          # Create wrapper that logs arguments for debugging and strips -c flags
+          sudo tee /usr/bin/git > /dev/null << 'WRAPPER_EOF'
           #!/bin/bash
-          args=()
+          # Log original arguments for debugging
+          echo "[git wrapper] Original args: $@" >&2
+
+          # Filter out -c flags and their values
+          filtered_args=()
           skip_next=false
           for arg in "$@"; do
             if [ "$skip_next" = true ]; then
+              echo "[git wrapper] Skipping -c value: '$arg'" >&2
               skip_next=false
               continue
             fi
-            if [[ "$arg" == "-c" ]]; then
+            if [ "$arg" = "-c" ]; then
+              echo "[git wrapper] Found -c flag, will skip next arg" >&2
               skip_next=true
               continue
             fi
-            args+=("$arg")
+            filtered_args+=("$arg")
           done
-          exec /usr/bin/git "${args[@]}"
-          EOF
 
-          chmod +x ~/bin/git
-          export PATH=~/bin:$PATH
+          echo "[git wrapper] Filtered args: ${filtered_args[@]}" >&2
+          exec /usr/bin/git.real "${filtered_args[@]}"
+          WRAPPER_EOF
 
-          echo "Git wrapper installed, testing..."
-          which git
+          sudo chmod +x /usr/bin/git
+
+          echo "Git wrapper installed and configured"
+          echo "Testing wrapper:"
           git --version
 
+          # Test the -c flag filtering
+          echo "Testing -c flag filtering:"
+          git -c test.value=true --version 2>&1 | head -5
+
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 

From 1866a23ad588bd7592b2b8794f1831f5dd9858ee Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 17:34:05 -0700
Subject: [PATCH 17/19] fix: Pin golangci-lint to commit with -c flag fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove git wrapper workaround and pin to commit 101ccaca which fixes
the "-c advice.detachedHead=false" bug in golangci-lint custom command.

The bug: golangci-lint passes "-c advice.detachedHead=false" as a single
argument, but Git v2.52+ rejects this (expects two separate arguments).

Fix PR: https://github.com/golangci/golangci-lint/pull/6206

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/codeql.yml | 105 +++++------------------------------
 1 file changed, 13 insertions(+), 92 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f7736eb8ac..4bb529a448 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -107,107 +107,28 @@ jobs:
       # that includes both standard linters AND our custom module plugins.
       - name: Install golangci-lint v2 for custom build
         run: |
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+          # Pin to commit that fixes "-c advice.detachedHead=false" bug (PR #6206)
+          # https://github.com/golangci/golangci-lint/pull/6206
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@101ccaca0df22b2e36dd917ed5d0be423baa6298
 
       # Build a custom golangci-lint binary with our lintroller plugin compiled in.
-      #
-      # How this works:
-      # 1. `golangci-lint custom` reads .custom-gcl.yml
-      # 2. Clones golangci-lint repo and adds blank imports for each plugin
-      # 3. Builds a single binary (custom-gcl) containing:
-      #    - All standard golangci-lint linters (bodyclose, cyclop, etc.)
-      #    - All custom plugin linters (lintroller, etc.)
-      # 4. We copy it to /usr/local/bin/golangci-lint so the action uses it
-      #
-      # This approach allows multiple custom linters - just add them to .custom-gcl.yml
-      # and they'll all be compiled into the same custom-gcl binary.
       - name: Build custom golangci-lint with lintroller plugin
         run: |
-          set -e  # Exit on any error
-
-          # Workaround for golangci-lint custom's broken -c flag usage
-          # The issue: golangci-lint v2.5.0 passes `-c  advice.detachedHead=false`
-          # (note the leading space before "advice") which git rejects as invalid.
-          # Solution: Replace /usr/bin/git with wrapper that strips ALL -c flags.
-          # Since we can't fix the malformed flag, we remove it entirely.
-          echo "Installing git wrapper to strip broken -c flags from golangci-lint..."
-
-          # Backup original git
-          sudo mv /usr/bin/git /usr/bin/git.real
-
-          # Create wrapper that logs arguments for debugging and strips -c flags
-          sudo tee /usr/bin/git > /dev/null << 'WRAPPER_EOF'
-          #!/bin/bash
-          # Log original arguments for debugging
-          echo "[git wrapper] Original args: $@" >&2
-
-          # Filter out -c flags and their values
-          filtered_args=()
-          skip_next=false
-          for arg in "$@"; do
-            if [ "$skip_next" = true ]; then
-              echo "[git wrapper] Skipping -c value: '$arg'" >&2
-              skip_next=false
-              continue
-            fi
-            if [ "$arg" = "-c" ]; then
-              echo "[git wrapper] Found -c flag, will skip next arg" >&2
-              skip_next=true
-              continue
-            fi
-            filtered_args+=("$arg")
-          done
-
-          echo "[git wrapper] Filtered args: ${filtered_args[@]}" >&2
-          exec /usr/bin/git.real "${filtered_args[@]}"
-          WRAPPER_EOF
-
-          sudo chmod +x /usr/bin/git
-
-          echo "Git wrapper installed and configured"
-          echo "Testing wrapper:"
-          git --version
-
-          # Test the -c flag filtering
-          echo "Testing -c flag filtering:"
-          git -c test.value=true --version 2>&1 | head -5
+          set -e
 
