chore(deps): update golangci/golangci-lint-action action to v9

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
golangci/golangci-lint-action	action	major	v8 -> v9

---

Release Notes

golangci/golangci-lint-action (golangci/golangci-lint-action)

v9

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Code Review: Update golangci-lint-action to v9

Thank you for the automated dependency update from Renovate. I've reviewed this PR and have the following feedback:

Critical Issue: Missing Matrix Configuration ❌

The workflow file references matrix.lint on line 23 (.github/workflows/build.yml:23):

- name: Linting
  if: matrix.lint
  uses: golangci/golangci-lint-action@v8

However, there is no matrix strategy defined in the build job. This means:

• The matrix.lint condition will always be undefined/falsy
• The linting step is currently never executed
• Upgrading the action version won't fix this underlying issue

Recommendations

Before merging this PR, please:

1. Fix the missing matrix configuration by either:

   • Adding a proper matrix strategy, e.g.:

     strategy:
       matrix:
         lint: [true]

   • Or removing the conditional entirely if linting should always run:

     - name: Linting
       uses: golangci/golangci-lint-action@v9
       with:
         version: v1.41

2. Update golangci-lint version - The workflow pins to v1.41 which is quite old (from 2021). The latest version is 1.62+. Consider updating to a recent version to benefit from:

   • Better performance
   • Support for newer Go versions (currently using Go 1.25.4)
   • Bug fixes and new linters
   • Better compatibility with golangci-lint-action v9

Action Version Upgrade (v8 → v9)

The golangci-lint-action v9 upgrade itself appears safe as a minor version bump. However, it provides value only if the linting step is actually executed.

Additional Observations

• The .golangci.yml configuration is comprehensive with 40+ linters enabled
• Some deprecated linters are still referenced in the config (deadcode, structcheck, varcheck, maligned - these were removed in golangci-lint 1.49+)
• The old golangci-lint v1.41 won't support many of the configured linters

Suggested Actions

1. Create a separate issue to fix the matrix configuration bug
2. Update this PR to also bump the golangci-lint version to latest (v1.62 or newer)
3. Test the workflow after fixing the matrix issue
4. Clean up deprecated linters from .golangci.yml

---

Current Status: ⚠️ Do not merge - The linting step is not executing due to missing matrix configuration. This needs to be fixed first.

[claude]

PR Review: Update golangci-lint-action to v9

Summary

This PR updates the golangci/golangci-lint-action from v8 to v9. While the dependency update itself is straightforward, there are critical issues that need to be addressed.

---

🚨 Critical Issues

1. Severely Outdated golangci-lint Version

Location: .github/workflows/build.yml:26

The workflow is currently using golangci-lint v1.41, which was released in 2021 and is over 3 years old. This is a major problem:

• Go 1.24+ Incompatibility: The project uses Go 1.24 (with toolchain 1.25.4), but golangci-lint v1.41 was designed for Go 1.16-1.17 era
• Missing Modern Linters: Many valuable linters have been added since v1.41
• Security: Older versions may miss security issues that newer linters detect
• Deprecated Linters: The .golangci.yml configuration uses deprecated linters (deadcode, structcheck, varcheck, maligned) that have been removed in modern versions

Recommendation: Update to the latest golangci-lint version (currently v1.61+). Change line 26 from:

version: v1.41

to:

version: latest  # or specify v1.61.0 or newer

2. Configuration File Needs Update

Location: .golangci.yml:164-211

The linter configuration uses several deprecated linters:

• deadcode → replaced by unused
• structcheck → replaced by unused
• varcheck → replaced by unused
• maligned → replaced by govet: fieldalignment
• scopelint → replaced by exportloopref (already done on line 203)

These will cause warnings or errors with modern golangci-lint versions.

3. Workflow Matrix Strategy Missing

Location: .github/workflows/build.yml:23

The workflow references if: matrix.lint but there's no matrix strategy defined in the job. This means the linting step will never run because matrix.lint will always be false/undefined.

Recommendation: Either:

• Remove the if: matrix.lint condition (lint on every run), or
• Add a proper matrix strategy to the build job

---

✅ Positive Aspects

1. Action Update is Safe: The golangci-lint-action v8→v9 update itself is non-breaking
2. Automated Dependency Management: Using Renovate bot for dependency updates is a good practice
3. Minimal Change Scope: The PR is appropriately focused on a single dependency update

---

🔍 Testing Recommendations

Before merging, please:

1. Test locally with the updated action version
2. Update golangci-lint version to latest and run locally:

   golangci-lint run

3. Fix deprecation warnings from the configuration file
4. Verify the linting step actually runs in CI (currently it appears to be skipped)

---

📝 Suggested Action Plan

1. Merge this PR (the action update itself is fine)
2. Immediately follow up with:
   • Update version: v1.41 to version: latest or version: v1.61.0
   • Fix .golangci.yml to remove deprecated linters
   • Fix or remove the if: matrix.lint condition
3. Monitor the next CI run to ensure linting actually executes and passes

---

Security Considerations

Using such an outdated linting version (v1.41 from 2021) means you're missing 3+ years of security-focused linter improvements. The gosec linter has had numerous enhancements since then for detecting security vulnerabilities in Go code.

---

Verdict

✅ Approve with strong recommendation for immediate follow-up work

The action version update itself is fine, but the underlying golangci-lint version issue needs urgent attention. This PR can be merged, but should be immediately followed by a PR to update the actual linter version and configuration.