Skip to content

fix: repin go-licenses to v1.6.0#55

Merged
CybotTM merged 1 commit into
mainfrom
fix/go-licenses-pin-v1
Apr 20, 2026
Merged

fix: repin go-licenses to v1.6.0#55
CybotTM merged 1 commit into
mainfrom
fix/go-licenses-pin-v1

Conversation

@CybotTM
Copy link
Copy Markdown
Member

@CybotTM CybotTM commented Apr 20, 2026

Fix bad pin introduced in #53 — the SHA I picked was v2.0.1 whose go.mod uses the /v2 module suffix, so the install command in go-check.yml fails. Repin to v1.6.0.

The SHA I pinned in #53 (3e084b0caf71) is actually tag v2.0.1 — its
go.mod declares module path `github.com/google/go-licenses/v2`, so
`go install github.com/google/go-licenses@<that-sha>` fails with:

    go.mod has post-v1 module path "github.com/google/go-licenses/v2" at revision 3e084b0caf71

Caught on simple-ldap-go#142's license-scan job. Repin to v1.6.0
(5348b744) which keeps the v1 module path that the installer expects.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
Copilot AI review requested due to automatic review settings April 20, 2026 06:27
@gemini-code-assist
Copy link
Copy Markdown

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

@CybotTM CybotTM merged commit ef132fd into main Apr 20, 2026
8 checks passed
@CybotTM CybotTM deleted the fix/go-licenses-pin-v1 branch April 20, 2026 06:28
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Repins the go-licenses installation used by the reusable Go check workflow to a v1-compatible revision so the go install github.com/google/go-licenses@... step succeeds (avoiding the /v2 module-path mismatch introduced by the prior pin).

Changes:

  • Update the pinned go-licenses commit SHA to one corresponding to v1.6.0.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

CybotTM added a commit that referenced this pull request May 23, 2026
## Summary

Bumps `dessant/lock-threads` from
[`v6.0.0`](https://github.com/dessant/lock-threads/releases/tag/v6.0.0)
to
[`v6.0.2`](https://github.com/dessant/lock-threads/releases/tag/v6.0.2)
in `.github/workflows/lock.yml` to fix a GITHUB_TOKEN validation
regression that is breaking the daily `Community` workflow run across
every NR repo that consumes `lock.yml@main`.

## Root cause

GitHub recently changed the `GITHUB_TOKEN` format to a longer string.
`dessant/lock-threads@v6.0.0` (currently pinned) has a hardcoded schema
validation that rejects tokens longer than 100 characters:

```
##[error]"github-token" length must be less than or equal to 100 characters long
```

This breaks every consumer of
[`netresearch/.github/.github/workflows/lock.yml@main`](https://github.com/netresearch/.github/blob/main/.github/workflows/lock.yml)
on every scheduled cron run (00:00 UTC daily). Observed today
(2026-05-23) on at least:

- [`netresearch/t3x-nr-textdb` Community
#91](https://github.com/netresearch/t3x-nr-textdb/actions/runs/26318591202)
- [`netresearch/t3x-nr-temporal-cache` Community
#91](https://github.com/netresearch/t3x-nr-temporal-cache/actions/runs/26318520167)
- [`netresearch/t3x-nr-image-optimize` Community
#146](https://github.com/netresearch/t3x-nr-image-optimize/actions/runs/26318355355)

The full blast radius is every NR repo whose Community workflow calls
`lock.yml@main` — ~30 repos.

## Why v6.0.2 is the fix

From [the upstream CHANGELOG entry for
v6.0.2](https://github.com/dessant/lock-threads/blob/main/CHANGELOG.md#602-2026-05-23):

> ### Bug Fixes
> * **update github-token validation schema**
([a329c89](dessant/lock-threads@a329c89)),
closes [#55](dessant/lock-threads#55)

Released **today (2026-05-23)** specifically to address this. v6.0.1
(released 2026-05-21) only updated dependencies and doesn't fix the
schema.

## Pin

`dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2`
— commit SHA the `v6.0.2` tag points to, resolved via `gh api
repos/dessant/lock-threads/git/refs/tags/v6.0.2`. Renovate will keep
this current via the standard `# vX.Y.Z` comment pattern.

## Verification

- `actionlint .github/workflows/lock.yml` → clean
- `yamllint` against CI defaults → clean
- SHA confirmed to point at commit "chore(release): 6.0.2" dated
2026-05-23

After merge, the daily 00:00 UTC Community runs across consuming repos
should self-correct on the next scheduled trigger.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants