build(deps): bump the dependencies group across 1 directory with 8 updates

Bumps the dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache) | `5.0.3` | `6.0.0` |
| [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) | `2.0.2` | `3.0.0` |
| [@actions/exec](https://github.com/actions/toolkit/tree/HEAD/packages/exec) | `2.0.0` | `3.0.0` |
| [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) | `7.0.0` | `9.0.0` |
| [@actions/tool-cache](https://github.com/actions/toolkit/tree/HEAD/packages/tool-cache) | `3.0.0` | `4.0.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.0.10` | `25.2.3` |
| [which](https://github.com/npm/node-which) | `6.0.0` | `6.0.1` |



Updates `@actions/cache` from 5.0.3 to 6.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache)

Updates `@actions/core` from 2.0.2 to 3.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core)

Updates `@actions/exec` from 2.0.0 to 3.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/exec/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/exec)

Updates `@actions/github` from 7.0.0 to 9.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)

Updates `@actions/http-client` from 3.0.1 to 3.0.2
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/http-client/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/http-client)

Updates `@actions/tool-cache` from 3.0.0 to 4.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/tool-cache/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/@actions/cache@4.0.0/packages/tool-cache)

Updates `@types/node` from 25.0.10 to 25.2.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `which` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/npm/node-which/releases)
- [Changelog](https://github.com/npm/node-which/blob/main/CHANGELOG.md)
- [Commits](https://github.com/npm/node-which/compare/v6.0.0...v6.0.1)

---
updated-dependencies:
- dependency-name: "@actions/cache"
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@actions/core"
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@actions/exec"
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@actions/github"
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@actions/http-client"
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@actions/tool-cache"
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 25.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: which
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

.eslintrc.json

@@ -6,7 +6,7 @@
   "parser": "@typescript-eslint/parser",
   "parserOptions": {
     "ecmaVersion": 2020,
-    "sourceType": "module"
+    "sourceType": "commonjs"
   },
   "extends": [
     "eslint:recommended",

.github/workflows/codeql.yaml

@@ -11,6 +11,11 @@ on:
   schedule:
     - cron: '0 17 * * 5'
 
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 jobs:
   codeQL:
     # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
@@ -18,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           # Must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head of the pull request.
@@ -36,7 +41,7 @@ jobs:
         uses: github/codeql-action/init@v4
         # Override language selection by uncommenting this and choosing your languages
         with:
-          language: 'javascript'
+          languages: 'javascript-typescript'
 
       - run: |
           npm install

.github/workflows/test.yml

@@ -1,5 +1,6 @@
 name: "build-and-test"
-on: # rebuild any PRs and main branch changes
+
+on:
   pull_request:
     branches:
       - main
@@ -7,22 +8,27 @@ on: # rebuild any PRs and main branch changes
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
-  build: # make sure build/ci work properly
+  # make sure build/ci work properly
+  build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - run: |
           npm install
           npm run all
 
-      # Fail the build if there is dirty change
+      # Fail the build if there are changes.
       - run: git diff --exit-code -- dist
 
-  test: # make sure the action works on a clean machine without building
+  # make sure the action works on a clean machine without building
+  test:
     needs: [ build ]
     strategy:
       matrix:
@@ -34,14 +40,14 @@ jobs:
         version:
           - ""
           - "latest"
-          - "v2.5"
+          - "v2.10"
-          - "v2.5.0"
+          - "v2.10.1"
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -51,10 +57,11 @@ jobs:
       - uses: ./
         with:
           version: ${{ matrix.version }}
-          args: --timeout=5m --issues-exit-code=0 ./sample/...
+          args: --timeout=5m --issues-exit-code=0 ./fixtures/simple/...
           only-new-issues: true
 
-  test-go-install: # make sure the action works on a clean machine without building (go-install mode)
+  # make sure the action works on a clean machine without building (go-install mode)
+  test-go-install:
     needs: [ build ]
     strategy:
       matrix:
@@ -66,14 +73,14 @@ jobs:
         version:
           - ""
           - "latest"
-          - "v2.5.0"
+          - "v2.10.1"
-          - "655e8ede5178280b2a640e185bc4a343aed0f54e"
+          - "f8861ca84d805a673945d037bae1559c3567aadc"
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -83,7 +90,7 @@ jobs:
       - uses: ./
         with:
           version: ${{ matrix.version }}
-          args: --timeout=5m --issues-exit-code=0 ./sample/...
+          args: --timeout=5m --issues-exit-code=0 ./fixtures/simple/...
           only-new-issues: true
           install-mode: goinstall
 
