build(deps): bump the github-actions group with 4 updates (#1405)

Co-authored-by: Fernandez Ludovic <ldez@users.noreply.github.com>

.eslintrc.json

@@ -6,7 +6,7 @@
   "parser": "@typescript-eslint/parser",
   "parserOptions": {
     "ecmaVersion": 2020,
-    "sourceType": "module"
+    "sourceType": "commonjs"
   },
   "extends": [
     "eslint:recommended",

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -10,8 +10,6 @@ body:
           required: true
         - label: Yes, I've searched similar issues on GitHub and didn't find any.
           required: true
-        - label: Yes, I've included all information below (version, config, etc).
-          required: true
 
   - type: textarea
     id: problem
@@ -25,6 +23,7 @@ body:
     id: golangci-lint-version
     attributes:
       label: Version of golangci-lint
+      placeholder: golangci-lint has version 2.x.x built with go1.x.x from xxxx on xxxx-xx-xx
     validations:
       required: true
 
@@ -32,6 +31,7 @@ body:
     id: github-action-version
     attributes:
       label: Version of the GitHub Action
+      placeholder: v9.2.0
     validations:
       required: true
 
@@ -69,6 +69,7 @@ body:
     id: go-env
     attributes:
       label: Go version
+      placeholder: go1.25.8
     validations:
       required: true
 
@@ -86,3 +87,19 @@ body:
         </details>
     validations:
       required: true
+
+  - type: checkboxes
+    id: validation
+    attributes:
+      label: Validation
+      options:
+        - label: Yes, I've included all the information above (example, version, config, etc.).
+          required: true
+
+  - type: checkboxes
+    id: supporter
+    attributes:
+      label: Supporter
+      description: If you find golangci-lint valuable, consider [sponsoring the project](https://donate.golangci.org) to help sustain its development. 💛
+      options:
+        - label: I am a [sponsor/backer](https://donate.golangci.org) of this project.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -42,3 +42,11 @@ body:
       placeholder: "Add any other context or screenshots about the feature request here."
     validations:
       required: false
+
+  - type: checkboxes
+    id: supporter
+    attributes:
+      label: Supporter
+      description: If you find golangci-lint valuable, consider [sponsoring the project](https://donate.golangci.org) to help sustain its development. 💛
+      options:
+        - label: I am a [sponsor/backer](https://donate.golangci.org) of this project.

.github/dependabot.yml

@@ -3,7 +3,13 @@ updates:
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: weekly
+      interval: monthly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"  # Group all updates into a single larger pull request.
   - package-ecosystem: npm
     directory: "/"
     groups:
@@ -12,4 +18,6 @@ updates:
       dependencies:
         dependency-type: production
     schedule:
-      interval: weekly
+      interval: monthly
+    cooldown:
+      default-days: 7

.github/workflows/codeql.yaml

@@ -5,30 +5,27 @@ on:
     branches:
       - main
   pull_request:
-    # The branches below must be a subset of the branches above
     branches:
       - main
   schedule:
     - cron: '0 17 * * 5'
 
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
 jobs:
   codeQL:
-    # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
     runs-on: ubuntu-latest
-
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # Must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head of the pull request.
           # Only include this option if you are running this workflow on pull requests.
           fetch-depth: 2
+          persist-credentials: false
 
       # If this run was triggered by a pull request event then checkout
       # the head of the pull request instead of the merge commit.
@@ -38,7 +35,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         # Override language selection by uncommenting this and choosing your languages
         with:
           languages: 'javascript-typescript'
@@ -48,4 +45,4 @@ jobs:
           npm run all
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/test.yml

@@ -8,18 +8,19 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   # make sure build/ci work properly
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.x
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - run: |
           npm install
           npm run all
@@ -40,18 +41,17 @@ jobs:
         version:
           - ""
           - "latest"
-          - "v2.5"
-          - "v2.5.0"
+          - "v2.12"
+          - "v2.12.2"
     runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read
-      pull-requests: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.x
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: oldstable
       - uses: ./
@@ -73,18 +73,17 @@ jobs:
         version:
           - ""
           - "latest"
-          - "v2.5.0"
-          - "655e8ede5178280b2a640e185bc4a343aed0f54e"
+          - "v2.12.1"
+          - "c0d3ddc9cf3faa61a4e378e879ece580256d76e5"
     runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read
-      pull-requests: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.x
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: oldstable
       - uses: ./
@@ -107,14 +106,14 @@ jobs:
           - fixtures/go-mod
           - fixtures/go-tool
     runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.x
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: oldstable
       - uses: ./
@@ -135,18 +134,17 @@ jobs:
         version:
           - ""
           - "latest"
-          - "v2.5"
-          - "v2.5.0"
+          - "v2.12"
+          - "v2.12.1"
     runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read
-      pull-requests: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.x
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: oldstable
       - uses: ./
@@ -165,15 +163,14 @@ jobs:
           - macos-latest
           - windows-latest
     runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read
-      pull-requests: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.x
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: oldstable
       - uses: ./

README.md

@@ -49,14 +49,14 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version: stable
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.12
 ```
 
 </details>
@@ -87,14 +87,14 @@ jobs:
     name: lint
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go }}
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.12
 ```
 
 You will also likely need to add the following `.gitattributes` file to ensure that line endings for Windows builds are properly formatted:
@@ -120,7 +120,7 @@ on:
 
 env:
   GO_VERSION: stable
-  GOLANGCI_LINT_VERSION: v2.6
+  GOLANGCI_LINT_VERSION: v2.12
 
 jobs:
   detect-modules:
@@ -128,7 +128,7 @@ jobs:
     outputs:
       modules: ${{ steps.set-modules.outputs.modules }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -142,7 +142,7 @@ jobs:
       matrix:
         modules: ${{ fromJSON(needs.detect-modules.outputs.modules) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
@@ -179,7 +179,7 @@ jobs:
     with:
       os: ${{ matrix.os }}
       go-version: ${{ matrix.go-version }}
-      golangci-lint-version: v2.6
+      golangci-lint-version: v2.12
 ```
 
 ```yaml
@@ -201,7 +201,7 @@ on:
       golangci-lint-version:
         description: 'Golangci-lint version'
         type: string
-        default: 'v2.6'
+        default: 'v2.12'
 
 jobs:
   detect-modules:
@@ -209,7 +209,7 @@ jobs:
     outputs:
       modules: ${{ steps.set-modules.outputs.modules }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version }}
@@ -224,7 +224,7 @@ jobs:
       matrix:
         modules: ${{ fromJSON(needs.detect-modules.outputs.modules) }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version }}
@@ -247,7 +247,6 @@ You will also likely need to add the following `.gitattributes` file to ensure t
 
 * `v9.0.0` requires Nodejs runtime [`node24`](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/)
 * `v8.0.0` works with `golangci-lint` version >= `v2.1.0`
-* `v8.0.0` works with `golangci-lint` version >= `v2.1.0`
 * `v7.0.0` supports golangci-lint v2 only.
 * `v6.0.0+` removes `annotations` option, removes the default output format (`github-actions`).
 * `v5.0.0+` removes `skip-pkg-cache` and `skip-build-cache` because the cache related to Go itself is already handled by `actions/setup-go`.
@@ -297,7 +296,7 @@ When `install-mode` is:
 ```yml
 uses: golangci/golangci-lint-action@v9
 with:
-  version: v2.6
+  version: v2.12
   # ...
 ```
 
@@ -333,7 +332,7 @@ The mode to install golangci-lint: it can be `binary`, `goinstall`, or `none`.
 
 The default value is `binary`.
 
-`goinstall` is not recommended, more explanations [here](https://golangci-lint.run/docs/welcome/install/#install-from-sources).
+`goinstall` is not recommended, more explanations [here](https://golangci-lint.run/docs/welcome/install/local/#install-from-sources).
 
 <details>
 <summary>Example</summary>
@@ -617,6 +616,23 @@ with:
 
 </details>
 
+#### `no-run-logs-group`
+
+(optional)
+
+This option disables the grouping of logs from golangci-lint run.
+
+<details>
+<summary>Example</summary>
+
+```yaml
+uses: golangci/golangci-lint-action@v9
+with:
+  experimental: "no-run-logs-group"
+```
+
+</details>
+
 ## Annotations
 
 Currently, GitHub parses the action's output and creates [annotations](https://github.blog/2018-12-14-introducing-check-runs-and-annotations/).
@@ -647,6 +663,22 @@ build and run the custom version of golangci-lint.
 
 For more information, see [module plugin system](https://golangci-lint.run/docs/plugins/module-plugins/).
 
+## Tips
+
+### Using Renovate to update the golangci-lint version
+
+[Renovate](https://docs.renovatebot.com/) can update both the action and the
+`golangci-lint` version it uses via its [github-actions manager](https://docs.renovatebot.com/modules/manager/github-actions/#commonly-used-community-actions)
+which is included in presets like `config:recommended`.
+
+It can also be enabled explicitly in `renovate.json`:
+
+```json
+{
+  "enabledManagers": ["github-actions"]
+}
+```
+
 ## Performance
 
