Update GitHub Actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout (changelog)	action	digest	de0fac2 → d23441a
actions/checkout	action	minor	v6.0.2 → v6.1.0
actions/create-github-app-token	action	minor	v3.1.1 → v3.2.0	v3.3.0
actions/setup-go (changelog)	action	digest	4a36011 → 924ae3a
actions/setup-go	action	minor	v6.4.0 → v6.5.0
docker/login-action (changelog)	action	digest	4907a6d → dbcb813
docker/setup-buildx-action (changelog)	action	digest	4d04d5d → f87e599
docker/setup-qemu-action (changelog)	action	digest	ce36039 → 9901266
golangci/golangci-lint	uses-with	minor	v2.12.1 → v2.14.0	v2.15.0
golangci/golangci-lint-action	action	minor	v9.2.0 → v9.3.0

---

Release Notes

actions/checkout

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

actions/create-github-app-token

v3.2.0

Compare Source

Features

• add support for enterprise-level GitHub Apps (#​263) (952a2a7)
• support full repository names in repositories input (#​372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#​364) (43e5c34)
• validate private-key input (#​376) (f24bbd8)

actions/setup-go

v6.5.0

Compare Source

What's Changed

Dependency update

• Upgrade actions dependencies by @​priyagupta108 with @​Copilot in #​744
• Upgrade @​types/node and typescript-eslint dependencies to resolve npm audit findings by @​HarithaVattikuti in #​755
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​758
• Upgrade version to 6.5.0 in package.json and package-lock.json by @​HarithaVattikuti in #​762

New Contributors

• @​priyagupta108 with @​Copilot made their first contribution in #​744
• @​jasongin made their first contribution in #​758

Full Changelog: actions/setup-go@v6...v6.5.0

golangci/golangci-lint

v2.14.0

Compare Source

Released on 2026-09-24

1. Bug fixes
   • fix: cache of facts reloading
2. Linters new features or changes
   • bodyclose: from 73d1f95 to 857993a (new directive handled)
   • exhaustive: from 0.12.0 to 0.13.0
   • exhaustruct_v5: from 5.0.3 to 5.2.0 (new option: allow-empty-blank-assignments)
   • go-check-sumtype: from 0.3.1 to ae6904d
   • gocritic: from 0.14.4 to 0.15.0
   • gofumpt: from 0.11.0 to 0.12.0
   • gomoddirectives: from 0.9.0 to 0.10.0
   • gosec: from 2.28.0 to 2.29.0 (re-enable G407)
   • govet-modernize: from 0.49.0 to 0.50.0
   • loggercheck: from 0.11.0 to 0.12.0
   • revive: from 1.15.0 to 1.17.0 (new rules: marshal-receiver, multiline-if-init, use-slices-concat)
   • tagliatelle: from 0.7.2 to 0.8.0
3. Linters bug fixes
   • fatcontext: from 0.10.0 to 0.10.1
   • flock: from 0.13.0 to 0.13.1
   • godoclint: from 0.11.2 to 0.11.4
   • protogetter: from 0.3.21 to 1.0.1
   • recvcheck: from 0.3.0 to 0.3.1
   • tagalign: from 1.4.3 to 1.4.4

v2.13.2

Compare Source

Released on 2026-08-28

1. Bug fixes
   • Decrease cache entropy
2. Linters bug fixes
   • iface: from 1.5.0 to 1.5.1
   • staticcheck: from 0.8.0 to 0.8.1
   • unparam: from 3f964bc to 2fa3d84
   • canonicalheader: from v1.1.2 to a temporary fork

v2.13.1

Compare Source

Released on 2026-08-20

1. Linters bug fixes
   • ginkgolinter: from 0.23.1 to 0.24.0
   • gofmt: from d62b90e to e84e050
   • staticcheck: from 0.8.0-rc.1 to 0.8.0
   • wsl_v5: from 5.8.0 to 5.9.0

