CI pinned to Go 1.22 and golangci-lint v1.56.2 blocks all Go dependency updates #1462

What happened?

Five Dependabot PRs are stuck because Golang Lint and Unit tests with coverage fail on every one of them:

• chore(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.19.2 #1452 go-git 5.13.0 to 5.19.2 (run https://github.com/KusionStack/kusion/actions/runs/32545277078)
• chore(deps): bump golang.org/x/crypto from 0.31.0 to 0.52.0 #1454 x/crypto 0.31.0 to 0.52.0 (run https://github.com/KusionStack/kusion/actions/runs/32545284802)
• chore(deps): bump google.golang.org/grpc from 1.69.0 to 1.83.1 #1457 grpc 1.69.0 to 1.83.1 (run https://github.com/KusionStack/kusion/actions/runs/33594898558)
• chore(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.2 #1459 oras-go 2.5.0 to 2.6.2 (run https://github.com/KusionStack/kusion/actions/runs/35257493310)
• chore(deps): bump github.com/containerd/containerd from 1.7.23 to 1.7.36 #1460 containerd 1.7.23 to 1.7.36 (run https://github.com/KusionStack/kusion/actions/runs/36183219532)

Several of these are security-relevant (x/crypto, grpc, containerd).

What did you expect to happen?

Dependabot PRs that raise go.mod to go 1.25.0 should pass CI and be mergeable.

Why it fails

The new dependency versions need Go 1.25, so each PR raises go.mod from go 1.22.1 to go 1.25.0. The #1451 description already pointed this out for go-git v5.19.2.

CI is pinned to Go 1.22 (actions/setup-go@v2, go-version: 1.22) and golangci-lint v1.56.2 in .github/workflows/test.yaml, e2e-test.yml and release.yaml, and the Dockerfile uses golang:1.22.

With go 1.25.0 in go.mod:

1. golangci-lint v1 cannot type check the code:

   could not import k8s.io/apimachinery/pkg/types (-: could not load export data: internal error in importing "k8s.io/apimachinery/pkg/types" (unsupported version: 2); please report an issue) (typecheck)
   

   Even the last v1 release, v1.64.8, refuses: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0).
2. go vet under the newer toolchain reports slog calls with a missing key (pkg/server/route/route.go, pkg/server/handler/endpoint/endpoint.go) and non-constant format strings (pkg/engine/operation/watch.go, tfops/tferrors.go, models/change.go, third_party/dyff/output_human.go).
3. After that, test binaries fail to link on Go 1.23 and later, because mockey v1.2.10 uses a blocked go:linkname:

   link: github.com/bytedance/mockey/internal/monkey/common: invalid reference to runtime.sysAllocOS
   

The workflows also use actions/checkout@v2/v3, actions/setup-go@v2 and golangci-lint-action@v3. The runner already warns that their Node 20 runtime is deprecated and is forced onto Node 24.

How can we reproduce it?

Open any of the PRs above and look at the Golang Lint and Unit tests with coverage jobs, or check out #1460 locally and run golangci-lint v1.56.2 or v1.64.8.

Proposed fix

• Move CI and the Dockerfile to Go 1.26 (the oldest Go release that still gets security fixes, and at least the 1.25 the dependencies need).
• Move to golangci-lint v2 and migrate .golangci.yml, keeping the current rule set.
• Fix the vet and lint findings, which are small and mechanical.
• Bump mockey to v1.4.6.
• Update the GitHub actions to their current majors.

I have a branch ready that does this and passes lint and unit tests on my fork, both on its own and with #1460 applied on top. I am happy to open the PR.

@ruquanzhao, you merged #1451, which first noted the Go 1.25 requirement. Would this approach work for you?

Kusion version

main at 7524b14