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 
-          # Build custom golangci-lint with plugins using our git wrapper
-          if ! golangci-lint custom; then
-            echo "Error: golangci-lint custom build failed" >&2
-            exit 1
-          fi
-
-          # Verify the custom binary was created and is executable
-          if [[ ! -f ./custom-gcl ]]; then
-            echo "Error: custom-gcl binary not found" >&2
-            exit 1
-          fi
-
-          if [[ ! -x ./custom-gcl ]]; then
-            echo "Error: custom-gcl binary is not executable" >&2
-            exit 1
-          fi
-
-          # Move the system binary out of the way and replace it with our custom one
-          # This ensures the action uses our custom binary with lintroller
-          if ! mv ~/go/bin/golangci-lint ~/go/bin/golangci-lint.system; then
-            echo "Error: failed to move system golangci-lint binary" >&2
-            exit 1
-          fi
+          # Build custom golangci-lint with plugins
+          golangci-lint custom
 
-          if ! cp ./custom-gcl ~/go/bin/golangci-lint; then
-            echo "Error: failed to copy custom-gcl to ~/go/bin/golangci-lint" >&2
-            exit 1
-          fi
+          # Verify the custom binary was created
+          test -x ./custom-gcl || { echo "Error: custom-gcl not found or not executable"; exit 1; }
 
-          if ! chmod +x ~/go/bin/golangci-lint; then
-            echo "Error: failed to make ~/go/bin/golangci-lint executable" >&2
-            exit 1
-          fi
+          # Replace system binary with our custom one
+          mv ~/go/bin/golangci-lint ~/go/bin/golangci-lint.system
+          cp ./custom-gcl ~/go/bin/golangci-lint
+          chmod +x ~/go/bin/golangci-lint
 
           golangci-lint --version
 
@@ -233,7 +154,7 @@ jobs:
       - name: Run golangci-lint with lintroller plugin
         uses: golangci/golangci-lint-action@v8.0.0
         with:
-          version: v2.5.0
+          version: 101ccaca0df22b2e36dd917ed5d0be423baa6298
           install-mode: none
           only-new-issues: true
           args: >

From 832154328bc4b3c435b150b121e74c42460903d3 Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 17:34:32 -0700
Subject: [PATCH 18/19] fix: Auto-install gh actions-cache extension in dev
 commands
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cache-list and cache-clear commands now automatically install the
gh actions-cache extension if it's not already present, improving the
developer experience by removing manual setup steps.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .atmos.d/dev.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.atmos.d/dev.yaml b/.atmos.d/dev.yaml
index 410c52c9f5..b6848724a2 100644
--- a/.atmos.d/dev.yaml
+++ b/.atmos.d/dev.yaml
@@ -245,6 +245,12 @@ commands:
               exit 1
             fi
 
+            # Check if actions-cache extension is installed
+            if ! gh actions-cache --help &> /dev/null; then
+              echo "📦 Installing gh actions-cache extension..."
+              gh extension install actions/gh-actions-cache
+            fi
+
             # Get cache entries over 1GB
             CACHE_ENTRIES=$(gh actions-cache list -R cloudposse/atmos | grep GB)
 
@@ -290,6 +296,12 @@ commands:
               exit 1
             fi
 
+            # Check if actions-cache extension is installed
+            if ! gh actions-cache --help &> /dev/null; then
+              echo "📦 Installing gh actions-cache extension..."
+              gh extension install actions/gh-actions-cache
+            fi
+
             # Get cache entries over 1GB
             CACHE_ENTRIES=$(gh actions-cache list -R cloudposse/atmos | grep GB)
 

From 7369a5a553d07cfb9da56c5b194cfbf612b8a24b Mon Sep 17 00:00:00 2001
From: Erik Osterman <erik@cloudposse.com>
Date: Wed, 26 Nov 2025 18:18:29 -0700
Subject: [PATCH 19/19] fix: Pin AWS provider to v5.x for LocalStack
 compatibility
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AWS provider v6.x has breaking changes in S3 bucket creation that
LocalStack 1.4.0 doesn't support, causing MalformedXML errors.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .../components/terraform/bucket/providers.tf             | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/examples/demo-localstack/components/terraform/bucket/providers.tf b/examples/demo-localstack/components/terraform/bucket/providers.tf
index 8c9ebd1754..feb8c6ff81 100644
--- a/examples/demo-localstack/components/terraform/bucket/providers.tf
+++ b/examples/demo-localstack/components/terraform/bucket/providers.tf
@@ -1,2 +1,11 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
 provider "aws" {
 }