v2.13.0

Compare Source

Released on 2026-08-19

1. Enhancements
   • 🎉 go1.27 support
2. Bug fixes
   • fix: cache package facts
3. Linters new features or changes
   • dupword: from 0.1.7 to 0.1.8 (new option skip-raw-strings)
   • errcheck: from 1.10.0 to 1.20.0
   • exhaustruct_v5: from 4.0.0 to 5.0.2 (new configuration)
   • exhaustruct: deprecated and replaced by exhaustruct_v5
   • fatcontext: from 0.9.0 to 0.10.0 (new options: check-loops, check-function-literals)
   • goconst: from 1.10.0 to 1.11.0 (new options: ignore-map-keys, exclude-types)
   • gofumpt: from 0.9.2 to 0.11.0 (new options: extra.group-params, extra.clothe-returns, extra.balance-calls)
   • gomoddirectives: from 0.8.0 to 0.9.0 (new option: replace-allow-all)
   • gosec: from 2.26.1 to 2.27.1
   • govet-modernize: from 0.44.0 to 0.49.0 (fmtappendf is removed. New analyzers atomictypes, embedlit, errorsastype, importcomment, reflecttypeassert, slicesclip, and slicesbackward. waitgroup is renamed waitgroupgo)
   • iface: from 1.4.3 to 1.5.0 (new analyzer: unusedmethod)
   • noinlineerr: from 1.0.5 to 1.0.6
   • nonamedreturns: from 1.0.6 to 1.0.8 (new option: allow-unused-named-returns)
   • recvcheck: from 0.2.0 to 0.3.0 (new default exclusions)
   • unparam: from 5beb8c8 to 3f964bc
4. Linters bug fixes
   • clickhouse-go-linter: from 1.2.0 to 1.2.1
   • errname: from 1.1.1 to 1.1.2
   • exhaustruct_v5: from 5.0.2 to 5.0.3
   • funcorder: add missing Function field
   • ginkgolinter: from 0.23.0 to 0.23.1
   • gocheckcompilerdirectives: from 1.3.0 to 1.4.0
   • gocritic: from 0.14.3 to 0.14.4
   • gomoddirectives: add missing IgnoreForbidden field
   • iface: from 1.4.2 to 1.4.3
   • mirror: from 1.3.0 to 1.3.3
   • nilnil: from 1.1.1 to 1.1.2
   • protogetter: from 0.3.20 to 0.3.21

v2.12.2

Compare Source

Released on 2026-05-06

1. Linters bug fixes
   • gomodguard_v2: fix blocked configuration
   • gomodguard_v2: from 2.1.0 to 2.1.3
   • iface: from 1.4.1 to 1.4.2

golangci/golangci-lint-action

v9.3.0

Compare Source

What's Changed

Changes

• feat: add no-run-logs-group as experimental option by @​ldez in #​1403

Dependencies

• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the github-actions group by @​dependabot[bot] in #​1395
• build(deps): bump tmp from 0.2.5 to 0.2.6 by @​dependabot[bot] in #​1397
• build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-actions group by @​dependabot[bot] in #​1398
• build(deps): bump tmp from 0.2.6 to 0.2.7 by @​dependabot[bot] in #​1399
• build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in #​1400

Full Changelog: golangci/golangci-lint-action@v9.2.1...v9.3.0

v9.2.1

Compare Source

What's Changed

IMPORTANT: this is the first immutable release.

Changes

• chore: improve workflows by @​ldez in #​1394

Dependencies

• build(deps-dev): bump the dev-dependencies group with 3 updates by @​dependabot[bot] in #​1325
• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot[bot] in #​1326
• build(deps): bump the dependencies group with 4 updates by @​dependabot[bot] in #​1327
• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot[bot] in #​1328
• build(deps): bump @​types/node from 25.0.2 to 25.0.3 in the dependencies group by @​dependabot[bot] in #​1329
• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot[bot] in #​1330
• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot[bot] in #​1332
• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot[bot] in #​1333
• build(deps): bump the dependencies group with 6 updates by @​dependabot[bot] in #​1334
• build(deps-dev): bump the dev-dependencies group with 4 updates by @​dependabot[bot] in #​1335
• build(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in #​1336
• build(deps-dev): bump the dev-dependencies group with 3 updates by @​dependabot[bot] in #​1337
• build(deps): bump @​types/node from 25.0.9 to 25.0.10 in the dependencies group by @​dependabot[bot] in #​1338
• build(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 by @​dependabot[bot] in #​1339
• build(deps-dev): bump the dev-dependencies group with 2 updates by @​dependabot[bot] in #​1340
• build(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​1344
• build(deps): bump fast-xml-parser from 5.3.4 to 5.3.6 by @​dependabot[bot] in #​1346
• build(deps): bump minimatch by @​dependabot[bot] in #​1348
• build(deps): bump minimatch from 3.1.3 to 3.1.5 by @​dependabot[bot] in #​1350
• build(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 by @​dependabot[bot] in #​1351
• build(deps): bump fast-xml-parser from 5.4.1 to 5.5.6 by @​dependabot[bot] in #​1357
• build(deps): bump fast-xml-parser from 5.5.6 to 5.5.7 by @​dependabot[bot] in #​1358
• build(deps-dev): bump flatted from 3.3.3 to 3.4.2 by @​dependabot[bot] in #​1359
• build(deps): bump picomatch from 4.0.3 to 4.0.4 by @​dependabot[bot] in #​1364
• build(deps): bump yaml from 2.8.2 to 2.8.3 by @​dependabot[bot] in #​1365
• build(deps): bump brace-expansion by @​dependabot[bot] in #​1370
• build(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates by @​ldez in #​1374
• build(deps): bump github/codeql-action from 4 to 4.35.2 by @​dependabot[bot] in #​1384
• build(deps): bump fast-xml-builder from 1.1.5 to 1.2.0 by @​dependabot[bot] in #​1386
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @​dependabot[bot] in #​1389
• build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @​dependabot[bot] in #​1391

Full Changelog: golangci/golangci-lint-action@v9.2.0...v9.2.1

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.