Skip to content

probe 4: merge-commit method, contributor-authored commit - #9

Merged
quad341 merged 1 commit into
mpr-probe-base4from
mpr-probe-h4
Jul 28, 2026
Merged

quad341 merged 1 commit into
mpr-probe-base4from
mpr-probe-h4

Conversation

@quad341

@quad341 quad341 commented Jul 28, 2026

Copy link
Copy Markdown
Owner

Throwaway attribution probe (gm-ubcxn).

@quad341
quad341 merged this pull request into mpr-probe-base4 Jul 28, 2026
@quad341
quad341 deleted the mpr-probe-h4 branch July 28, 2026 05:07
quad341 pushed a commit that referenced this pull request Oct 26, 2026
…townhall#8291)

Part of the Dolt 2.6.0 rollout that follows the eMudhra CA compromise
(https://emudhra.we-have-a-problem.com/). Dolt 2.6.0 is the first Dolt
release built with a Go toolchain (1.27.3) that distrusts the eight
compromised eMudhra intermediates. This PR makes 2.6.0 Gas City's
minimum Dolt, moves gascity to Go 1.27.3, and re-pins the rbe-west
worker host to Go 1.27.3 and Dolt 2.6.0.

**Stacked on gastownhall#8321** (golangci-lint v2.14.0, gofumpt v0.12.0,
staticcheck v0.8.1). golangci-lint v2.12.0 cannot read Go 1.27 export
data, so without gastownhall#8321 `Mac / quality` and `Mac regression summary` go
red on this PR, and after a merge on every PR. This branch currently
contains gastownhall#8321's four commits plus three of its own. Once gastownhall#8321 is
squash-merged, I'll rebase this branch onto `main` and drop them; the
golangci-lint pin then comes from `main`. gastownhall#8287 (the Dolt CLI and image
pins) is merged as `5e10c84c2`.

**Updated 2026-10-26 after the independent review**
(gastownhall#8291 (comment)).
The section "Review findings" below says what changed for each finding.

## What changed

**Commit 1 (`fix(deps)`): Dolt 2.6.0 floor, Go 1.27.3 and the
CHANGELOG**

| | Old | New |
|---|---|---|
| `internal/doltversion` `ManagedMin` (gc init/start readiness, `gc
doctor` `dolt-version`) | 2.1.0 | **2.6.0** |
| dolt pack `doctor/check-dolt` `required`, `pack.toml` minimum note |
2.1.0 | 2.6.0 |
| Bazel test Dolt (`MODULE.bazel` http_archive, every
`GC_TEST_TOOL_PATHS` / runfiles reference) | `dolt_bin_v2_2_0` |
`dolt_bin_v2_6_0` (sha256 `a8d4c2e2…`, the release asset) |
| `go.mod`, `tools/nogo/go.mod`, `gazelle.go.work` `go` line | 1.26.10 |
1.27.3 |
| Bazel `go_sdk.download` + `MODULE.bazel.lock` go_sdk facts | 1.26.10 |
1.27.3 (39 archives; sha256s identical to go.dev's JSON) |
| gazelle `go_repository_tools` `_PINS` | go1.26.10 | +
`0.53.0/go1.27.3/linux_amd64` (same digests beads pins, reproducible
build) |
| `golang.org/x/tools` (root and `tools/nogo`) /
`golang.org/x/telemetry` (root, required by x/tools) | v0.49.0 /
`v0.0.0-20260811182544-a038080d80e5` | v0.50.0 /
`v0.0.0-20260908163034-4bcc4b2ee518` (staticcheck stays at gastownhall#8321's
v0.8.1) |
| `contrib/k8s/Dockerfile.agent` bd-builder stage |
`golang:1.26.10-bookworm@sha256:ee3901c6…` |
`golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5`
(index digest; same image gastownhall#8287 uses for `Dockerfile.base`) |
| devcontainer image / README | `go:1.26-ubuntu-24.04` |
`go:1.27-ubuntu-24.04` |

