ci: verify golangci config against a vendored schema

[Kiran01bm]

Summary

The lint job occasionally fails with no lint findings because the golangci-lint action's built-in config verify fetches the config JSON schema from golangci-lint.run on every run — a transient network failure on the runner fails this merge-gating job. This keeps the config-verify check but makes it hermetic.

What

• Vendor the golangci-lint v2.11 config JSON schema at .github/golangci.v2.11.jsonschema.json.
• Disable the action's built-in verify (verify: false) and add an explicit golangci-lint config verify --schema <vendored file> step (once, on the default matrix leg) that validates .golangci.yaml against the vendored copy with no remote fetch.

Why

config verify is worth keeping: it validates the whole config against the schema and reports precise diagnostics (unknown keys, wrong types, misplaced sections) before any lint run. The alternative — dropping the check altogether (verify: false with no replacement) — removes the flake with zero maintenance, but loses those schema diagnostics: a config typo would then surface only as whatever error golangci-lint run happens to produce, or worse, as a silently ignored setting.

The cost of the vendored approach is a schema file that must be refreshed whenever the pinned golangci-lint minor version moves. That cost is temporary: the hidden --schema flag is removed in golangci-lint v2.12+, which embeds the schema in the binary — config verify becomes hermetic by default. On that version bump, the vendored file and the extra step get deleted and the action's built-in verify is re-enabled (the workflow comment records this).

Before:
┌────────────┐  config verify   ┌───────────────────┐
│ lint job   │ ───────────────▶ │ golangci-lint.run │  ← transient fetch
│ (gating)   │   (every run)    │ (remote schema)   │    failure fails job
└────────────┘                  └───────────────────┘

After:
┌────────────┐  config verify   ┌──────────────────────────────┐
│ lint job   │ ───────────────▶ │ .github/golangci.v2.11.…json │  ← in-repo,
│ (gating)   │   --schema       │ (vendored schema)            │    no network
└────────────┘                  └──────────────────────────────┘

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

This PR makes the merge-gating lint workflow hermetic by removing the golangci-lint action’s network-dependent schema download during config verification, and instead validating .golangci.yaml against a vendored JSON schema checked into the repo.

Changes:

• Disable golangci/golangci-lint-action’s built-in verify behavior to avoid remote schema fetches.
• Add an explicit golangci-lint config verify --schema <vendored> step for the default matrix leg.
• Vendor the golangci-lint v2.11 config JSON schema under .github/ for offline verification.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/lint.yaml	Disables action verify and adds a hermetic config verification step using a vendored schema.
.github/golangci.v2.11.jsonschema.json	Adds the vendored JSON schema used to validate .golangci.yaml without network access.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[morgo]

🤖 Approving on Morgan's behalf (automated review, escalation rules apply).

CI-only change that makes the config-verify check hermetic: verify: false on the lint step kills the per-run schema download from golangci-lint.run (a real merge-gate flake source), and the vendored-schema config verify --schema step replaces it. Install-only step is SHA-pinned consistent with the repo's pinning policy, both new steps are gated to the default matrix leg so they run once, and the comments document exactly when to delete this (v2.12+ embeds the schema). The 5.3k-line vendored schema's worst case is mis-validating the lint config — CI-only blast radius.