From 9362e4fd6a4c6d8a20b6ce2f4589f297f348ec0f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juli=C3=A1n=20Gonz=C3=A1lez?= Date: Mon, 21 Sep 2026 14:56:44 -0700 Subject: [PATCH 1/2] Raise the connector lint pin to golangci-lint v2.13.2 The verify workflow resolves its toolchain from the caller's go.mod (go-version-file: _caller/go.mod) but pinned golangci-lint at v2.11.4, whose release binaries are built with go1.26.1. golangci-lint refuses to load its configuration when it was built with a Go older than the module it targets, failing the job before any analysis runs: can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.1) baton-sdk's go directive is now 1.27.1 on main, and baton-admin propagates that to each connector as it bumps their SDK, so every connector reaching go 1.27 would have hit this. The pin is raised ahead of that rollout rather than during it. v2.13.2's binaries are built with go1.27.0. Landing it first is safe because the check is one-directional: a newer linter lints an older caller without complaint. Every connector sampled is still on go 1.25.x, so today this is only a linter upgrade. It affects every connector consuming verify.yaml, so it takes effect once v4 is re-pointed. Two minor versions of new rules ride along and may surface genuine findings on individual connectors; baton-github-test calls this same workflow and can canary the branch before the tag moves. Verified: the workflow parses and the lint step resolves to version v2.13.2 with the unchanged 6m timeout and _caller working directory. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/verify.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/verify.yaml b/.github/workflows/verify.yaml index 6654df0..6001965 100644 --- a/.github/workflows/verify.yaml +++ b/.github/workflows/verify.yaml @@ -43,7 +43,8 @@ jobs: - name: Run linters uses: golangci/golangci-lint-action@v9 with: - version: v2.11.4 + # Floor for go 1.27 callers: a linter built with an older Go can't load the config. + version: v2.13.2 args: --timeout=6m working-directory: _caller test: From 54c083d38bd50f330fd1cd74a12e4995be91ee12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juli=C3=A1n=20Gonz=C3=A1lez?= Date: Mon, 21 Sep 2026 16:01:37 -0700 Subject: [PATCH 2/2] Hold goconst's prior signal at the new lint pin v2.13.2 carries goconst v1.11.0, up from v1.8.2. goconst v1.9.0 added detection of repeated literals inside composite literal elements, and this config pins no goconst settings, so the connector profile-map idiom trips the default three-occurrence threshold: profile := map[string]interface{}{ "displayName": user.Name, "email": user.Email, "role": user.Role, } Measured across 15 enrolled connectors: of the 12 green in CI, 5 go red purely on goconst, 47 findings in total, nothing from any other linter despite errcheck moving ten minor versions and gosec four. ignore-map-keys alone is not enough -- baton-databricks went from 10 findings to 4 and baton-demo from 31 to 15, the residue being short protocol strings as arguments and struct fields, which only the threshold clears. Both settings together return all five to zero: baton-demo, baton-databricks, baton-file, baton-claude-enterprise and baton-pingfed each report 0 issues. Neither setting asks for less correctness. Field-name keys are not constants worth extracting, and three uses of a string like "user" is not duplication worth naming. This file is the source baton-admin syncs into pkg/files/.golangci.yml daily and pushes to every connector, so it is the only durable place to set this; the settings are also invalid on v2.11.4, which rejects ignore-map-keys as an unknown property, so they ship with the pin rather than ahead of it. Co-Authored-By: Claude Opus 5 (1M context) --- .golangci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.golangci.yml b/.golangci.yml index 1e6dfd9..7ab6339 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -39,6 +39,10 @@ linters: settings: exhaustive: default-signifies-exhaustive: true + goconst: + # goconst v1.9.0 reports literals inside composite literals; these hold the prior signal. + ignore-map-keys: true + min-occurrences: 6 gocritic: enabled-checks: - ruleguard