ci: 升级 GitHub Actions 到 Node 24 并修复 golangci-lint

[Colin-XKL]

问题

近期 Lint workflow 在 dev 上失败，同时 GitHub Actions 提示 Node.js 20 已弃用。

Lint 失败根因： golangci/golangci-lint-action@v6 安装的仍是 golangci-lint v1.64.8（用 Go 1.24 构建）。项目 go.mod 的 toolchain 是 go1.25.13，因此报错：

can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.13)

Node 20 弃用： runner 已默认用 Node 24 强制执行仍声明 node20 的 action，例如 actions/checkout@v4、actions/setup-go@v5、golangci-lint-action@v6、docker/setup-buildx-action@v3、docker/metadata-action@v5。

改动

• 将 checkout / setup-go / setup-node 升到 v7（Node 24 runtime），前端 Node 版本改为 24
• golangci-lint-action 升到 v9，安装 golangci-lint v2.12.2（install-only），由 task fix 实际执行
• Docker publish 相关 action 升到 Node 24 版本（buildx v4.2.0、metadata v6.2.0、login v4.6.0、build-push v7.3.0、cosign-installer v4.1.2）
• OSSAR 升到 v2（上游仍声明 node20，这是目前最新可用版本；runner 会强制用 Node 24）
• task lint 为 golangci-lint 增加 --timeout=10m

验证

本 PR 上 GitHub Actions 已全部通过：

• Format and Lint：通过（golangci-lint v2.12.2，Node v24.18.0，无 Node 20 弃用警告）
• Golang Test：通过
• Docker Build & Release：通过

说明

github/ossar-action@v2 仍声明 Node 20，暂无 Node 24 版本。其余 JavaScript action 均已切到 using: node24。

  

Summary by Sourcery

Update CI workflows to use Node 24-compatible GitHub Actions and align golangci-lint with the project Go toolchain.

CI:

• Upgrade checkout, setup-go, and setup-node actions across workflows to their Node 24-compatible v7 versions.
• Update golangci-lint GitHub Action to v9 with a fixed golangci-lint version and install-only usage in the lint workflow.
• Refresh Docker-related GitHub Actions (buildx, login, metadata, build-push, cosign-installer) to their latest Node 24-compatible releases in the Docker publish workflow.
• Bump OSSAR GitHub Action to v2 while retaining compatibility with the current runner setup.

Tests:

• Increase golangci-lint execution timeout in the task-based lint command to reduce flaky failures for Go linting.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
feed-craft-admin	Ready	Preview	Aug 14, 2026 6:48am
feed-craft-doc	Ready	Preview	Aug 14, 2026 6:48am

[sourcery-ai]

Reviewer's Guide

This PR updates GitHub Actions workflows to use Node 24–compatible action versions, fixes golangci-lint compatibility with the project’s Go toolchain, and adjusts the local lint task to match the CI configuration.

Sequence diagram for updated lint workflow using install-only golangci-lint

sequenceDiagram
  actor Developer
  participant GitHubActions
  participant golangci_lint_action_v9
  participant task_lint
  participant golangci_lint_binary

  Developer->>GitHubActions: push or PR triggers lint_workflow
  GitHubActions->>golangci_lint_action_v9: uses golangci/golangci-lint-action@v9 version v2.12.2 install-only true
  golangci_lint_action_v9-->>GitHubActions: golangci-lint v2.12.2 installed
  GitHubActions->>task_lint: run task lint
  task_lint->>golangci_lint_binary: golangci-lint run ./... --timeout=10m

Loading

File-Level Changes

Change	Details	Files
Update lint workflow to Node 24-compatible actions and pin golangci-lint while delegating execution to Taskfile.	Bump actions/checkout from v4 to v7 in the lint workflow. Bump actions/setup-go from v5 to v7 with Go 1.25.13 and no cache. Upgrade golangci/golangci-lint-action from v6 to v9, pinning golangci-lint to v2.12.2 and using install-only mode. Upgrade pnpm/action-setup from v6 to v10. Bump actions/setup-node from v4 to v7 and change node-version from 22 to 24 with pnpm cache.	.github/workflows/lint.yml
Update Docker publish workflow to Node 24-compatible Docker and cosign actions, keeping versions pinned by commit SHA.	Bump actions/checkout from v5 to v7 in docker-publish workflow. Update sigstore/cosign-installer to commit for v4.1.2. Upgrade docker/setup-buildx-action to v4.2.0 via pinned commit. Upgrade docker/login-action to v4.6.0 via pinned commit for both extra registry and Docker Hub login. Upgrade docker/metadata-action to v6.2.0 via pinned commit. Upgrade docker/build-push-action to v7.3.0 via pinned commit.	.github/workflows/docker-publish.yml
Update Go test workflow to use Node 24-compatible checkout and setup-go actions.	Bump actions/checkout from v4 to v7 in go-test workflow. Bump actions/setup-go from v5 to v7 with Go 1.25.13 and cache enabled.	.github/workflows/go-test.yml
Update OSSAR workflow to latest available action versions while staying compatible with Node 24 runner behavior.	Bump actions/checkout from v5 to v7 in ossar workflow. Upgrade github/ossar-action from v1 to v2 while noting upstream still declares node20.	.github/workflows/ossar.yml
Align local Go lint task behavior with CI by adding an explicit timeout to golangci-lint runs.	Change Taskfile golangci-lint invocation to include --timeout=10m in the task lint command.	Taskfile.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.