- **Why `x/tools`:** in v0.49.0, nogo's importer (`internal/pkgbits`)
reads export data up to version 4, and Go 1.27 writes version 5. On the
1.27.3 SDK, every nogo action failed with `cannot decode "os", export
data version 5 is greater than maximum supported version 4`. v0.50.0
adds V5; beads moved to it in beads#7829.
- `third_party/patches/x_tools_ctrlflow_stdlib_noreturn.patch` still
applies, because `ctrlflow.go` is identical in v0.49.0 and v0.50.0.
- The root `go.sum` only gains the new x/tools and x/telemetry lines; no
other `require` moved. I didn't run Go 1.27's `go mod tidy` on the root
module: it would also prune about 270 stale `go.sum` lines, which is
unrelated churn. `tools/nogo` is tidy (`go mod tidy` there only drops
x/tools v0.49.0; gastownhall#8321 already dropped the other orphans).
- Docs: README, `docs/getting-started/{installation,troubleshooting}.md`
and `docs/troubleshooting/dolt-bloat-recovery.md` now give the 2.6.0
floor and its reason, and say building from source needs Go 1.27.3.
- CHANGELOG `[Unreleased]`, Upgrading Notes:
  - "Dolt 2.6.0 or newer is now required".
  - gastownhall#8287's pin note, corrected:
- **Which CI pins moved:** the workflows' `DOLT_VERSION` (macOS
regression, nightly, RC Gate, Ollama, fork-verify) and, with this PR,
the Bazel test Dolt.
- **The behaviour changes the 2.2.0 → 2.6.0 move crosses, each
attributed to its release:** strict `sql_mode` since 2.3.3; 2.4.0's
UPDATE privilege for `ON DUPLICATE KEY UPDATE` and its MySQL error
codes; 2.5.0's multi-branch commits; and 2.6.0's `dolt_merge()` change.
That change applies only to histories with several merge bases
(criss-cross): 2.6.0 merges a virtual base, as git does. It can raise
conflicts that earlier releases resolved silently and drop some spurious
ones.
- **Why rollback is not a downgrade:** once Dolt 2.3.3+ creates or
alters a schema with a descending index column, as bd's schema has, a
Dolt below 2.3.3 can't write to the database (`table has unknown
fields`). The old note blamed a first-start migration instead.
- **A new Go 1.27.3 note.** On macOS and Windows, a set
`SSL_CERT_FILE`/`SSL_CERT_DIR` now replaces the system trust store
(GODEBUG `x509sslcertoverrideplatform`, new default in Go 1.27). gc on
macOS needs macOS 13 or newer. This is documented, with no `godebug`
opt-out.
- CHANGELOG, Changed: "Go toolchain 1.27.3". It now tells contributors
to rebuild golangci-lint with Go 1.27.3.
- `examples/bd/dolt/pack.toml` no longer claims that the sync step
checks the Dolt version; `commands/sync/run.sh` has no such check.
- `internal/testenv/bazel_tools_internal_test.go`: the last
`dolt_bin_v2_2_0` (a path-splitting fixture string) is now
`dolt_bin_v2_6_0`.
- The comments in the generated managed-Dolt config
(`cmd/gc/cmd_dolt_config.go`, `gc-beads-bd.sh`) now say the floor is
2.6.0+.

**Commit 2 (`fix(productmetrics)`): `tls.Config.Rand` under Go 1.27.**
Go 1.27 deprecates `tls.Config.Rand` ("should be left nil in
production"), so staticcheck v0.8.1 reports SA1019 on
`isClosedProductionTLSConfig`'s read of it
(`internal/productmetrics/upload.go:287`). The policy requires `Rand` to
be nil, which is exactly what the deprecation asks for. So the check
stays, and the read carries a `//nolint:staticcheck // SA1019` with that
reason.

**Commit 3 (`build(rbe)`): worker host re-pin**

| | Old | New |
|---|---|---|
| `.github/actions/rbe-worker/pin` | `3bfd8aea` |
`80d70774f18401e5aed2cb4982328fee808d0fc2` |
| `tools/rbe/worker-env.txt` `dolt` / `go` lines | `dolt version 2.1.8`
/ `go1.26.10` | `dolt version 2.6.0` / `go1.27.3` |
| `platforms/BUILD.bazel` worker-env pin | `sha256:7065d0a1…` |
`sha256:1c13f58eb37a36d4961b8db0e37825d1ddc39ebce86a33bd58b50abb495bfd98`
(sha256 of the manifest) |

rbe-worker bump (`bin/bump-summary 3bfd8aea 80d70774`):
- Compare:
gastownhall/rbe-worker@3bfd8ae...80d7077
- Commits:
- `80d7077` chore(worker): bump dolt 2.1.8 -> 2.6.0 (#9). The only
worker-executed change: `DOLT_VERSION=2.6.0`, `DOLT_SHA256=a8d4c2e2…`.
- `4f3a96b` fix(security): build and self-test with Go 1.26.10 (#8).
This touches only rbe-worker's own go.mod and fixtures.
- Measurement, isolation and microVM files: unchanged.

The workers install `go.mod`'s Go (`blacksmith-worker.sh`:
`GO_VERSION=$(awk '/^go /…' go.mod)`) and the pinned rbe-worker's Dolt.
Go 1.27.3 and the 2.6.0 floor therefore need this new host in the same
PR: the floor needs the host Dolt at 2.6.0, and
`TestRBEWorkerEnvManifestNamesTheWorkerHost` requires the manifest's
`go` line to equal go.mod's.

The former commit 3 (`style(test)`, the formatter-agnostic
`worker_inference` return) is now in gastownhall#8321, which needs it for gofumpt
v0.12.0 too, so it dropped out of this branch on rebase.

## Review findings
(gastownhall#8291 (comment))

1. **Conflict with `main`: fixed.** I rebased with `git rebase --onto
origin/main 72472bd` and then onto gastownhall#8321.
2. **Mac / quality red: fixed by gastownhall#8321**, plus commit 2 here, as
recommended. gastownhall#8321 is a separate PR on Go 1.26.10. It carries
golangci-lint v2.14.0, gofumpt v0.12.0, staticcheck v0.8.1, the reformat
and the Go-1.26 findings. On gastownhall#8321, `Mac / quality` and `Mac regression
summary` pass.
3. **GODEBUG defaults: documented.** The new CHANGELOG Upgrading Note
covers the `SSL_CERT_FILE`/`SSL_CERT_DIR` change on macOS/Windows and
macOS 13. There is no `godebug` opt-out (the coordinator's decision).
`tracebacklabels` changes only traceback output and isn't called out.
4. **staticcheck crash on Go 1.27 struct-literal keys: fixed in gastownhall#8321**
(v0.8.1). The `analyzers.bzl` lists were updated: +SA9010, -SA5011.
5. **Enqueue alone:** this is merge gate 4.
6. **Stale `dolt_bin_v2_2_0` fixture: renamed** to `v2_6_0`.
7. **pack.toml sync-step claim: removed.**
8. **Devcontainer tag: not changed** (see Follow-ups).
9. **`tools/nogo/go.sum`: tidy.**

The gastownhall#8287 review's CHANGELOG wording fixes
(gastownhall#8287 (comment)),
findings 1-3, are applied here. They cover the rollback mechanism, the
`sql_mode` attribution to 2.3.3 plus 2.4.0/2.5.0, and which CI pins
moved. The `dolt_merge` description is corrected too: it changes only
for criss-cross histories and does not "take the newer change".

