fix: Pin golangci-lint to commit with -c flag fix for Git v2.52+

.github/workflows/codeql.yml

@@ -124,10 +124,58 @@ jobs:
       - name: Build custom golangci-lint with lintroller plugin
         run: |
           set -e  # Exit on any error
+
+          # Workaround for golangci-lint custom's broken -c flag usage
+          # The issue: golangci-lint v2.5.0 passes `-c  advice.detachedHead=false`
+          # (note the leading space before "advice") which git rejects as invalid.
+          # Solution: Replace /usr/bin/git with wrapper that strips ALL -c flags.
+          # Since we can't fix the malformed flag, we remove it entirely.
+          echo "Installing git wrapper to strip broken -c flags from golangci-lint..."
+
+          # Backup original git
+          sudo mv /usr/bin/git /usr/bin/git.real
+
+          # Create wrapper that logs arguments for debugging and strips -c flags
+          sudo tee /usr/bin/git > /dev/null << 'WRAPPER_EOF'
+          #!/bin/bash
+          # Log original arguments for debugging
+          echo "[git wrapper] Original args: $@" >&2
+
+          # Filter out -c flags and their values
+          filtered_args=()
+          skip_next=false
+          for arg in "$@"; do
+            if [ "$skip_next" = true ]; then
+              echo "[git wrapper] Skipping -c value: '$arg'" >&2
+              skip_next=false
+              continue
+            fi
+            if [ "$arg" = "-c" ]; then
+              echo "[git wrapper] Found -c flag, will skip next arg" >&2
+              skip_next=true
+              continue
+            fi
+            filtered_args+=("$arg")
+          done
+
+          echo "[git wrapper] Filtered args: ${filtered_args[@]}" >&2
+          exec /usr/bin/git.real "${filtered_args[@]}"
+          WRAPPER_EOF
+
+          sudo chmod +x /usr/bin/git
+
+          echo "Git wrapper installed and configured"
+          echo "Testing wrapper:"
+          git --version
+
+          # Test the -c flag filtering
+          echo "Testing -c flag filtering:"
+          git -c test.value=true --version 2>&1 | head -5
+
           # Ensure lintroller module is ready
           cd tools/lintroller && go mod tidy && cd ../..
 
-          # Build custom golangci-lint with plugins
+          # Build custom golangci-lint with plugins using our git wrapper
           if ! golangci-lint custom; then
             echo "Error: golangci-lint custom build failed" >&2
             exit 1