[CI Failure Doctor] Investigate lint-go download failure (Run 38017)

[github-actions]

CI Failure Investigation - Run #38017

Summary

The lint-go job fails early because the golangci-lint install step downloads a payload that tar -xz cannot unzip, so the job stops before lint checks execute.

Failure Details

• Run: 22468945601
• Commit: e0bade6
• Trigger: push

Root Cause Analysis

The install script sets GOLANGCI_LINT_VERSION="v2.8.0", streams curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.8.0/golangci-lint-\$\{GOLANGCI_LINT_VERSION#v}-$GOOS-$GOARCH.tar.gz directly into tar -xz, but shortly afterward tar reports gzip: stdin: not in gzip format and aborts. This means the download returned non-gzip content (usually an HTML error/redirect) yet the workflow continued anyway, so the extraction step fails without a helpful HTTP error. The release still publishes golangci-lint-2.8.0-linux-amd64.tar.gz, so the URL is valid, but the runner never confirmed a successful download before handing the stream to tar.

Failed Jobs and Errors

• lint-go: tar: Error is not recoverable: exiting now after gzip: stdin: not in gzip format while extracting the downloaded golangci-lint tarball.

Investigation Findings

• The lint-go job is the only failure and it fails right after the download/extraction block; all earlier Go formatting and lint setup succeeded.
• The golangci-lint release asset for linux-amd64 exists, but the job received a payload that tar could not read, so the HTTP download almost certainly returned HTML (404, rate limit, or similar) instead of the tarball.
• Because we pipe curl straight into tar -xz, there is no visible HTTP status code when the download fails, and the log only shows the inferior tar error.

Recommended Actions

• Guard the download with curl --fail (and maybe --retry 3) and/or save the archive to disk so we can check its size/content before extracting.
• Replace the manual install with the official golangci-lint GitHub Action or cache the binary, eliminating the need to hit the release assets on every run.
• Log the HTTP status or body/snippet when a download fails so future investigations can see whether GitHub returned 404/500 instead of a tarball.

Prevention Strategies

Always verify external tool downloads (HTTP status, checksum) before piping them into decompression commands so that CI fails with a descriptive error instead of a generic tar: not in gzip format.

AI Team Self-Improvement

When editing workflows, remind agents to validate remote downloads (status/checksums) before extraction and to document the third-party domains that must remain reachable.

Historical Context

Searching [CI Failure Doctor] issues with label cookie returned 33 hits, but none describe this golangci-lint download failure, so opening a new investigation is appropriate.

🩺 Diagnosis provided by CI Failure Doctor

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/ci-doctor.md@ea350161ad5dcc9624cf510f134c6a9e39a6f94d

• expires on Feb 28, 2026, 1:45 AM UTC