chore: golangci-lint update

.github/workflows/pr.yml

@@ -1,17 +1,29 @@
 on: pull_request
 name: pull_request
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: 1.25.x # NB! when updating also update matrix, we cannot refer to env variables in the matrix
+  GOLANGCI_LINT_VERSION: v2.10.1
+
 jobs:
   staticcheck:
     runs-on: ubuntu-latest
     steps:
       - name: checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.2 # nonpinned - official GH action
         with:
           fetch-depth: 0
       - name: install Go
-        uses: actions/setup-go@v6.2.0
+        uses: actions/setup-go@v6.2.0 # nonpinned - official GH action
         with:
-          go-version: 1.25.x
+          go-version: ${{ env.GO_VERSION }}
 
       - name: gofmt
         run: if [[ -n $(gofmt -l .) ]]; then echo "please run gofmt"; exit 1; fi
@@ -25,9 +37,9 @@ jobs:
           if [[ -n $(git status --porcelain) ]]; then echo "git repo is dirty after running go generate -- please don't modify generated files"; echo $(git diff);echo $(git status --porcelain); exit 1; fi
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9.2.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 #v9.2.0 pinned
         with:
-          version: v2.8.0
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           args: -v --timeout=5m
 
   test:
@@ -41,15 +53,15 @@ jobs:
       - name: install Go
         uses: actions/setup-go@v6.2.0
         with:
-          go-version: 1.25.x
+          go-version: ${{ env.GO_VERSION }}
 
       - name: install deps
         run: |
           go install golang.org/x/tools/cmd/goimports@latest && go install github.com/klauspost/asmfmt/cmd/asmfmt@latest
 
       # Install gotestfmt on the VM running the action.
       - name: Set up gotestfmt
-        uses: gotesttools/gotestfmt-action@v2.2.0
+        uses: gotesttools/gotestfmt-action@8b4478c7019be847373babde9300210e7de34bfb #v2.2.0 pinned
         with:
           # Optional: pass GITHUB_TOKEN to avoid rate limiting.
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/push.yml

@@ -3,6 +3,18 @@ on:
     branches:
       - "master"
 name: push_master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  GO_VERSION: 1.25.x # NB! when updating also update matrix, we cannot refer to env variables in the matrix
+  GOLANGCI_LINT_VERSION: v2.10.1
+
 jobs:
   staticcheck:
     runs-on: ubuntu-latest
@@ -14,7 +26,7 @@ jobs:
       - name: install Go
         uses: actions/setup-go@v6.2.0
         with:
-          go-version: 1.25.x
+          go-version: ${{ env.GO_VERSION }}
 
       - name: gofmt
         run: if [[ -n $(gofmt -l .) ]]; then echo "please run gofmt"; exit 1; fi
@@ -28,9 +40,9 @@ jobs:
           if [[ -n $(git status --porcelain) ]]; then echo "git repo is dirty after running go generate -- please don't modify generated files"; echo $(git diff);echo $(git status --porcelain); exit 1; fi
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9.2.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 #v9.2.0 pinned
         with:
-          version: v2.8.0
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
           args: -v --timeout=5m
 
   test:
@@ -50,15 +62,15 @@ jobs:
       failures: ${{ steps.generate-job-summary.outputs.failures }}
     steps:
       - name: checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.2 # nonpinned - official GH action
       - name: install Go
-        uses: actions/setup-go@v6.2.0
+        uses: actions/setup-go@v6.2.0 # nonpinned - official GH action
         with:
           go-version: ${{ matrix.go-version }}
 
       # Install gotestfmt on the VM running the action.
       - name: Set up gotestfmt
-        uses: gotesttools/gotestfmt-action@v2.2.0
+        uses: gotesttools/gotestfmt-action@8b4478c7019be847373babde9300210e7de34bfb #v2.2.0 pinned
         with:
           # Optional: pass GITHUB_TOKEN to avoid rate limiting.
           token: ${{ secrets.GITHUB_TOKEN }}

ecc/secp256r1/g1_test.go

@@ -423,7 +423,7 @@ func TestG1CrossImplementations(t *testing.T) {
 			Gx, Gy := curve.Params().Gx, curve.Params().Gy
 			var S big.Int
 			s.BigInt(&S)
-			Qx, Qy := curve.ScalarMult(Gx, Gy, S.Bytes())
+			Qx, Qy := curve.ScalarMult(Gx, Gy, S.Bytes()) //nolint:staticcheck // compatibility test only
 			var Q G1Affine
 			Q.ScalarMultiplication(&g1GenAff, &S)
 			var qx, qy fp.Element

go.mod

@@ -1,6 +1,6 @@
 module github.com/consensys/gnark-crypto
 
-go 1.25.6
+go 1.25.7
 
 require (
 	github.com/bits-and-blooms/bitset v1.24.4

go.sum

@@ -122,6 +122,8 @@ github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=