 The action was implemented with performance in mind:

action.yml

@@ -76,6 +76,7 @@ inputs:
     description: |
       Experimental options for the action.
       List of comma separated options.
+      Available options: `automatic-module-directories`, `no-run-logs-group`
     default: ""
     required: false
 runs:

eslint.config.mjs

@@ -0,0 +1,55 @@
+import { defineConfig } from "eslint/config";
+import { fixupConfigRules, fixupPluginRules } from "@eslint/compat";
+import typescriptEslint from "@typescript-eslint/eslint-plugin";
+import simpleImportSort from "eslint-plugin-simple-import-sort";
+import globals from "globals";
+import tsParser from "@typescript-eslint/parser";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import js from "@eslint/js";
+import { FlatCompat } from "@eslint/eslintrc";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const compat = new FlatCompat({
+    baseDirectory: __dirname,
+    recommendedConfig: js.configs.recommended,
+    allConfig: js.configs.all
+});
+
+export default defineConfig([{
+    extends: fixupConfigRules(compat.extends(
+        "eslint:recommended",
+        "plugin:@typescript-eslint/eslint-recommended",
+        "plugin:@typescript-eslint/recommended",
+        "plugin:import/errors",
+        "plugin:import/warnings",
+        "plugin:import/typescript",
+        "plugin:prettier/recommended",
+    )),
+
+    plugins: {
+        "@typescript-eslint": fixupPluginRules(typescriptEslint),
+        "simple-import-sort": simpleImportSort,
+    },
+
+    languageOptions: {
+        globals: {
+            ...globals.node,
+            ...globals.jest,
+        },
+
+        parser: tsParser,
+        ecmaVersion: 2020,
+        sourceType: "commonjs",
+    },
+
+    rules: {
+        "import/first": "error",
+        "import/newline-after-import": "error",
+        "import/no-duplicates": "error",
+        "simple-import-sort/imports": "error",
+        "simple-import-sort/exports": "error",
+        "sort-imports": "off",
+    },
+}]);

fixtures/plugins/.custom-gcl.yml

@@ -1,4 +1,4 @@
-version: v2.6.1
+version: v2.10.1
 name: custom-golangci-lint
 #destination: ./zzz/path/
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "golanci-lint-action",
-  "version": "8.0.0",
+  "version": "9.3.0",
   "private": true,
   "description": "golangci-lint github action",
   "main": "dist/main.js",
@@ -27,31 +27,38 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@actions/cache": "^4.1.0",
-    "@actions/core": "^1.11.1",
-    "@actions/exec": "^1.1.1",
-    "@actions/github": "^6.0.1",
+    "@actions/cache": "^5.0.3",
+    "@actions/core": "^2.0.2",
+    "@actions/exec": "^2.0.0",
+    "@actions/github": "^7.0.0",
     "@actions/http-client": "^3.0.0",
+    "@actions/tool-cache": "^3.0.0",
     "@octokit/plugin-retry": "^6.1.0",
-    "@actions/tool-cache": "^2.0.2",
-    "@types/node": "^24.10.1",
+    "@types/node": "^25.0.10",
     "@types/semver": "^7.7.1",
     "@types/tmp": "^0.2.6",
     "@types/which": "^3.0.4",
-    "tmp": "^0.2.5",
-    "which": "^6.0.0",
-    "yaml": "^2.8.2"
+    "tmp": "^0.2.7",
+    "which": "^7.0.0",
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@typescript-eslint/eslint-plugin": "^8.48.0",
+    "@eslint/compat": "^2.0.5",
+    "@eslint/eslintrc": "^3.3.5",
+    "@eslint/js": "^9.39.2",
+    "@typescript-eslint/eslint-plugin": "^8.58.1",
     "@typescript-eslint/parser": "^8.32.1",
     "@vercel/ncc": "^0.38.4",
-    "eslint": "^8.57.1",
+    "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-prettier": "^5.5.4",
+    "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-simple-import-sort": "^12.1.1",
-    "prettier": "^3.7.3",
+    "globals": "^17.5.0",
+    "prettier": "^3.8.2",
     "typescript": "^5.9.3"
+  },
+  "overrides": {
+    "undici": "^6.27.0"
   }
 }

src/run.ts

@@ -205,19 +205,31 @@ async function runLint(binPath: string): Promise<void> {
 
   const experimental = core.getInput(`experimental`).split(`,`)
 
+  const noGroup = experimental.includes(`no-run-logs-group`)
+
   if (experimental.includes(`automatic-module-directories`)) {
     const wds = modulesAutoDetection(workingDirectory)
 
     const cwd = process.cwd()
 
     for (const wd of wds) {
-      await core.group(`run golangci-lint in ${path.relative(cwd, wd)}`, () => runGolangciLint(binPath, wd))
+      await optionalGroup(noGroup, `run golangci-lint in ${path.relative(cwd, wd)}`, () => runGolangciLint(binPath, wd))
     }
 
     return
   }
 
-  await core.group(`run golangci-lint`, () => runGolangciLint(binPath, workingDirectory))
+  await optionalGroup(noGroup, `run golangci-lint`, () => runGolangciLint(binPath, workingDirectory))
+}
+
+async function optionalGroup<T>(noGroup: boolean, name: string, fn: () => Promise<T>): Promise<T> {
+  if (noGroup) {
+    core.info(name)
+
+    return fn()
+  }
+
+  return core.group(name, fn)
 }
 
 export async function run(): Promise<void> {