Repository navigation
ci: build with Go 1.27.3 (GO-2026-6809) - #527
Merged
Merged
Conversation
…rrection (GO-2026-6809)
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title uses the required conventional-commit format with type ci and accurately describes the Go 1.27.3 toolchain update and vulnerability reference. |
| Description check | |
The description directly explains the Go toolchain update, vulnerability remediation, affected workflows and modules, verification, and remaining CI status. |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Negative Control For Changed Checks | |
Validation paths changed, but only their go.mod version directives changed; no check implementation changed. The description names the relevant govulncheck negative control: GO-2026-6809 causes exit 3… |
Full details: Negative Control For Changed Checks
-
Explanation
Validation paths changed, but only their go.mod version directives changed; no check implementation changed. The description names the relevant govulncheck negative control: GO-2026-6809 causes exit 3 with Go 1.27.2, while govulncheck exits 0 with Go 1.27.3. The diff contains no report/, mage_.go, or workflow__test.go changes.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs the v1.6.0 release run (no issue closed by this PR). Sibling of goceleris/celeris#1102.
The
govulncheckjob oftest.ymlfails onmainsince the vulnerability database update: GO-2026-6809 (crypto/x509), corrected in go1.27.3, reachable on the root module throughvalidation/rfc_scrape.go:405and onvalidation/refapp/auth_jwt_csrf(exit 3 with go1.27.2). This moves the toolchain from 1.27.2 to 1.27.3.WHAT THIS CHANGES FOR THE CLUSTER
The cluster's Go binaries are not built by ansible:
ansible/has no Go role (roles are bun, c, cpp, dbservices, dotnet, java, node, python, rust, zig) and no Go version variable. The benchmark, race, checkptr, nightly, weekend and PR-tier workflows build withactions/setup-goon the runner and ship the result, so thego-versionvalues here ARE the toolchain the cluster benchmarks are built with, and this PR changes them to 1.27.3. In addition,celeris-stress.yml(4 steps) andceleris-stress-cluster.ymlusego-version-file: go.mod/celeris/go.mod: after this merges the probatorium side of those stress/soak runs resolves to 1.27.3 through the rootgo.mod, and the celeris side follows the checked-out celerisgo.mod(1.27.3 once celeris#1102 is in the checkout). The final-sha benchmarks and soak must therefore be built with 1.27.3, same as celeris; merge this before dispatching them. No playbook and no host-affecting file is touched.Changes (version strings only, 37 files)
godirective 1.27.2 -> 1.27.3 in 28 go.mod files: root,.github/tools,servers/{celeris,chi,echo,fasthttp,fiber,gin,gnet,gorilla_ws,hertz,iris,nbio,stdhttp},validation/properties/fieldguard,validation/refapp/{auth_jwt_csrf,auth_session_ratelimit,driver_memcached,driver_postgres,driver_redis,internal/debugvars,kitchen_sink,observability,static_swagger_proxy}, and the four testdata fixtures (tools/stresstally/testdata/samplemod,validation/remote/testdata/splicedemo,validation/testdata/{checkptrdemo,racedemo}), as the earlier 1.27.2 bump (chore(deps): go 1.27.2 in every Go module, dependencies at latest #514) did.go-version: "1.27.2"in.github/workflows(benchmark-tier, coverage, lint, matrix-{checkptr,nightly,pr,race,weekend}-tier, test): 16 occurrences.Not changed: go.sum files (
go mod tidyleaves the tree identical in all 28 modules); the comment inlint.ymlthat cites "Go 1.27.2's export data" (historic reason for the golangci-lint floor); thego version go1.27.0strings intools/stresstallytest fixtures (synthetic host output).Verification
Run in
golang:1.27.3linux/arm64 (Docker, lane-local caches), with the repo's own CI invocations:go build ./... && go vet ./...clean on the root, every Go module underservers/, everyvalidation/refapp/*andvalidation/properties/fieldguardgo test -count=1 -race ./...and-tags mageon the root module: all packages ok. Two environment artifacts of my container, not of the change: the image has nojq(tools/stresstallyshell-script tests need it, the CI runner has it) and I ran as root (one stresstally test refuses to run as root because root can delete read-only module caches). Withjqinstalled and a non-root user,tools/stresstallypasses under both tag sets. Avalidation/remotesplice-demo test neededgit safe.directoryfor the non-root user and then passed-count=5 -race.validation/refapp/internal/debugvarsgo test -raceokmage -compileok (mage v1.17.2 from the tools module)govulncheck ./...(v1.8.0, the CI-pinned scanner) over the 11 modules the CI job scans: all exit 0. The root module reports 0 affected, and one advisory in a required module that the code does not call (exit 0, so the job passes; I did not identify which advisory it is).actionlint(tools module, v1.7.12) cleanOWED: the CI run on this PR; the cluster itself (nothing dispatched).