chore: pin GHA by commit, switch to golangci-lint (#823)

Author: davidzhao

.github/workflows/build.yaml

@@ -24,8 +24,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/cache@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/go/pkg/mod
@@ -34,18 +34,17 @@ jobs:
           key: livekit-cli
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "1.25"
 
       - name: Download Go modules
         run: go mod download
 
-      - name: Static Check
-        uses: dominikh/staticcheck-action@v1.4.0
+      - name: Lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
         with:
-          version: "latest"
-          install-go: false
+          version: v2.11.4
 
       - name: Run Go tests
         run: go test -v ./...

.github/workflows/docker.yaml

@@ -27,15 +27,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Git LFS
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           lfs: 'true'
 
       - run: git lfs pull
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           # list of Docker images to use as base name for tags
           images: |
@@ -46,20 +46,20 @@ jobs:
             type=semver,pattern=v{{major}}.{{minor}}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push
         id: docker_build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           push: true

.github/workflows/install-test.yaml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Run installer
         run: bash install-cli.sh

.github/workflows/release.yaml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Git LFS
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           lfs: 'true'
 
@@ -70,7 +70,7 @@ jobs:
       - name: Fetch all tags
         run: git fetch --force --tags
 
-      - uses: actions/cache@v5
+      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/go/pkg/mod
@@ -79,12 +79,12 @@ jobs:
           key: livekit-cli
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "1.25"
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
         with:
           distribution: goreleaser
           version: latest

.github/workflows/test.yaml

@@ -19,23 +19,21 @@ jobs:
       packages: read
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "1.25"
           cache: true
 
       - name: Download Go modules
         run: go mod download
 
-      - name: Static Check
-        uses: dominikh/staticcheck-action@v1
+      - name: Lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
         with:
-          checks: '["all", "-ST1000", "-ST1003", "-ST1016", "-ST1020", "-ST1021", "-ST1022", "-SA1019"]'
-          version: "latest"
-          install-go: false
+          version: v2.11.4
 
       - name: Test
         shell: bash
@@ -44,7 +42,7 @@ jobs:
           go test -race -json -v ./... 2>&1 | tee test.log
 
       - name: Upload test log
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         if: always()
         with:
           name: test-log-${{ matrix.os }}

.golangci.yml

@@ -0,0 +1,16 @@
+version: "2"
+linters:
+  default: none
+  enable:
+    - staticcheck
+  settings:
+    staticcheck:
+      checks:
+        - "all"
+        - "-ST1000"
+        - "-ST1003"
+        - "-ST1016"
+        - "-ST1020"
+        - "-ST1021"
+        - "-ST1022"
+        - "-SA1019"

Makefile

@@ -36,5 +36,8 @@ check_lfs:
 	fi \
 	}
 
+lint:
+	golangci-lint run ./...
+
 fish_autocomplete: cli
 	./bin/lk generate-fish-completion -o autocomplete/fish_autocomplete

cmd/lk/agent.go

@@ -401,7 +401,7 @@ func createAgentClientWithOpts(ctx context.Context, cmd *cli.Command, opts ...lo
 func initAgent(ctx context.Context, cmd *cli.Command) error {
 	// TODO: (@rektdeckard) move compatibility flag into template index,
 	// then show template picker containing only compatible templates
-	if !(cmd.IsSet("lang") || cmd.IsSet("template") || cmd.IsSet("template-url")) {
+	if !cmd.IsSet("lang") && !cmd.IsSet("template") && !cmd.IsSet("template-url") {
 		if SkipPrompts(cmd) {
 			templateURL = "https://github.com/livekit-examples/agent-starter-python"
 		} else {
@@ -629,7 +629,7 @@ func createAgent(ctx context.Context, cmd *cli.Command) error {
 	fmt.Println("Build completed - You can view build logs later with `lk agent logs --log-type=build`")
 
 	if !silent && !SkipPrompts(cmd) {
-		var viewLogs bool = true
+		viewLogs := true
 		if err := huh.NewForm(
 			huh.NewGroup(
 				huh.NewConfirm().

cmd/lk/main.go

@@ -96,7 +96,7 @@ func main() {
 }
 
 func checkForLegacyName() {
-	if !(strings.HasSuffix(os.Args[0], "lk") || strings.HasSuffix(os.Args[0], "lk.exe")) {
+	if !strings.HasSuffix(os.Args[0], "lk") && !strings.HasSuffix(os.Args[0], "lk.exe") {
 		fmt.Fprintf(
 			os.Stderr,
 			"\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ DEPRECATION NOTICE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"+

pkg/agentfs/secrets-file.go

@@ -67,7 +67,7 @@ func DetectEnvFile(maybeFile string, skipPrompts bool) (string, map[string]strin
 		return selectedFile, env, err
 	}
 
-	var selectedFile string = extantEnvFiles[0]
+	selectedFile := extantEnvFiles[0]
 	if err := huh.NewForm(
 		huh.NewGroup(
 			huh.NewSelect[string]().