ci: use project defined golangci-lint version

[pmalek]

Do not depend on pre-installed golangci-lint version. Use a project defined version, as it's done in e.g. KIC

[codecov-commenter]

Codecov Report

Patch and project coverage have no change.

Comparison is base (2467c8c) 52.77% compared to head (c957993) 52.77%.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #341   +/-   ##
=======================================
  Coverage   52.77%   52.77%           
=======================================
  Files          69       69           
  Lines        5095     5095           
=======================================
  Hits         2689     2689           
  Misses       1832     1832           
  Partials      574      574           

Flag	Coverage Δ
2.1.4	36.29% <ø> (ø)
2.2.1.3	46.77% <ø> (ø)
2.2.2	36.29% <ø> (ø)
2.3.3	36.34% <ø> (ø)
2.3.3.4	?
2.4.1	36.42% <ø> (ø)
2.4.1.3	?
2.5.1.2	?
2.5.2	36.42% <ø> (ø)
2.6.1	36.42% <ø> (ø)
2.6.1.0	?
2.7.2	36.42% <ø> (ø)
2.7.2.0	49.04% <ø> (ø)
2.8.3	36.42% <ø> (ø)
2.8.4.0	?
3.0.2	35.87% <ø> (ø)
3.0.2.0	49.49% <ø> (ø)
3.1.1	37.36% <ø> (ø)
3.1.1.3	50.99% <ø> (ø)
3.2.2	37.42% <ø> (ø)
3.2.2.1	50.99% <ø> (ø)
community	37.97% <ø> (ø)
enterprise	51.54% <ø> (ø)
enterprise-nightly	50.99% <ø> (ø)
integration	52.77% <ø> (ø)
nightly	37.42% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

[aboudreault]

In case we would like to avoid this third_party package, we could also do something like this: https://github.com/Kong/koko-private/blob/dev/scripts/install-tools.sh#L27-L30 (used with make install-tools in koko)

[pmalek]

In case we would like to avoid this third_party package, we could also do something like this: https://github.com/Kong/koko-private/blob/dev/scripts/install-tools.sh#L27-L30 (used with make install-tools in koko)

This is exactly what we're trying to avoid for 3 reasons:

• arbitrary code execution internet | sh
• it's not (or might not be) idempotent: each time the installer needs to be downloaded and it might download the binary itself (depends how it's) written. With go.mod based approach, it's idempotent.
• you can the benefits of dependabot automatically creating PRs for new versions and when those get merged and people pull those changes they'll automatically start using those