From 1ad01eab75aa362268a596809cff95a4fba04913 Mon Sep 17 00:00:00 2001
From: joshuaaferguson <contact@joshua-ferguson.com>
Date: Sat, 25 Apr 2026 10:56:35 -0700
Subject: [PATCH] fix(ci): bump GO_VERSION to 1.25 + golangci-lint to v2.5 +
 repair sha tag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three pre-existing CI failures unrelated to product code:

1. GO_VERSION='1.21' was older than every module in the repo (api: 1.24,
   k8s-agent: 1.24, docker-agent: 1.25). Lint and build steps could not
   parse the modules' Go directive. Bump to 1.25 across CI and align
   security-scan.yml from 1.24 → 1.25.

2. golangci-lint v1.55.2 cannot read Go 1.23+ export data, so the K8s
   agent lint failed with "internal/goarch unsupported version: 2".
   Pin to v2.5.0 (Go 1.25 support) via GOLANGCI_LINT_VERSION env var.

3. container-images.yml had `type=sha,prefix={{branch}}-` which
   evaluates `{{branch}}` to empty on pull_request events, producing
   the malformed tag `:-<sha>` and aborting buildx with
   "invalid reference format". Replace with `prefix=sha-` for an
   unambiguous, always-valid tag.
---
 .github/workflows/ci.yml               | 4 ++--
 .github/workflows/container-images.yml | 6 +++---
 .github/workflows/security-scan.yml    | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 547e27dd..0358da95 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,8 +43,8 @@ jobs:
         run: |
           go fmt ./...
           go vet ./...
-          # Install golangci-lint
-          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.55.2
+          # Install golangci-lint (pinned to a version that supports the modules' Go directive)
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "$(go env GOPATH)/bin" "${GOLANGCI_LINT_VERSION}"
           golangci-lint run
 
       - name: Download API dependencies
diff --git a/.github/workflows/container-images.yml b/.github/workflows/container-images.yml
index c2a2bf64..c1d055c4 100644
--- a/.github/workflows/container-images.yml
+++ b/.github/workflows/container-images.yml
@@ -65,7 +65,7 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=sha,prefix={{branch}}-
+            type=sha,prefix=sha-
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Set build variables
@@ -234,7 +234,7 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=sha,prefix={{branch}}-
+            type=sha,prefix=sha-
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Set build variables
@@ -403,7 +403,7 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=sha,prefix={{branch}}-
+            type=sha,prefix=sha-
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Set build variables
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 96b4edfd..21815a19 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -85,7 +85,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.24'
+          go-version: '1.25'
 
       - name: Download dependencies
         run: |