The gh-aw-threat-detection version is defined in one place and flows into all lock files at compile time. Do not hand-edit the 89 .lock.yml files.
Correct path to update v0.2.2 → v0.3.0:
Edit the single source constant in pkg/constants/version_constants.go:168:
make fmt (required after any Go change).
make recompile — regenerates every .lock.yml, propagating install_threat_detect_binary.sh v0.3.0 to all 89 detection workflows.
make test-unit — the isolation test (threat_detection_isolation_test.go) asserts the compiled output contains DefaultThreatDetectVersion, so it validates the new pin automatically. No test edits needed since it reads the constant dynamically.
That's it — one constant, recompile, done. Just confirm the v0.3.0 release/asset actually exists in the gh-aw-threat-detection releases before pinning, since the install script pulls it from GitHub Releases at runtime.
The gh-aw-threat-detection version is defined in one place and flows into all lock files at compile time. Do not hand-edit the 89 .lock.yml files.
Correct path to update v0.2.2 → v0.3.0:
Edit the single source constant in pkg/constants/version_constants.go:168:
make fmt (required after any Go change).
make recompile — regenerates every .lock.yml, propagating install_threat_detect_binary.sh v0.3.0 to all 89 detection workflows.
make test-unit — the isolation test (threat_detection_isolation_test.go) asserts the compiled output contains DefaultThreatDetectVersion, so it validates the new pin automatically. No test edits needed since it reads the constant dynamically.
That's it — one constant, recompile, done. Just confirm the v0.3.0 release/asset actually exists in the gh-aw-threat-detection releases before pinning, since the install script pulls it from GitHub Releases at runtime.