Move the toolchain to Go 1.27 - #23
Merged
Merged
Conversation
Follows the 1.26.7 bump in 1.6.1. The go directive in go.mod is what every workflow feeds to setup-go, so this moves the language version and the standard library CI builds against. The Dockerfile builder image moves to golang:1.27.0 to match. golangci-lint moves to v2.13.1. Its modernize linter flagged twelve issues in the test suite. Eleven are embedded fields that can use the promoted-field shorthand in a composite literal. One replaces errors.As with errors.AsType, which the 1.27 standard library adds, so the tests now require 1.27 to build. The linter's own autofix produced invalid code in the MQTT writer tests: it hoisted promoted fields alongside the embedded field they belong to, which the compiler rejects. Those two literals build the base value first instead. A dependency sweep found no updates. Every GitHub Action was checked against its latest release and all were already pinned to the newest version by commit SHA.
Default setup pins its own Go toolchain and runs the extractor with GOTOOLCHAIN=local, so it failed on this branch with "go.mod requires go >= 1.27.0 (running go 1.26.6)". It cannot build a module whose go directive is newer than whatever the CodeQL bundle ships. Driving CodeQL from a workflow lets setup-go install the toolchain go.mod asks for before the build, so a Go bump no longer blocks code scanning. Same languages and the same security-extended query suite as the default setup it replaces. Default setup is now disabled on the repository.
ichnograph
added a commit
that referenced
this pull request
Aug 24, 2026
PR #23 merged while a CodeQL check was red. The red job was the old default setup running autobuild, racing the API call that disabled it, and our own manual-build job passed on the same commit. The conclusion was right but the practice was wrong, and nothing stopped the merge: master had no protection at all. Master now requires lint, test and both CodeQL analyze jobs, must be up to date before merge, and rejects force-pushes and deletion. Administrators can still override for emergencies. Two rules protection cannot enforce go in CONTRIBUTING: never merge on a red check even when it looks stale, and confirm a fresh green run after changing CI or scanning config, because those changes take minutes to take effect on the GitHub side. CI gains a workflow_dispatch trigger so it can be verified on demand, as Security, Integration and now CodeQL already could. Release stays tag driven.
ichnograph
added a commit
that referenced
this pull request
Aug 24, 2026
* Allow CodeQL to run on demand The workflow only had push, pull_request and schedule triggers, so there was no way to confirm a scanning config change was green without pushing a commit to provoke one. That gap is why the switch away from default setup was merged on a stale red check instead of a fresh green one. * Protect master and write down the merging rules PR #23 merged while a CodeQL check was red. The red job was the old default setup running autobuild, racing the API call that disabled it, and our own manual-build job passed on the same commit. The conclusion was right but the practice was wrong, and nothing stopped the merge: master had no protection at all. Master now requires lint, test and both CodeQL analyze jobs, must be up to date before merge, and rejects force-pushes and deletion. Administrators can still override for emergencies. Two rules protection cannot enforce go in CONTRIBUTING: never merge on a red check even when it looks stale, and confirm a fresh green run after changing CI or scanning config, because those changes take minutes to take effect on the GitHub side. CI gains a workflow_dispatch trigger so it can be verified on demand, as Security, Integration and now CodeQL already could. Release stays tag driven. * Note that both CodeQL default setups are replaced Settings has two independent default setups, Code security and Code quality, and each spawns its own CodeQL run with its own pinned Go toolchain. Both failed on Go 1.27 with the same autobuild error, which made it look like one disable had not taken effect. Record which runs come from where so the next person does not spend the same time on it. --------- Co-authored-by: Jeroen <ichnograph@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows the 1.26.7 bump in 1.6.1.
The
godirective ingo.modis what every workflow feeds tosetup-go, so this moves both the language version and the standard library CI builds against. The Dockerfile builder image moves togolang:1.27.0to match.golangci-lint v2.12.2 to v2.13.1
Its
modernizelinter flagged twelve issues in the test suite:errors.Asreplaced witherrors.AsType, which the 1.27 standard library adds. The tests therefore no longer build on 1.26.The linter's own
--fixproduced invalid code in the MQTT writer tests. It hoisted promoted fields alongside the embedded field they belong to, which the compiler rejects (cannot specify promoted field Node and enclosing embedded field BaseDucoNodeStatus). Those two literals build the base value first instead.Actions and dependencies
Every action was checked against its latest release. All nine were already pinned to the newest version by commit SHA, so none moved.
go get -u ./...found no updates; the 1.6.1 sweep had already taken everything to latest.Verification
Locally on go1.27.0: build, vet, full test suite,
golangci-lint runat v2.13.1 (0 issues), andgovulncheck ./...all clean.