Fix CI: migrate the checks to the steps-check bundles

[gergely-sallai]

Checklist

• I've read and followed the Contribution Guidelines
• step.yml and README.md is updated with the changes (if needed)

Version

No version update required, this change only affects CI configuration. step.yml is reformatted but no value changes, and README.md regenerates identically.

Context

ci has been red on every build, including on untouched master. It fails in the Golint step before it lints anything:

$ go "get" "-u" "golang.org/x/lint/golint"
Failed to install golint: package iter: unrecognized import path "iter":
import path does not begin with hostname

iter has been a standard library package since Go 1.23. The step installs golint with an unversioned GOPATH-mode go get -u, which doesn't know that and tries to fetch it as a remote repository. golint itself has been deprecated and frozen since 2021, so this will never be fixed at the source. Errcheck and Go test were skipped as a result, so only the step's own integration tests were running.

Changes

Replace the legacy go-list / golint / errcheck / go-test chain with steps-check's shared config modules and the bundles they provide:

include:
- repository: steps-check
  branch: master
  path: step-metadata.bitrise.yml
- repository: steps-check
  branch: master
  path: golang.bitrise.yml

bundle / step	replaces
yamlfmt, lint mode (see Decisions)	new — nothing before
bundle::step-yml-audit	the hand-rolled audit-this-step, plus step.yml JSON schema validation
bundle::golangci-lint (golangci_lint_version: 2.11.4)	go-list, golint, errcheck
bundle::go-test	go-test

Also dropped three workflows that were unreachable from ci and long dead: go-tests and _install-test-tools (installed golint from github.com/golang/lint, a path that has not existed in years), and dep-update (used dep). Plus a stray test: key inside the ci workflow.

step.yml is reformatted in its own commit: 96 of the 107 changed lines are the shared .ymlfmt setting indentless_arrays: true, which de-indents the whole inputs: list.

Investigation details

No code changes were needed — golangci-lint 2.11.4 with steps-check's config reports 0 issues, and go build / go test pass. go.mod stays at go 1.16.

Two things only surfaced once CI ran:

1. The golangci-lint bundle fails on this app's stack. It installs with install.sh -b $(go env GOPATH)/bin and then calls the binary by name. Go is managed by asdf here, GOPATH/bin is not on PATH, and the bundle died with golangci-lint: command not found (exit 127). stepman and envman hit the same thing in their own golangci-lint steps and solve it with asdf reshim golang. The third commit exports the directory before the bundle runs — the smallest fix available from this repo, since the bundle is included from steps-check and cannot be adjusted locally. The real fix belongs upstream: the bundle should invoke the binary at the path it just installed it to. Any step repo on an asdf-managed stack will hit this.

2. bundle::yamlfmt cannot fail without Unified CI. It runs yamlfmt in write mode (no -lint) and exits 0 regardless; steps-check's own check workflow pairs it with autofix-ci, which commits the reformatted files back. Without UCI there is no autofix, so the bundle would reformat a workspace nobody reads and discard the result — a check that cannot fail, guarding the step.yml reformat above. Raised by Copilot on Move steps-check off the stale golangci-lint-version branch steps-project-scanner#177 and confirmed to apply here.

Decisions

• Keep the checks shared rather than localizing them. This is a step repo, so .golangci.yml and .ymlfmt are not copied in — the bundles fetch steps-check's at build time. (They are byte-identical to the ones the go-* library repos vendor.)
• Do not use steps.bitrise.yml's check workflow. It pulls in readme-generator and autofix-ci, which need Unified CI secrets this app does not have. The bundles are used directly instead, as the step-repo guidance describes.
• Call yamlfmt with -lint instead of bundle::yamlfmt. Deliberate deviation from the step-repo convention so the check can actually fail; the config is still fetched from steps-check, so there is one source of truth. A TODO marks it for reverting once this Step migrates to Unified CI.
• The PATH workaround is its own commit, so it can be reverted alone once the bundle is fixed upstream.
• include: uses the repo-slug form (repository: steps-check). The full-URL form is accepted by newer CLIs but mangled by the 2.4x line; this app's stack runs 2.42.2.

[Copilot]

🟢 Approval recommended

The migration is internally consistent, preserves existing tests, and the updated CI statuses pass.

0 open findings

What changed in this PR

Migrates failing legacy CI checks to maintained shared steps-check bundles while preserving integration tests.

Changes:

• Adds YAML formatting, metadata audit, golangci-lint, and Go test checks.
• Adds a GOPATH workaround and removes obsolete workflows.
• Reformats step.yml without changing values.

File	Description
bitrise.yml	Modernizes CI configuration and removes dead workflows.
step.yml	Applies shared YAML formatting.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.