## Deferred: the beads library bump

`go.mod` keeps `github.com/steveyegge/beads v1.3.2`. `deps.env` `BD_*`,
`Dockerfile.agent` `BD_SOURCE_REF` and the native store's schema cursors
(66/26) are unchanged.

Moving to beads `main` (the Dolt 2.6.0 engine, beads#7829) takes bd's
schema to 72/28 (migrations 0067-0072 and ignored 0027-0028). Every
Bazel bd cell runs the v1.3.2 release archive, so the native-lane
acceptance tests would see `schema_skew` and fall back to the bd CLI.
That bump moves with the **bd v1.4.0** release: go.mod at the tag,
`BD_CURRENT_VERSION`/`BD_VERSION`, a `bd_bin_v1_4_0` archive and the
cursors together. Until then, `scripts/check-embedded-pins` (nightly
`bundled-pack-pins`, and `rc-gate`'s `--bd-advisory`) reports
`DOLT_VERSION=2.6.0, beads v1.3.2 qualifies Dolt 2.2.0`, as on gastownhall#8287.

## Merge prerequisites and order

This PR is labelled `status/human-review-required` so the review
pipeline cannot auto-merge it. Remove the label only once these gates
hold:

1. **gastownhall#8321 is merged, and this branch is rebased onto `main` after it.**
gastownhall#8287 is already merged.
2. **The hosted beads Dolt is upgraded to 2.6.0 (gascity/infra#2471),
along with the other B3 servers and CLIs.** After this merges, `gc
init`/`gc start` and `gc doctor` refuse any Dolt below 2.6.0.
3. **The farm-side worker-env prerequisite below is done.** No operator
step is needed, but check these before merging.
- **How the farm picks up the new pin.** rbe-west's oss and oss-fork
schedulers match `worker-env` exactly. Pool workers come from
`rbe-worker-pool.yml`, which runs on gascity `main` only. They are
dispatched by `rbe-oss-pool-scaler` on rbe-west-core-1 when actions
queue, by its warm floor, and by `bazel.yml`'s pre-warm. Each one checks
out `main`, fetches the pinned rbe-worker, installs `main`'s Go and the
rbe-worker's Dolt, measures the host, and advertises that hash for its
whole life. The first pool runs dispatched after the merge therefore
serve the new pin. Main's post-merge Bazel run queues actions on that
pin, and the scaler dispatches workers for them, so nothing on
rbe-west-core-1 needs editing or restarting. Before the merge nothing
can serve the new pin (see "What CI checks" below).
- **The PR's `rbe worker host` job (bazel.yml `worker-host`) must be
green.** It fetches rbe-worker `80d70774` anonymously and runs H5 on the
bump range. It then measures a real Blacksmith host (Go from this
go.mod, Dolt 2.6.0) against the new manifest, which fails if they
differ, and runs the new commit's `cmd/product-check`. If the
measurement drifted, merging would leave every gascity remote action
unservable.
- **No open `rbe-worker-env-drift` issue on gastownhall/gascity.** While
one is open, both pool scalers cap the pools at 2 workers. There was
none at 2026-10-26 03:10Z; the canary was green at 01:00Z.
- **`rbe-oss-pool-scaler` up, with its breaker closed.** This is an
operator journal check (`pool scaler:` lines). I haven't touched or
ssh'd to the farm.
- **Workers already running keep the old pin until they retire.** Burst
workers retire after their idle window (the scaler currently dispatches
them with 8 minutes). Warm-floor workers last until 03:00Z or 300
minutes, and they count toward the floor and the 24-worker max but take
no new-pin work. **Merge outside the 13:00Z-03:00Z floor window**, or
expect the old floor to linger.
- **No grace window for beads.** This re-pin moves the `dolt` line as
well as `go`, so `worker-env-notify-beads.yml`'s grace job publishes
`previous none` and rbe-west runs no previous-pin legacy workers. The
same push dispatches `gascity-worker-env-repinned`, and beads'
`worker-env-autosync.yml` opens the sync PR within a minute or two. Its
CI runs fully uncached, about an hour; the release lane has hit its
90-minute timeout before. Until that PR lands, every beads PR fails at
`Bazel / execution mode`.
- beads `main` is already on Go 1.27.3 with Dolt 2.6.0 test pins, so the
new host suits it.
- bd-enterprise and gc-enterprise copy the manifest by hand;
gc-enterprise's is in its mirror PR.
- **The first runs after the re-pin are uncached** (every action key
changes). Main's push run executes everything on the new host, on a
congested farm with 60-90-minute lane timeouts. Re-run a cancelled lane;
the remote cache keeps progress.
- **Rollback:** revert this PR. Pool workers dispatched from the
reverted `main` measure and serve the old pin again.
4. **Enqueue this PR alone.** The worker-env pin moves, so worker-env
preflight skips `bazel test` for the whole merge group. The `main`
ruleset batches up to 5 PRs, and any PR batched with this one would land
without ever having been Bazel-tested on Go 1.27.3. Enqueue it when the
queue is empty.