@@ -97,13 +104,13 @@ jobs:
           - macos-latest
           - windows-latest
         wd:
-          - sample-go-mod
+          - fixtures/go-mod
-          - sample-go-tool
+          - fixtures/go-tool
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -115,7 +122,8 @@ jobs:
           working-directory: ${{ matrix.wd }}
           args: --timeout=5m --issues-exit-code=0 ./...
 
-  test-plugins: # make sure the action works on a clean machine with plugins
+  # make sure the action works on a clean machine with plugins
+  test-plugins:
     needs: [ build ]
     strategy:
       matrix:
@@ -127,14 +135,14 @@ jobs:
         version:
           - ""
           - "latest"
-          - "v2.5"
+          - "v2.10"
-          - "v2.5.0"
+          - "v2.10.1"
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -144,7 +152,7 @@ jobs:
       - uses: ./
         with:
           version: ${{ matrix.version }}
-          working-directory: sample-plugins
+          working-directory: fixtures/plugins
           args: --timeout=5m --issues-exit-code=0 ./...
 
   test-monorepo:
@@ -161,7 +169,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -170,6 +178,6 @@ jobs:
           go-version: oldstable
       - uses: ./
         with:
-          working-directory: sample-monorepo
+          working-directory: fixtures/monorepo
           experimental: "automatic-module-directories"
           args: --timeout=5m --issues-exit-code=0 ./...

README.md

@@ -56,7 +56,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.10
 ```
 
 </details>
@@ -94,7 +94,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.6
+          version: v2.10
 ```
 
 You will also likely need to add the following `.gitattributes` file to ensure that line endings for Windows builds are properly formatted:
@@ -120,7 +120,7 @@ on:
 
 env:
   GO_VERSION: stable
-  GOLANGCI_LINT_VERSION: v2.6
+  GOLANGCI_LINT_VERSION: v2.10
 
 jobs:
   detect-modules:
@@ -179,7 +179,7 @@ jobs:
     with:
       os: ${{ matrix.os }}
       go-version: ${{ matrix.go-version }}
-      golangci-lint-version: v2.6
+      golangci-lint-version: v2.10
 ```
 
 ```yaml
@@ -201,7 +201,7 @@ on:
       golangci-lint-version:
         description: 'Golangci-lint version'
         type: string
-        default: 'v2.6'
+        default: 'v2.10'
 
 jobs:
   detect-modules:
@@ -261,21 +261,22 @@ You will also likely need to add the following `.gitattributes` file to ensure t
 
 ### Overview
 
-| Option                                                        | Description                                        |
+| Option                                                        | Description                                           |
-|---------------------------------------------------------------|----------------------------------------------------|
+|---------------------------------------------------------------|-------------------------------------------------------|
-| [`version`](#version)                                         | The version of golangci-lint to use.               |
+| [`version`](#version)                                         | The version of golangci-lint to use.                  |
-| [`install-mode`](#install-mode)                               | The mode to install golangci-lint.                 |
+| [`version-file`](#version-file)                               | Gets the version of golangci-lint to use from a file. |
-| [`install-only`](#install-only)                               | Only install golangci-lint.                        |
+| [`install-mode`](#install-mode)                               | The mode to install golangci-lint.                    |
-| [`verify`](#verify)                                           | Validates golangci-lint configuration file.        |
+| [`install-only`](#install-only)                               | Only install golangci-lint.                           |
-| [`github-token`](#github-token)                               | Used by the `only-new-issues` option.              |
+| [`verify`](#verify)                                           | Validates golangci-lint configuration file.           |
-| [`only-new-issues`](#only-new-issues)                         | Show only new issues.                              |
+| [`github-token`](#github-token)                               | Used by the `only-new-issues` option.                 |
-| [`working-directory`](#working-directory)                     | The golangci-lint working directory.               |
+| [`only-new-issues`](#only-new-issues)                         | Show only new issues.                                 |
-| [`args`](#args)                                               | Golangci-lint command line arguments.              |
+| [`working-directory`](#working-directory)                     | The golangci-lint working directory.                  |
-| [`skip-cache`](#skip-cache)                                   | Disable cache support.                             |
+| [`args`](#args)                                               | Golangci-lint command line arguments.                 |
-| [`skip-save-cache`](#skip-save-cache)                         | Don't save cache.                                  |
+| [`skip-cache`](#skip-cache)                                   | Disable cache support.                                |
-| [`cache-invalidation-interval`](#cache-invalidation-interval) | Number of days before cache invalidation.          |
+| [`skip-save-cache`](#skip-save-cache)                         | Don't save cache.                                     |
-| [`problem-matchers`](#problem-matchers)                       | Forces the usage of the embedded problem matchers. |
+| [`cache-invalidation-interval`](#cache-invalidation-interval) | Number of days before cache invalidation.             |
-| [Experimental](#experimental)                                 | Experimental options                               |
+| [`problem-matchers`](#problem-matchers)                       | Forces the usage of the embedded problem matchers.    |
+| [Experimental](#experimental)                                 | Experimental options                                  |
 
 ### Installation
 
@@ -296,7 +297,29 @@ When `install-mode` is:
 ```yml
 uses: golangci/golangci-lint-action@v9
 with:
-  version: v2.6
+  version: v2.10
+  # ...
+```
+
+</details>
+
+#### `version-file`
+
+Gets the version of golangci-lint to use from a file.
+
+The path must be relative to the root of the project, or the `working-directory` if defined.
+
+This parameter supports `.golangci-lint-version`, and `.tool-versions` files.
+
+Only works with `install-mode: binary` (the default).
+
+<details>
+<summary>Example</summary>
+
+```yml
+uses: golangci/golangci-lint-action@v9
+with:
+  version-file: .tool-versions
   # ...
 ```
 

action.yml

@@ -11,6 +11,13 @@ inputs:
       - `goinstall`: the value can be v2.3.4, `latest`, or the hash of a commit.
       - `none`: the value is ignored.
     required: false
+  version-file:
+    description: |
+      Gets the version of golangci-lint to use from a file.
+      The path must be relative to the root of the project, or the `working-directory` if defined.
+      This parameter supports `.golangci-lint-version`, and `.tool-versions` files.
+      Only works with `install-mode: binary` (the default).
+    required: false
   install-mode:
     description: "The mode to install golangci-lint. It can be 'binary', 'goinstall', or 'none'."
     default: "binary"

eslint.config.mjs

@@ -0,0 +1,55 @@
+import { defineConfig } from "eslint/config";
+import { fixupConfigRules, fixupPluginRules } from "@eslint/compat";
+import typescriptEslint from "@typescript-eslint/eslint-plugin";
+import simpleImportSort from "eslint-plugin-simple-import-sort";
+import globals from "globals";
+import tsParser from "@typescript-eslint/parser";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import js from "@eslint/js";
+import { FlatCompat } from "@eslint/eslintrc";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const compat = new FlatCompat({
+    baseDirectory: __dirname,
+    recommendedConfig: js.configs.recommended,
+    allConfig: js.configs.all
+});
+
+export default defineConfig([{
+    extends: fixupConfigRules(compat.extends(
+        "eslint:recommended",
+        "plugin:@typescript-eslint/eslint-recommended",
+        "plugin:@typescript-eslint/recommended",
+        "plugin:import/errors",
+        "plugin:import/warnings",
+        "plugin:import/typescript",
+        "plugin:prettier/recommended",
+    )),
+
+    plugins: {
+        "@typescript-eslint": fixupPluginRules(typescriptEslint),
+        "simple-import-sort": simpleImportSort,
+    },
+
+    languageOptions: {
+        globals: {
+            ...globals.node,
+            ...globals.jest,
+        },
+
+        parser: tsParser,
+        ecmaVersion: 2020,
+        sourceType: "commonjs",
+    },
+
+    rules: {
+        "import/first": "error",
+        "import/newline-after-import": "error",
+        "import/no-duplicates": "error",
+        "simple-import-sort/imports": "error",
+        "simple-import-sort/exports": "error",
+        "sort-imports": "off",
+    },
+}]);

fixtures/go-mod/go.mod

@@ -1,4 +1,4 @@
-module sample
+module github.com/golangci/sample
 
 go 1.24.0
 

fixtures/go-tool/go.mod

@@ -1,4 +1,4 @@
-module sample
+module github.com/golangci/sample
 
 go 1.24.0
 

fixtures/plugins/.custom-gcl.yml

@@ -1,4 +1,4 @@
-version: v2.6.1
+version: v2.10.1
 name: custom-golangci-lint
 #destination: ./zzz/path/
 

package.json

@@ -27,31 +27,35 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@actions/cache": "^4.1.0",
+    "@actions/cache": "^6.0.0",
-    "@actions/core": "^1.11.1",
+    "@actions/core": "^3.0.0",
-    "@actions/exec": "^1.1.1",
+    "@actions/exec": "^3.0.0",
-    "@actions/github": "^6.0.1",
+    "@actions/github": "^9.0.0",
     "@actions/http-client": "^3.0.0",
+    "@actions/tool-cache": "^4.0.0",
     "@octokit/plugin-retry": "^6.1.0",
-    "@actions/tool-cache": "^2.0.2",
+    "@types/node": "^25.3.2",
-    "@types/node": "^24.10.1",
     "@types/semver": "^7.7.1",
     "@types/tmp": "^0.2.6",
     "@types/which": "^3.0.4",
     "tmp": "^0.2.5",
-    "which": "^6.0.0",
+    "which": "^6.0.1",
-    "yaml": "^2.8.1"
+    "yaml": "^2.8.2"
   },
   "devDependencies": {
-    "@typescript-eslint/eslint-plugin": "^8.46.4",
+    "@eslint/compat": "^2.0.2",
+    "@eslint/eslintrc": "^3.3.3",
+    "@eslint/js": "^9.39.2",
+    "@typescript-eslint/eslint-plugin": "^8.55.0",
     "@typescript-eslint/parser": "^8.32.1",
     "@vercel/ncc": "^0.38.4",
-    "eslint": "^8.57.1",
+    "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-prettier": "^5.5.4",
+    "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-simple-import-sort": "^12.1.1",
-    "prettier": "^3.6.2",
+    "globals": "^17.3.0",
+    "prettier": "^3.8.1",
     "typescript": "^5.9.3"
   }
 }

src/version.ts

@@ -67,6 +67,12 @@ const isLessVersion = (a: Version, b: Version): boolean => {
 
 const getRequestedVersion = (): Version => {
   let requestedVersion = core.getInput(`version`)
+  let versionFilePath = core.getInput(`version-file`)
+
+  if (requestedVersion && versionFilePath) {
+    core.warning(`Both version (${requestedVersion}) and version-file (${versionFilePath}) inputs are specified, only version will be used`)
+  }
+
   const workingDirectory = core.getInput(`working-directory`)
 
   let goMod = "go.mod"
@@ -83,6 +89,27 @@ const getRequestedVersion = (): Version => {
     }
   }
 
+  if (requestedVersion == "" && versionFilePath) {
+    if (workingDirectory) {
+      versionFilePath = path.join(workingDirectory, versionFilePath)
+    }
+
+    if (!fs.existsSync(versionFilePath)) {
+      throw new Error(`The specified golangci-lint version file at: ${versionFilePath} does not exist`)
+    }
+
+    const content = fs.readFileSync(versionFilePath, "utf-8")
+
+    if (path.basename(versionFilePath) === ".tool-versions") {
+      // asdf/mise file.
+      const match = content.match(/^golangci-lint\s+([^\n#]+)/m)
+      requestedVersion = match ? "v" + match[1].trim().replace(/^v/gi, "") : ""
+    } else {
+      // .golangci-lint-version file.
+      requestedVersion = "v" + content.trim().replace(/^v/gi, "")
+    }
+  }
+
   const parsedRequestedVersion = parseVersion(requestedVersion)
   if (parsedRequestedVersion == null) {
     return null