ci: pin Go to 1.25.7 + restore Java↔Go parity workflow

Goal: lock the toolchain to a version available on developer machines.
1.26+ is too new (not on Homebrew, not in most Linux distros yet), so
declare go 1.25.7 in go.mod and pin the same version in both CI
workflows.

Also restores go-parity.yml — earlier iteration deleted it as part of
"remove Java build from pipeline", but the new goal is to keep the
parity check active until Phase 6 cutover. The restored workflow has
all the fixes from the prior pass:

- Builds Java jar with -Dfrontend.skip=true (npm wasn't on CI image).
- Runs `enrich -Dspring.profiles.active=serving` before `graph -f json`
  so the JSON export reads from the populated Neo4j store rather than
  bailing with "No graph data found."
- Runs the graph export from inside the fixture directory so Neo4j
  resolves the embedded DB path correctly.
- Uploads /tmp/java-raw.json + /tmp/java-normalized.json on failure
  so the parity diff is recoverable for offline triage.
- Triggers on PR changes to go/**, src/**, pom.xml, or this workflow,
  plus workflow_dispatch for manual runs.

Local: 828 tests pass with the downgraded go.mod (1.25.7 doesn't lose
anything we use — no 1.26-specific features in the tree).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

.github/workflows/go-ci.yml

@@ -24,7 +24,9 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          # Pin to 1.25.x — 1.26+ isn't on enough developer machines yet.
+          # go.mod declares `go 1.25.7` to match.
+          go-version: '1.25.7'
           cache: true
           cache-dependency-path: go/go.sum
       - name: Install C toolchain

.github/workflows/go-parity.yml

@@ -0,0 +1,96 @@
+name: go-parity
+
+# Java vs Go parity test for fixture-minimal. Validates that the Go port
+# produces the same canonical graph shape as the Java reference until
+# Phase 6 cutover deletes the Java tree. Runs on PRs that touch the Go
+# tree, the Java tree, the parity harness, or this workflow.
+#
+# The Java side ships a JSON graph via `codeiq graph -f json` from the
+# `serving` profile (Neo4j-backed). A small jq filter
+# (go/parity/java-normalize.jq) rewrites that into the same per-file
+# canonical shape that the Go-side parity.Normalize emits. The two
+# normalized JSON blobs are then diff'd by the `parity` build tag in
+# go/parity/parity_test.go, with expected-divergence.json holding the
+# allow-list of intentional drift.
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'go/**'
+      - 'src/**'
+      - 'pom.xml'
+      - '.github/workflows/go-parity.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  parity:
+    name: Java vs Go parity (fixture-minimal)
+    runs-on: ubuntu-latest
+    env:
+      CGO_ENABLED: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+      - uses: actions/setup-go@v5
+        with:
+          # Pin to 1.25.x — 1.26+ isn't on enough developer machines yet.
+          go-version: '1.25.7'
+          cache: true
+          cache-dependency-path: go/go.sum
+      - name: Install C toolchain
+        run: sudo apt-get update -y && sudo apt-get install -y build-essential jq
+
+      # ---- Java side ----------------------------------------------------
+      - name: Build Java jar (skip frontend)
+        run: mvn -B -q -DskipTests -Dfrontend.skip=true package
+      - name: Stage Java fixture (separate copy so caches don't collide)
+        run: cp -r go/testdata/fixture-minimal /tmp/fm-java
+      - name: Java index → H2 cache
+        run: java -jar target/code-iq-*-cli.jar index /tmp/fm-java
+      - name: Java enrich → Neo4j (serving profile)
+        # `graph -f json` reads from Neo4j under the serving profile, not
+        # H2. Need to enrich first or the export prints "No graph data
+        # found. Run 'codeiq analyze' first."
+        run: |
+          java -Dspring.profiles.active=serving \
+            -jar target/code-iq-*-cli.jar enrich /tmp/fm-java
+      - name: Java graph → normalized JSON
+        # Run from inside the fixture so Neo4j path resolution finds the
+        # store enrich wrote. java-normalize.jq pivots the Java
+        # {nodes:[...], edges:[...]} shape into the per-file array shape
+        # parity.Normalize uses on the Go side.
+        run: |
+          cd /tmp/fm-java
+          java -Dspring.profiles.active=serving \
+            -jar "$GITHUB_WORKSPACE"/target/code-iq-*-cli.jar graph . -f json \
+            > /tmp/java-raw.json
+          jq -f "$GITHUB_WORKSPACE"/go/parity/java-normalize.jq /tmp/java-raw.json \
+            > /tmp/java-normalized.json
+
+      # ---- Go side ------------------------------------------------------
+      - name: Build Go binary
+        working-directory: go
+        run: go build -o codeiq ./cmd/codeiq
+      - name: Go parity test (diff vs normalized Java output)
+        working-directory: go
+        env:
+          TEST_JAVA_NORMALIZED: /tmp/java-normalized.json
+        run: go test -tags=parity ./parity/... -v
+
+      # ---- Failure artifact --------------------------------------------
+      - name: Upload normalized JSON on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: parity-diff
+          path: |
+            /tmp/java-normalized.json
+            /tmp/java-raw.json

go/go.mod

@@ -1,6 +1,6 @@
 module github.com/randomcodespace/codeiq/go
 
-go 1.26.2
+go 1.25.7
 
 require github.com/mattn/go-sqlite3 v1.14.22