ci: Future proof golangci-lint workflow by using dynamic base branch

[Copilot]

The golangci-lint workflow was hardcoded to use --new-from-rev=origin/master which caused failures when:

• Creating feature branches and opening PRs against them
• Opening PRs against branches other than master
• The repository's default branch changes

Changes Made

1. Removed hardcoded base branch from .golangci.yml

Before:

issues: max-same-issues: 0 max-issues-per-linter: 0 new-from-rev: origin/master # ❌ Hardcoded

After:

issues: max-same-issues: 0 max-issues-per-linter: 0 # ✅ No hardcoded new-from-rev

2. Updated GitHub workflow to use dynamic base branch

Before:

args: --new-from-rev=origin/master --config=.golangci.yml --timeout=25m

After:

args: ${{ github.event_name == 'pull_request' && format('--new-from-rev=origin/{0}', github.base_ref) || '' }} --config=.golangci.yml --timeout=25m

How It Works

The solution uses GitHub Actions context variables and conditional expressions:

• For PR events: Uses github.base_ref to get the target branch dynamically
• For other events: Omits --new-from-rev parameter (runs full linting)

Test Scenarios

Scenario	Event Type	Base Branch	Generated Args
PR against master	pull_request	master	--new-from-rev=origin/master
PR against feature	pull_request	feature/awesome-feature	--new-from-rev=origin/feature/awesome-feature
Manual dispatch	workflow_dispatch	N/A	(no --new-from-rev)
Merge group	merge_group	N/A	(no --new-from-rev)

Benefits

✅ Future-proof: Works with any base branch without manual changes
✅ Automatic: No need to update workflow when creating feature branches
✅ Robust: Handles different event types gracefully
✅ Minimal: Only 2 lines changed across 2 files
✅ Backward compatible: Still works for existing workflows

The workflow now automatically adapts to any base branch without requiring manual changes when creating feature branches or opening PRs against them.

Fixes #3804.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• golangci-lint.run
  • Triggering command: golangci-lint config verify --config=.golangci.yml (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to my firewall allow list

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[jpayne3506]

Changes in both files are required.

Expected result as GITHUB_BASE_REF is intended to solve this problem.

The name of the base ref or target branch of the pull request in a workflow run. This is only set when the event that triggers a workflow run is either pull_request or pull_request_target. For example, main.``` 

[jpayne3506]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Changes in both files are required.

Expected result as GITHUB_BASE_REF is intended to solve this problem.
...

Confirmed. The implementation uses github.base_ref (the GitHub Actions context variable equivalent of GITHUB_BASE_REF) to dynamically determine the base branch for pull requests. Changes were made to both files as required:

1. .golangci.yml: Removed hardcoded new-from-rev: origin/master
2. .github/workflows/golangci.yaml: Added dynamic base branch logic

The solution now works for PRs against any branch (commit be5416e).

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• golangci-lint.run
  • Triggering command: ./build/tools/bin/golangci-lint config verify --config=.golangci.yml (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to my firewall allow list