fix(ci): guard golangci-lint download against silent HTTP failures

[Copilot]

curl -sSL … | tar -xz silently piped an HTTP error page into tar when GitHub's release CDN returned a non-200 response, producing the misleading gzip: stdin: not in gzip format failure instead of a useful HTTP error.

Changes

• --fail: curl now exits non-zero on HTTP 4xx/5xx, surfacing the real error (e.g. 404 Not Found) instead of letting a bad response reach tar
• --retry 3: automatic retry on transient network failures
• Save before extract: archive written to /tmp/golangci-lint.tar.gz first, then extracted — cleanly separates download errors from extraction errors and makes future checksum verification straightforward

# Before
curl -sSL "$DOWNLOAD_URL" | tar -xz -C /tmp

# After
curl --fail --retry 3 -sSL "$DOWNLOAD_URL" -o "$ARCHIVE"
tar -xz -C /tmp -f "$ARCHIVE"

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[CI Failure Doctor] Investigate lint-go download failure (Run 38017)</issue_title>
<issue_description>### CI Failure Investigation - Run github/gh-aw#38017

Summary

The lint-go job fails early because the golangci-lint install step downloads a payload that tar -xz cannot unzip, so the job stops before lint checks execute.

Failure Details

• Run: 22468945601
• Commit: e0bade6
• Trigger: push

Root Cause Analysis

The install script sets GOLANGCI_LINT_VERSION="v2.8.0", streams curl -sSL https://github.com/golangci/golangci-lint/releases/download/v2.8.0/golangci-lint-\$\{GOLANGCI_LINT_VERSION#v}-$GOOS-$GOARCH.tar.gz directly into tar -xz, but shortly afterward tar reports gzip: stdin: not in gzip format and aborts. This means the download returned non-gzip content (usually an HTML error/redirect) yet the workflow continued anyway, so the extraction step fails without a helpful HTTP error. The release still publishes golangci-lint-2.8.0-linux-amd64.tar.gz, so the URL is valid, but the runner never confirmed a successful download before handing the stream to tar.

Failed Jobs and Errors

• lint-go: tar: Error is not recoverable: exiting now after gzip: stdin: not in gzip format while extracting the downloaded golangci-lint tarball.

Investigation Findings

• The lint-go job is the only failure and it fails right after the download/extraction block; all earlier Go formatting and lint setup succeeded.
• The golangci-lint release asset for linux-amd64 exists, but the job received a payload that tar could not read, so the HTTP download almost certainly returned HTML (404, rate limit, or similar) instead of the tarball.
• Because we pipe curl straight into tar -xz, there is no visible HTTP status code when the download fails, and the log only shows the inferior tar error.

Recommended Actions

• Guard the download with curl --fail (and maybe --retry 3) and/or save the archive to disk so we can check its size/content before extracting.
• Replace the manual install with the official golangci-lint GitHub Action or cache the binary, eliminating the need to hit the release assets on every run.
• Log the HTTP status or body/snippet when a download fails so future investigations can see whether GitHub returned 404/500 instead of a tarball.

Prevention Strategies

Always verify external tool downloads (HTTP status, checksum) before piping them into decompression commands so that CI fails with a descriptive error instead of a generic tar: not in gzip format.

AI Team Self-Improvement

When editing workflows, remind agents to validate remote downloads (status/checksums) before extraction and to document the third-party domains that must remain reachable.

Historical Context

Searching [CI Failure Doctor] issues with label cookie returned 33 hits, but none describe this golangci-lint download failure, so opening a new investigation is appropriate.

🩺 Diagnosis provided by CI Failure Doctor

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/ci-doctor.md@ea350161ad5dcc9624cf510f134c6a9e39a6f94d

• expires on Feb 28, 2026, 1:45 AM UTC

Comments on the Issue (you are @copilot in this section)

• Fixes [CI Failure Doctor] Investigate lint-go download failure (Run 38017) #18613

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR fixes a CI reliability issue where golangci-lint download failures were silently piped into tar, producing misleading "not in gzip format" errors instead of showing the actual HTTP error.

Changes:

• Added --fail flag to curl to surface HTTP 4xx/5xx errors instead of silently passing error pages to tar
• Added --retry 3 to automatically retry transient network failures
• Changed to save the archive to disk before extraction, cleanly separating download errors from extraction errors

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.