Renovate only runs a single `postUpgradeTasks` command per dependency, so
projects cannot add their own post-upgrade logic without overriding (and
thereby breaking) the shared `post-renovate-upgrade.sh` behaviour.

This adds a well-known extension point: if an executable
`./scripts/repo-post-renovate-upgrade.sh` exists in the consuming project,
it is run automatically after the common post-upgrade tasks, receiving the
upgrade context via `RENOVATE_POSTUPG_*` environment variables.

The trigger is also broadened beyond `.tool-versions` to the other
version-file managers (`.mise.toml` and variants, and
`.gitlab-ci-other-versions.yml`), so the common tasks and the new hook run
for those upgrades too.

This is zero-touch and non-breaking: projects without the hook file are
unaffected and adopt the change automatically when Renovate bumps their
common-ci-tasks pin.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Address review feedback:
- Use inline `[text](url)` link syntax instead of the inverted `(text)[url]`
  form for the RENOVATE_POSTUPG_* env var references.
- Replace "e.g." with "for example".
- Add a `**/mise.toml` glob so nested `mise.toml` files (without a leading
  dot) are matched symmetrically with nested `.tool-versions`/`.mise.toml`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The golangci_lint job was the only Go component with no caching, so every
run re-downloaded modules and rebuilt golangci-lint's analysis cache from
scratch.

Reuse the shared .go-mod-cache base (internal/go/caching.yml) for the module
cache and its key/policy, and layer GOCACHE and GOLANGCI_LINT_CACHE onto the
same cache entry by overriding cache.paths. This speeds up incremental lint
runs while following the existing Go caching convention.

Zero-touch for consumers: adoption is automatic on the next component pin
bump, with no required inputs and no repository changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chore(deps): update dependency golang/go to v1.27.0

See merge request !1794

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat(golangci-lint): cache Go module, build, and lint caches

See merge request !1798

feat(renovate): allow projects to customise post-renovate-upgrade tasks

See merge request !1797

## [5.2.0](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/compare/...) (2026-08-24)

### Features

* **golangci-lint:** cache Go module, build, and lint caches ([d7ed83a1](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/d7ed83a1dc4e80cf15c74dd36d480e56d2072476))
* **renovate:** allow projects to customise post-renovate-upgrade tasks ([3540f5c8](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/3540f5c8d5b56b476dd4b0f6816e08d535850e19))

### Docs

* **renovate:** fix link syntax and add nested mise.toml glob ([8a571b3f](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/8a571b3ff48142977f3c29ed8db6ddbf5eb5dff3))

### Others

* **golangci-lint:** use // comments in jsonnet to satisfy jsonnetfmt ([458b4c4c](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/458b4c4ce36237858e83fc84923b13b5520d675f))

### Dependencies

* **deps:** update dependency golang/go to v1.27.0 ([0811c96b](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/0811c96b7d2b272ecf6db0304ce23b2ff3f66c7d))

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.75.0

chore(deps): update dependency https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git to v1.75.0

See merge request !1800

The .goreleaser_base job runs in the bash-less Alpine `docker:` image, so
GitLab Runner executes its script with POSIX `sh`. The FIPS guard
`if [[ ${FIPS_MODE} == "1" ]]` used an unquoted variable, so an empty
FIPS_MODE collapsed the test to two operands and emitted
`sh: 1: unknown operand` on every normal build.

Extract the script to src/ci/components/goreleaser/script.sh and import it
via importstr. A `# shellcheck shell=sh` pragma now enforces POSIX
compatibility through pre-commit, so bashisms are caught before reaching CI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

GitLab runs the multi-line script block as a single step and only checks
the last command's exit code. With the FIPS guard as the final command
(exit 0 when FIPS is off), a failing `docker run` goreleaser build/release
was masked and the job reported success. Add `set -o errexit` so any
command failure fails the job.

`nounset` and a restricted `IFS` are intentionally omitted: optional CI
variables are legitimately unset, and the docker run relies on space
word-splitting of the GORELEASER_* argument variables.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v5.2

See merge request !1802

chore(deps): update dependency yoheimuta/protolint to v0.57.0

See merge request !1801

chore(deps): update dependency renovate to v44.32.0

See merge request !1795

chore(deps): update dependency gitlab-org/labkit to v2.35.6

See merge request !1791

chore(deps): update dependency docker/cli to v29.7.2

See merge request !1760

chore(deps): update dependency pre-commit/pre-commit to v4.6.2

See merge request !1793

chore(deps): update dependency helm/helm to v4.2.4

See merge request !1799

fix(goreleaser): make base job script POSIX-sh safe

See merge request !1803

## [5.2.1](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/compare/...) (2026-08-25)

### Fixes

* **goreleaser:** fail base job on command error with set -o errexit ([706c8cdf](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/706c8cdf956c9c0010d86771a0451196c03606e6))
* **goreleaser:** make base job script POSIX-sh safe ([2108699b](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/2108699b2a48dc2423d392cc83538d0142f24887))

### Dependencies

* **deps:** update dependency docker/cli to v29.7.2 ([fd8b935b](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/fd8b935b41479ee754cf1cf39efac8586b1d95f1))
* **deps:** update dependency gitlab-org/labkit to v2.35.6 ([6fd0d3a9](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/6fd0d3a9f179ff0eb731afc890efdc3686e00332))
* **deps:** update dependency helm/helm to v4.2.4 ([2572c84c](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/2572c84cb7c24c280b4766eaf205c93ad88c07b7))
* **deps:** update dependency https://gitlab.com/[secure]/gl-infra/common-template-copier.git to v1.75.0 ([65951f5a](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/65951f5a6196b3381320eb9c6a5da46a483903f7))
* **deps:** update dependency pre-commit/pre-commit to v4.6.2 ([e4ce37bc](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/e4ce37bc9983aed739b3c41d0e08179e090c801b))
* **deps:** update dependency renovate to v44.32.0 ([673ce569](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/673ce569b5a9d73caa7cbb79f2ca2affb74d88a4))
* **deps:** update dependency yoheimuta/protolint to v0.57.0 ([fa4b6a9b](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/fa4b6a9b6513c8bc889b56ca0c9d1c418ff0b87e))
* **deps:** update pre-commit hook [secure]/gl-infra/common-ci-tasks to v5.2 ([4c3e2d87](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/4c3e2d874beebf762db606f8da5dc5bff795661c))