Migrate tools.go to Go 1.24 tool directives; remove dead gosec config from .golangci.yml by Copilot · Pull Request #48830 · github/gh-aw

Copilot · 2026-07-29T09:36:23Z

gosec version was hardcoded in 4 separate places (go.mod, two Makefile targets, and the security workflow), and .golangci.yml carried ~30 lines of inert gosec settings/exclusions that never executed because gosec is disabled in golangci-lint.

Go 1.24 `tool` directives

Replaces the tools.go blank-import shim with native tool directives in go.mod:

tool (
    github.com/rhysd/actionlint/cmd/actionlint
    github.com/securego/gosec/v2/cmd/gosec
    golang.org/x/vuln/cmd/govulncheck
)

go.mod is now the single source of truth for tool versions
make security-gosec uses go tool gosec ... — no go install @hardcoded-version or GOPATH/bin:PATH juggling
make security-govulncheck / security-govulncheck-sarif use go tool govulncheck
make tools installs via go install <path> without @version (resolves from go.mod)
.github/workflows/security-scan.yml replaced go install ...@v2.28.0 && gosec with go tool gosec
tools.go deleted

Dead gosec config removed from `.golangci.yml`

Removed linters-settings.gosec block (settings for a linter that's explicitly disabled)
Removed all 20+ exclude-rules entries with linters: [gosec] (none ever fired)

Fixes [go-fan] Go Module Review: gosec #48829

Run: https://github.com/github/gh-aw/actions/runs/30446544004

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.46 AIC · ⌖ 5.69 AIC · ⊞ 7.6K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-29T09:49:22Z

Thanks for starting this refactoring work on the gosec module! The addition of tool directives in go.mod is a solid modernization step that aligns with Go 1.24+ best practices.

Here are a few things to finalize:

Mark as Ready When Complete — The PR is currently in WIP (draft) status. Once the remaining checklist items are complete, remove the [WIP] prefix and un-draft the PR.
Add Test Coverage — This changeset updates build tooling configuration but has no test coverage. Add tests verifying go tool gosec resolves correctly and that versions remain synchronized.
Complete the Checklist — Delete tools.go, update the Makefile security-gosec target, update .github/workflows/security-scan.yml, and clean up the dead gosec config in .golangci.yml.

Once these are done, this will be a great housekeeping PR that eliminates version-pin duplication across 4 separate files.

Complete the remaining steps in PR #48830 for the Go 1.24+ tool directive migration:

1. Delete tools.go (the blank-import shim is no longer needed with tool directives)
2. Update the Makefile to use go tool gosec instead of the hardcoded version
3. Update .github/workflows/security-scan.yml to use go tool gosec
4. Clean up .golangci.yml: remove the inert gosec settings block
5. Add a simple test verifying go tool gosec works with the tool directives
6. Remove [WIP] from the PR title and un-draft the PR

Generated by ✅ Contribution Check · sonnet50 · 47.8 AIC · ⌖ 11.9 AIC · ⊞ 8.4K · ◷

…onfig Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-29T10:25:37Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #48830 does not have the 'implementation' label and has 0 new lines of code in business logic directories (threshold: 100).

github-actions · 2026-07-29T10:25:43Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-07-29T10:25:56Z

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

github-actions · 2026-07-29T10:26:08Z

✅ PR Code Quality Reviewer completed the code quality review.

github-actions

The migration to Go 1.24 tool directives is clean and correct. Removing the dead gosec config from .golangci.yml reduces noise. One minor nit: in the Makefile security-gosec target, the new go tool gosec line is missing the @ prefix (all surrounding lines use @), so the command will be echoed to stdout on make. Not blocking — approve as-is or fix at your discretion.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 11.5 AIC · ⌖ 5.84 AIC · ⊞ 5.1K

github-actions

Skills-Based Review

Applied /codebase-design — requesting one minor fix.

Finding: go tool gosec ... in Makefile line 230 is missing the @ prefix, so the command echoes to stdout during make security-gosec — inconsistent with all other lines in that target.

Positive highlights:

Excellent consolidation: tool versions declared once in go.mod
Clean deletion of tools.go blank-import shim (Go 1.24 native approach)
~120 lines of genuinely dead gosec config removed from .golangci.yml
CI workflow and Makefile updates are consistent

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 28 AIC · ⌖ 4.86 AIC · ⊞ 6.8K
_{Comment /matt to run again}

github-actions

Approve — clean mechanical migration

Verified go build ./... succeeds with the new tool directives; the removed .golangci.yml gosec block was genuinely dead (gosec is disabled in golangci-lint per line 12-14), so nothing is lost. No correctness, security, or maintainability issues found in the changed lines.

