fix: downgrade gosec to v2.27.1 to resolve actionlint yaml/v4 compile failure

.golangci.yml

@@ -37,12 +37,25 @@ linters:
     - errcheck       # Disabled due to exclude-functions not working properly in golangci-lint v2
     - gocritic       # Disabled due to disabled-checks not working properly in golangci-lint v2
     - revive         # Disabled due to exclude-rules not working properly in golangci-lint v2
+  settings:
+    gomoddirectives:
+      # Forbid replace directives except where necessary for tool-dependency compatibility.
+      replace-local: false       # Forbid local replace directives (e.g., replace foo => ../foo)
+      replace-allow-list:
+        # actionlint@v1.7.12 requires yaml/v4@rc.3, which exposes yaml.ParserError
+        # and related types that were removed in rc.6. gosec@v2.28.0 pulls in rc.6
+        # transitively, so we pin the whole module to rc.3 here.
+        - go.yaml.in/yaml/v4
 
 linters-settings:
   gomoddirectives:
-    # Forbid all replace directives in go.mod
+    # Forbid replace directives except where necessary for tool-dependency compatibility.
     replace-local: false       # Forbid local replace directives (e.g., replace foo => ../foo)
-    replace-allow-list: []     # No replace directives are allowed
+    replace-allow-list:
+      # actionlint@v1.7.12 requires yaml/v4@rc.3, which exposes yaml.ParserError
+      # and related types that were removed in rc.6. gosec@v2.28.0 pulls in rc.6
+      # transitively, so we pin the whole module to rc.3 here.
+      - go.yaml.in/yaml/v4
   errcheck:
     exclude-functions:
       - (*os.File).Close

go.mod

@@ -125,3 +125,10 @@ tool (
 	github.com/securego/gosec/v2/cmd/gosec
 	golang.org/x/vuln/cmd/govulncheck
 )
+
+// actionlint@v1.7.12 requires go.yaml.in/yaml/v4@v4.0.0-rc.3, which exposes
+// yaml.ParserError and related fields that were removed in rc.6. gosec@v2.28.0
+// pulls in rc.6 transitively (but does not import yaml/v4 directly), causing
+// actionlint to fail to compile. Pin the replacement to rc.3 so all
+// consumers in this module use the version actionlint depends on.
+replace go.yaml.in/yaml/v4 => go.yaml.in/yaml/v4 v4.0.0-rc.3

go.sum

@@ -233,8 +233,8 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
-go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 h1:e66Fs6Z+fZTbFBAxKfP3PALWBtpfqks2bwGcexMxgtk=