ci: enforce that the two golangci-lint pins agree

[bryanbeverly]

Note

Authorship: this pull request description, and the code changes it describes, were drafted by Cursor (an AI coding assistant) on behalf of @bryanbeverly, who reviewed them before opening the PR.

What changed

Adds scripts/check_lint_pins.py and a lint-pin-consistency job in .github/workflows/lint.yml that runs it.

golangci-lint is pinned twice — as the version input to golangci-lint-action in .github/workflows/lint.yml, and as GOLANGCI_LINT_VERSION in scripts/lint.sh. Both files say the two must match. Nothing enforced it.

The check does two things:

1. Asserts the pins are equal and concrete. This catches drift however it arrives, including a hand edit Renovate was never involved in, and rejects floating values like latest or a bare v2 that read like a pin but aren't.
2. Applies the regex from .github/renovate.json to scripts/lint.sh and requires it to match. It also checks the datasource, the target file, and the grouping rule.

Why it changed

The pins have drifted twice: v2.12.2 in the workflow against v2.11.4 in the script, then v2.13.1 against v2.12.2. The second was more than cosmetic — go1.27 support arrived in golangci-lint v2.13.0, so make lint on the stale pin failed outright for anyone on that toolchain.

1bc0db6b5 fixed the bumping gap with a Renovate custom manager. This PR addresses the quieter gap that fix introduced: a regex that stops matching fails open. Renovate reports no dependency rather than an error, so reshaping that assignment — single quotes, a readonly wrapper, interpolation — would silently resume bumping the workflow alone, with nothing to notice. Since the custom manager is currently the only thing holding these two files together, that failure mode is the whole exposure rather than an inconvenience.

Worth noting where this came from: the sibling repo slack-integration-service has the same double-pin, and a guard comparing the two pins has been catching drift there since dc636205. Its Renovate PRs go red rather than quietly wrong. This ports that backstop here.

Design notes

• Standard library only, and no YAML parsing. The workflow pin is read as text. PyYAML is not installed on a bare ubuntu-latest runner, and this check shouldn't need a dependency install step to run.
• Python rather than a shell script, because the job is JSON parsing plus a PCRE named-group regex. scripts/test/diff_corpora_results.py is the precedent for a Python helper invoked from CI.
• One translation is applied to Renovate's regex before use: (?<currentValue> becomes (?P<currentValue>. Renovate matches with RE2, which accepts both spellings; Python's re accepts only the latter. Renaming the group is the entire translation and does not change what the pattern matches.
• managerFilePatterns is honored in both spellings — a slash-wrapped regex or a glob — rather than assuming the form currently in the config.
• Both NOTE comments now name the enforcing check, and say plainly that the version half is enforced while the args half is not.

Deliberately not in this PR

The NOTE comments claim "Version and args must match." Only the version is enforced here. LINT_ARGS (--enable bodyclose,copyloopvar,misspell --timeout 10m) is duplicated across the same two files with no bot in the loop and no check, so it can still drift silently. Worth a follow-up; it's a different kind of comparison and didn't belong in the same change.

How it was validated

Nine cases, each confirmed to fail for the intended reason or pass when it should:

Case	Expected
Workflow bumped, script left behind	fail
Script pin reshaped to single quotes	fail
Script pin wrapped in readonly (still tracked)	pass
customManager deleted	fail
Grouping packageRule deleted	fail
Manager retargeted at the wrong file	fail
Workflow pin floated to latest	fail
Regex-form managerFilePatterns	pass
Clean baseline	pass

The single-quote case is the one that matters most: it's the fail-open scenario, and it's now caught.

actionlint is clean on the modified workflow.

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7963209. Configure here.}