ci: run release gosec via golangci-lint; bump to 0.4.7

.github/workflows/release.yml

@@ -62,9 +62,10 @@ jobs:
 
       - name: Run security scan
         if: matrix.os == 'linux' && matrix.arch == 'amd64'
-        run: |
-          go install github.com/securego/gosec/v2/cmd/gosec@latest
-          gosec -exclude=G304 ./...
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.14.0
+          args: --no-config --enable-only=gosec --tests=false --timeout=5m
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v0.4.7] - 2026-10-13
+
+### Fixed
+- Release security scan now runs gosec through golangci-lint (`--enable-only=gosec --tests=false`). The previous `go install gosec@latest` step failed on Go 1.27.2 with `export data version 5 is greater than maximum supported version 4`, so v0.4.6 was not released
+- Release tests and security scan run before image build and publishing
+
 ## [v0.4.6] - 2026-10-13
 
 ### Fixed

Makefile

@@ -1,5 +1,5 @@
 BINARY_NAME := bucketsyncd
-VERSION := 0.4.6
+VERSION := 0.4.7
 
 LDFLAGS=-ldflags "-X main.version=$(VERSION)"
 

debian/changelog

@@ -1,3 +1,9 @@
+bucketsyncd (0.4.7-1) unstable; urgency=medium
+
+  * Fix: release security scan runs gosec via golangci-lint; go install gosec failed on Go 1.27.2 export data
+
+ -- Ross Golder <ross@golder.org>  Tue, 13 Oct 2026 00:00:00 +0000
+
 bucketsyncd (0.4.6-1) unstable; urgency=medium
 
   * Build: Go 1.27.2 and golangci-lint v2.14.0

main.go

@@ -13,7 +13,7 @@ import (
 )
 
 var (
-	version   = "v0.4.6"
+	version   = "v0.4.7"
 	buildTime = "unknown"
 	gitCommit = "unknown"
 )