## What CI checks before merge, and what runs only after

Because the worker-env pin moves, `bazel.yml`'s `worker-env preflight`
skips `bazel test` in **every lane (unit `//...`, acceptance,
integration-packages, integration-smoke), on this PR and in the merge
queue**. The pool serves only `main`'s pin. The required `bazel test
(side-by-side)` gate passes on `rbe`, `sync-check` and `worker-host`
alone.

- **Runs pre-merge:**
  - `worker-host` (the measurement, H5 and product-check above);
  - `BUILD files in sync` (gazelle, using the read-only fork cache);
- the GitHub-hosted jobs: Container Scan, which builds the images with
this PR's Dockerfiles; the Mac smoke tier; the Contract radar, which has
failed since beads#7829 because it builds bd main with go.mod's Go and
should pass again on 1.27.3; and the other path-filtered `ci.yml` jobs.
- **Runs only after merge:** the push to `main` runs the full Bazel
suite on the new pin, uncached:
  - nogo/vet/format/policy and unit `//...`;
  - acceptance Tier A, with the bd v1.3.2 and Dolt 2.6.0 cells;
  - integration-packages and integration-smoke.

`bazel-nightly.yml` adds the full `//test/integration` suite and
coverage. Watch the first main run, the `rbe-worker-env-canary.yml` run
on the merge, and beads' autosync PR.

## Verification (local, on cherry)

Under the disk guard, I ran no local Bazel test suite and no Docker
build (Container Scan covers the images).

**This revision** (`aa058bace`, on gastownhall#8321 rebased onto `main`
`3fb225b90`), all with Go 1.27.3. After the rebase, the code that main
gained since the last revision is clean: `go build ./...`, `go vet` and
golangci-lint v2.14.0 on its packages report 0 issues, and the
formatters are clean on its files.
- **golangci-lint v2.14.0** (built with Go 1.27.3):
- `golangci-lint run ./...` reports `0 issues.` That covers the
`tls.Config.Rand` SA1019, which it reported before commit 2.
  - `golangci-lint fmt --diff ./...` prints nothing.
- **`scripts/check-go-format.sh`** with gofumpt v0.12.0 and goimports
v0.50.0, both built with Go 1.27.3: `5823 Go files formatted.`
- **Pre-commit hook on the new and amended commits.** These ran with the
old worker-env pin still in place, so remote nogo could serve them.
- nogo on `//internal/testenv` and `//internal/productmetrics`
(staticcheck v0.8.1, Go 1.27.3 SDK, remote) passed.
  - `//test/docsync:docsync_test` passed.
  - Codegen showed no drift.
- **`go build ./...`** passes.
- **`go test`**, with Dolt 2.6.0 first on PATH, all ok:
`./internal/productmetrics/...`, `./internal/testenv`,
`./internal/doltversion`, `./test/docsync`, `./scripts` (the policy
suite) and `tools/nogo`.
- **Pre-push** (`GC_PREPUSH_SUITE=go`): `All fast jobs passed`, 10 of 10
jobs: unit-core, unit-cmd-gc 1-6 of 6, fsys-darwin-compile and the two
self-tests. This is the hook's documented mode for a moved pin; `auto`
would fall back to fork-cache with local execution, which the host rules
forbid.

**CI on revision `40cb54244`** (before the 06:30Z rebase onto `main`
`3fb225b90`, which conflicted only in the CHANGELOG): every check
passes. That includes `Mac / quality`, `Mac regression summary`,
`Contract radar` (green again now that go.mod is at 1.27.3), `Image
vulnerabilities`, `rbe worker host`, `bazel test (side-by-side)` and `CI
/ required`. The Bazel test lanes were skipped by worker-env preflight,
as described above.

**Earlier revision**, with the same floor and toolchain changes:

- **nogo through the pre-commit hook.** `make lint-changed
LINT_CHANGED_SCOPE=staged` over the staged packages (`//cmd/gc`,
`//internal/beads`, `//internal/doctor`, `//internal/doltversion`,
`//examples/bd/dolt`, `//scripts`, `//test/integration`) built remotely
on rbe-west's oss instance with the Go 1.27.3 SDK. It ran before the
worker-host files changed, which is why the re-pin is its own commit.
Build completed successfully: 6,522 actions, 6,503 of them remote.
- **`make check-docs`** (Bazel docsync test, remote) in the same hook:
`//test/docsync:docsync_test` PASSED.
- **Go 1.27.3, plain go:**
  - `go build ./...` passes;
- `go vet ./...` is clean under every build tag the tree uses
(integration, acceptance_a/b/c, acceptance_bd_contract,
gascity_native_beads, dolt_integration, productmetrics_testhook,
gc_coarse_clock) and under GOOS=darwin;
  - `tools/nogo` `go test ./...` passes.
- **`go test`, Go 1.27.3, with Dolt 2.6.0 first on PATH**
(`/usr/local/lib/dolt-2.6.0/dolt`, the same bytes as the v2.6.0 release
binary):
  - `./internal/doltversion`: ok.
  - `./internal/doctor`: ok, whole package.
  - `./examples/bd/dolt`: 412 PASS, 0 SKIP, 0 FAIL.
- `./examples/bd/dolt -tags integration`, against real Dolt 2.6.0
servers and bd v1.3.2 (release archive, sha-verified): 426 PASS, 0 SKIP,
0 FAIL. This includes the real-Dolt compaction, flatten, rollback and
remote-push tests and the real-bd stale-db close test.
- `./cmd/gc`, targeted: `TestBuiltinDoltDoctor*`,
`TestCheckHardDependencies*`,
`TestDoStartForegroundReportsHardDependenciesBeforeDoltIdentity`, and
the dolt-config/readiness set. 82 PASS, 0 FAIL, 1 SKIP; the skip is the
shell-fallback test, which is process-only by design.
- `./scripts`: the whole policy suite passes, including
TestDoltVersionPins, TestBDVersionPins, TestRBEWorker*,
TestBazelExecutesOnWorkerPlatform, TestGoRepositoryTools*, the container
and Dockerfile tests, the worker-env grace and drift tests, and the
hooks tests.
  - `./test/docsync`: ok.
  - `./tools/nogo`: TestModuleRequirementsAgreeWithRoot passes.
- **rbe-worker `cmd/product-check -product-root <this checkout>
-skip-client` at `80d70774`:** `product-check: ok`. This covers the
manifest package set, the dolt line against the worker's `DOLT_VERSION`,
the test PATH, and the pin against the manifest's sha256.
- **`.github/actions/rbe-worker/h5.sh` on `3bfd8aea..80d70774`:** 2
commits, all signed, verified, committed by web-flow and merged.
- **`tools/rbe/worker-env-grace record`** for this re-pin: `previous
none` ("the re-pin moves more than the go line"). Record: `pin
sha256:1c13f58e…`, `previous none`, reason `-dolt dolt version 2.1.8,
+dolt dolt version 2.6.0`.
- **Pre-push hook:** `GC_PREPUSH_SUITE=go` (`make test-fast-parallel`).
The hook refuses remote execution for a moved pin, and the disk guard
rules out its local Bazel fallback. `All fast jobs passed` (10 jobs:
unit-core, unit-cmd-gc 1-6 of 6, fsys-darwin-compile and the two
self-tests), about 36 minutes, on both pushes. The second push added
commit 3, and its pre-commit nogo on
`//test/acceptance/worker_inference` also passed.

## Tests changed, and why

- **Floor moves to 2.6.0, so boundaries move with it.** Below-floor
cases now include 2.5.1 (the last release under the floor), 2.2.0 and
2.1.0 (the previous floor). Above-floor cases include multi-digit 2.6.10
and 2.10.0 (lexical-order traps). Pre-release cases now sit at the 2.6.0
floor.
  - `internal/doltversion/doltversion_test.go`
  - `internal/doctor/checks_test.go`: DoltVersionCheck cases.
- `examples/bd/dolt/doctor_test.go`: TestDoctorCheckVersionFloor, and
the flock/lsof/no-sort tests now use a passing 2.6.x.
- `cmd/gc/embed_builtin_packs_test.go`: the at-minimum and bounded-probe
doctor tests now use 2.6.0 and 2.6.10.
- **`scripts/dolt_version_pin_test.go`:** `doltFloor` is now 2.6.0.
gastownhall#8287 already moved `doltPin`.
- **`internal/beads/lookup_limit_error_test.go`:** Go 1.27's vet printf
check rejects `%w` with a `*LookupLimitError` operand, because the value
type is the error. The test still wraps a pointer, now passed as an
`error` value. No production code changed.
- **`scripts/container_tool_security_test.go`:** only the comment and
message naming the rebuild toolchain changed, from 1.26.10 to 1.27.3.

## Follow-ups and caveats

- **beads library and bd pins:** bump them with bd v1.4.0 (see
"Deferred" above).
- **`Mac / quality` and `Mac regression summary`** were red on the
previous revision because golangci-lint v2.12.0 can't read Go 1.27
export data. gastownhall#8321 moves to v2.14.0 and fixes what that flags on Go
1.26.10. This branch adds the one Go-1.27-only finding
(`tls.Config.Rand`, commit 2).
- **golangci-lint has to be rebuilt.** A golangci-lint built with Go
1.26 refuses this module ("the Go language version (go1.26) used to
build golangci-lint is lower than the targeted Go version (1.27.3)").
The pre-commit formatter (`scripts/precommit-format-staged-go`) runs
`golangci-lint` from PATH, so contributors and agent hosts need `make
install-tools` run with Go 1.27.3. CI builds it with go.mod's Go, so CI
is unaffected. On cherry I built v2.14.0 with Go 1.27.3 into a private
directory and left the shared `~/go/bin` alone. The CHANGELOG entry
carries the rebuild command.
- **The devcontainer image tag doesn't exist.**
`mcr.microsoft.com/devcontainers/go:*-ubuntu-24.04` isn't published (MCR
lists only `1.27`, `1.27-bookworm` and `1.27-trixie`), and
`1.26-ubuntu-24.04` didn't exist before this PR either. I kept the
repo's tag style and moved it to 1.27; switching the base is a separate
change.
- **`MODULE.bazel`'s comment on the x/tools ctrlflow patch** cites
SA5011, which staticcheck v0.8.1 no longer runs. See gastownhall#8321.
- **beads-team-server, gastown and crucible** follow in their own B4
PRs. The gc-enterprise mirror is a separate PR.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant