fix: decouple version mapping generation from pinned super-linter version

super-linter-versions/v8.5.0.toml

@@ -0,0 +1,19 @@
+# Tool versions matching super-linter v8.5.0
+# Source: https://github.com/super-linter/super-linter/tree/v8.5.0
+#
+# Auto-generated by tasks/setup/update-super-linter-versions.sh
+# Dockerfile multi-stage builds pin exact versions for compiled tools.
+# npm and python versions come from lock files in dependencies/.
+
+[tools]
+shellcheck = "v0.11.0"
+shfmt = "v3.12.0"
+actionlint = "1.7.10"
+hadolint = "v2.14.0"
+"npm:markdownlint-cli" = "0.47.0"
+"npm:prettier" = "3.8.1"
+"npm:@biomejs/biome" = "2.3.14"
+"pipx:ruff" = "0.15.0"
+"pipx:codespell" = "2.4.1"
+editorconfig-checker = "v3.6.1"
+golangci-lint = "v2.8.0"

tasks/setup/update-super-linter-versions.sh

@@ -10,18 +10,16 @@ fi
 
 cd "${MISE_PROJECT_ROOT}"
 
-if [ -z "${SUPER_LINTER_VERSION:-}" ]; then
-	echo "SUPER_LINTER_VERSION environment variable is not set. Exiting."
-	exit 1
-fi
+REPO="super-linter/super-linter"
+TAG="${1:-}"
 
-# Extract clean version (strip slim- prefix and @sha256 digest)
-VERSION="${SUPER_LINTER_VERSION#slim-}"
-VERSION="${VERSION%%@*}"
+if [ -z "$TAG" ]; then
+	TAG=$(gh api "repos/${REPO}/releases/latest" -q '.tag_name')
+	echo "Latest super-linter release: ${TAG}"
+fi
 
-REPO="super-linter/super-linter"
-TAG="${VERSION}"
-OUTPUT="super-linter-versions/${VERSION}.toml"
+# Strip slim- prefix if passed (slim and fat use the same tool versions)
+TAG="${TAG#slim-}"
 
 echo "Extracting tool versions for super-linter ${TAG}..."
 
@@ -67,6 +65,8 @@ codespell=$(_pip_version "codespell")
 
 mkdir -p super-linter-versions
 
+OUTPUT="super-linter-versions/${TAG}.toml"
+
 cat >"$OUTPUT" <<EOF
 # Tool versions matching super-linter ${TAG}
 # Source: https://github.com/${REPO}/tree/${TAG}