Upgrade GitHub Actions to latest versions, migrate golangci-lint conf…

.github/dependabot.yml

@@ -1,11 +1,11 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
 version: 2
 updates:
-  - package-ecosystem: "" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"

.github/workflows/check-commit-message.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Check Commit Message
         id: commits
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const prNumber = context.payload.pull_request.number;

.github/workflows/codeql.yml

@@ -59,7 +59,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -69,7 +69,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
+      uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -97,6 +97,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
+      uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/pull-request-build.yml

@@ -12,12 +12,12 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Set up Go
-      uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
-        go-version: '1.25.4'
+        go-version: '1.27.2'
 
     - name: Download dependencies
       run: go get -d -t ./...

.github/workflows/sonar-scan.yml

@@ -14,29 +14,29 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         # Full history so SonarCloud can compute new-code and blame data.
         fetch-depth: 0
 
     - name: Set up Go
-      uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
-        go-version: '1.25.4'
+        go-version: '1.27.2'
 
     - name: Build and Test with Coverage
       run: |
         go build -v ./...
         go test -coverprofile=coverage.out ./...
 
     - name: golangci-lint
-      uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
+      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
       with:
-        args: --output.json.path=golangci-report.json
+        args: --output.checkstyle.path=golangci-report.xml
       continue-on-error: true
 
     - name: Sonar Scan
-      uses: SonarSource/sonarqube-scan-action@aa494459d7c39c106cc77b166de8b4250a32bb97 # v5.1.0
+      uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.golangci.yml

@@ -1,13 +1,14 @@
+version: "2"
+
 # golangci-lint configuration for multiapps-cli-plugin
 # Runs a standard set of Go linters; JSON output is uploaded to SonarCloud.
 run:
   timeout: 5m
 
-issues:
-  exclude-dirs:
-    - test_resources
-
 linters:
+  exclusions:
+    paths:
+      - test_resources
   enable:
     - govet
     - staticcheck

sonar-project.properties

@@ -11,4 +11,4 @@ sonar.exclusions=\
 
 # Go analysis inputs
 sonar.go.coverage.reportPaths=coverage.out
-sonar.go.golangci-lint.reportPaths=golangci-report.json
+sonar.go.golangci-lint.reportPaths=golangci-report.xml