The official install.sh (master branch) fails checksum verification because it
matches the .tar.gz line against the .sbom.json checksum (the tarball filename
is a prefix of the sbom filename). The downloaded tarball is NOT corrupt - its
real sha256 matches the checksums file - install.sh just picks the wrong line.
Replace install.sh with a direct tarball download + extract, reusing the
existing go_arch variable. Consistent with how Go itself is installed in this
Dockerfile (no checksum verification either).
Co-Authored-By: Claude <noreply@anthropic.com>
- Add golangci-lint v2.12.2 to node-go image (arch-aware via official install.sh)
- Wire renovate.json to auto-bump GOLANGCI_LINT_VERSION (minor/patch automerge)
and GO_VERSION (patch automerge); keep pins for reproducible/rollback-able builds
- Add node-go/README.md documenting installed tools and what's NOT included
- Update root README accordingly
Co-Authored-By: Claude <noreply@anthropic.com>