💡 Review notes

go.mod tool directives correctly list all three tools previously tracked via tools.go blank imports; versions are pinned via existing require entries (actionlint v1.7.12, gosec v2.28.0, x/vuln v1.6.0), so behavior is unchanged.
Makefile security-gosec/security-govulncheck/security-govulncheck-sarif/tools targets consistently switched to go tool <name>, removing the manual GOPATH/bin:PATH juggling — a real simplification.
security-scan.yml workflow mirrors the Makefile change (drops the explicit go install ...@v2.28.0 step in favor of go tool gosec).
Removed .golangci.yml gosec settings/exclude-rules were inert (gosec commented out of enable: list), confirmed no linters: gosec reference remains active elsewhere in the file.
Verified with go build ./... locally — succeeds under go1.26.5 toolchain.

No blocking issues; nothing to comment on individual lines.

🔎 Code quality review by PR Code Quality Reviewer · sonnet50 · 51.2 AIC · ⌖ 4.53 AIC · ⊞ 7.5K
_{Comment /review to run again}

done

pelikhan · 2026-07-29T10:38:52Z

@copilot run pr-finisher skill

Copilot

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR migrates Go tool dependency tracking from a tools.go pattern to go.mod tool directives, and updates local/CI commands to run security tooling via go tool.

Changes:

Remove tools.go and declare tool dependencies in go.mod via a tool block.
Update Makefile and GitHub Actions security workflow to run gosec/govulncheck using go tool.
Clean up .golangci.yml by removing gosec-specific config and exclusions.

Show a summary per file

File	Description
tools.go	Removes legacy `tools.go`-based tool pinning/imports.
go.mod	Adds `tool` directives to declare tool dependencies.
Makefile	Switches security scans to `go tool` and updates the tools install help text.
.golangci.yml	Removes `gosec` config/exclusions now that it’s not run via golangci-lint.
.github/workflows/security-scan.yml	Runs `gosec`/`govulncheck` via `go tool` instead of installing/running them directly.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 6
Review effort level: Low

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-29T21:02:59Z

🎉 This pull request is included in a new release.

Release: v0.84.0

Initial plan

1addec3

Copilot AI assigned Copilot and pelikhan Jul 29, 2026

Copilot started work on behalf of pelikhan July 29, 2026 09:36 View session

Copilot AI linked an issue Jul 29, 2026 that may be closed by this pull request

[go-fan] Go Module Review: gosec #48829

Closed

Add tool directives to go.mod for gosec, actionlint, govulncheck

3919148

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions Bot mentioned this pull request Jul 29, 2026

[Contribution Check Report] Contribution Check — 2026-07-29 #48756

Closed

Migrate tools.go to Go 1.24 tool directives and clean up dead gosec c…

9e7bcee

…onfig Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Review gosec module for security analysis~~ Migrate tools.go to Go 1.24 tool directives; remove dead gosec config from .golangci.yml Jul 29, 2026

Copilot finished work on behalf of pelikhan July 29, 2026 09:55

Copilot AI requested a review from pelikhan July 29, 2026 09:55

pelikhan marked this pull request as ready for review July 29, 2026 10:23

Copilot AI review requested due to automatic review settings July 29, 2026 10:23

Copilot started reviewing on behalf of pelikhan July 29, 2026 10:24 View session

github-actions Bot approved these changes Jul 29, 2026

View reviewed changes

github-actions Bot previously requested changes Jul 29, 2026

View reviewed changes

Comment thread Makefile Outdated

This was referenced Jul 29, 2026

[aw] No-Op Runs #48838

Open

[aw] Matt Pocock Skills Reviewer failed #48844

Closed

github-actions Bot reviewed Jul 29, 2026

View reviewed changes

Copilot stopped reviewing on behalf of pelikhan due to an error July 29, 2026 10:44
Copilot had to stop work due to a timeout.

Copilot started work on behalf of pelikhan July 29, 2026 10:45 View session

Copilot AI reviewed Jul 29, 2026

View reviewed changes

Comment thread go.mod

Comment thread Makefile Outdated

Comment thread Makefile Outdated

Comment thread Makefile Outdated

Comment thread .github/workflows/security-scan.yml

Comment thread .github/workflows/security-scan.yml

Fix missing @ prefix on go tool lines in Makefile security targets

7a9bd83

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 29, 2026 10:55

Merge branch 'main' into copilot/go-fan-review-gosec

5e2e41e

github-actions Bot mentioned this pull request Jul 29, 2026

[pr-sous-chef] pr-sous-chef run report #48748

Closed

pelikhan merged commit 98bac81 into main Jul 29, 2026
38 checks passed

pelikhan deleted the copilot/go-fan-review-gosec branch July 29, 2026 11:53

Uh oh!

Conversation

Copilot AI commented Jul 29, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Go 1.24 tool directives

Dead gosec config removed from .golangci.yml

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Approve — clean mechanical migration

Uh oh!

pelikhan commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 29, 2026 •

edited by github-actions Bot

Loading

Go 1.24 `tool` directives

Dead gosec config removed from `.golangci.yml`

github-actions Bot commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading