Merge branch 'main' into fix/mirror-kube-version-comment

Author: mchmarny

.settings.yaml

@@ -19,7 +19,7 @@
 # Build Tools
 build_tools:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser depType=build_tools
-  goreleaser: 'v2.17.1'
+  goreleaser: 'v2.18.0'
   # renovate: datasource=github-releases depName=ko-build/ko depType=build_tools
   ko: 'v0.19.1'
   # renovate: datasource=github-releases depName=google/go-containerregistry depType=build_tools
@@ -61,8 +61,8 @@ security_tools:
   #
   # Stored WITHOUT the leading 'v', unlike cosign/syft/grype above:
   # oras-project/setup-oras looks the version up against bare release keys and
-  # throws on 'v1.3.0'. tools/setup-tools re-adds the prefix for the download URL.
-  oras: '1.3.0'
+  # throws on 'v1.3.3'. tools/setup-tools re-adds the prefix for the download URL.
+  oras: '1.3.3'
 
 # E2E Testing Tools
 testing_tools:

tools/setup-tools

@@ -378,7 +378,10 @@ if [[ "${SKIP_TOOLS}" == "false" ]]; then
     echo "════════════════════════════════════════════════════════"
 
     GRYPE_INSTALL_SHA256=${GRYPE_INSTALL_SHA256:-"8646f06a90b10ca64992c1809b4aa00c44e30b4f551f63c309b0b0ab66873556"}
-    GOLANGCI_LINT_INSTALL_SHA256=${GOLANGCI_LINT_INSTALL_SHA256:-"d32d3534af96cfd59546a084d22b213e8a47541cada5013aa8a84c4fa2589905"}
+    # install.sh is fetched from the golangci-lint tag in .settings.yaml, so this
+    # hash is version-specific: re-pin it whenever linting.golangci_lint is bumped.
+    #   curl -fsSL "https://raw.githubusercontent.com/golangci/golangci-lint/$(yq '.linting.golangci_lint' .settings.yaml)/install.sh" | shasum -a 256
+    GOLANGCI_LINT_INSTALL_SHA256=${GOLANGCI_LINT_INSTALL_SHA256:-"1022ddb4d87ed252350ed03fc9677e250a4ae95cc6bcd4658c2a20a8a23d390f"}
 
     if command_exists helm && [[ "${UPGRADE}" != "true" ]]; then
         log_success "Helm already installed: $(helm version --short)"