Lint

deps(actions): bump actions/setup-go from 6 to 7 #1284

	name: Lint

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	golangci-lint:
	name: golangci-lint
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Set up Go
	uses: actions/setup-go@v7
	with:
	go-version-file: 'go.mod'
	cache: false

	- name: Set up Node.js
	uses: actions/setup-node@v7
	with:
	node-version: '24'
	cache: 'npm'
	cache-dependency-path: web/package-lock.json

	- name: Build frontend (required for embed)
	run: \|
	cd web
	npm ci
	npm run build

	- name: Run golangci-lint
	uses: golangci/golangci-lint-action@v9
	with:
	# Keep in sync with .golangci-version and local installs (see CONTRIBUTING.md).
	# Schema for gosec excludes (e.g. G124) differs across minor versions.
	version: v2.12.2
	args: --timeout=5m

	- name: Install govulncheck
	run: go install golang.org/x/vuln/cmd/govulncheck@latest

	- name: Run govulncheck
	run: govulncheck ./...
	# Informational: unfixed third-party vulns (e.g. incus) cause exit 3
	# which cannot be suppressed. Fail only on fixable vulns by reviewing output.
	continue-on-error: true

	ent-verify:
	name: ent-generated-code-check
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Set up Go
	uses: actions/setup-go@v7
	with:
	go-version-file: 'go.mod'

	- name: Regenerate Ent code
	run: make ent-generate

	- name: Check for uncommitted changes
	run: \|
	if ! git diff --exit-code ent/; then
	echo ""
	echo "ERROR: Ent generated code is out of date."
	echo "Run 'make ent-generate' and commit the result."
	exit 1
	fi

Provide feedback