From 7007b0757f5186a5cb21caf88fd23aec32c03688 Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Fri, 24 Jul 2026 12:56:17 +0200 Subject: [PATCH] ci: extend go1.26.4 pin to remaining test workflows (follow-up to #5056) #5056 pinned Go 1.26.4 (off corruption-prone 1.26.5, golang/go#77168) only in smoke-tests.yml and govulncheck-fix.yml. The remaining test/build workflows still ran 1.26.5 via stable or the "1.26" minor, so the same zip: checksum error corruption kept hitting the default-branch and PR test matrix. Pin the 1.26.5-exposed go-version entries to "1.26.4" in main-branch-tests, pull-request, appsec, dynamic-checks, and orchestrion; oldstable and "1.25" unchanged. govulncheck.yml stays on stable on purpose: govulncheck scans the toolchain stdlib, and 1.26.4 still carries GO-2026-5856 (crypto/tls ECH, CVE-2026-42505, fixed in 1.26.5), so pinning it down reintroduces a real finding. Test/build jobs only need to dodge the corruption, so 1.26.4 is fine there. On smoke-tests the pin cut the corruption rate from ~40% to ~10% -- a reduction, not a fix. Temporary until Go ships the #77168 fix. --- .github/workflows/appsec.yml | 8 ++++---- .github/workflows/dynamic-checks.yml | 6 +++--- .github/workflows/main-branch-tests.yml | 4 ++-- .github/workflows/orchestrion.yml | 4 ++-- .github/workflows/pull-request.yml | 4 ++-- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/appsec.yml b/.github/workflows/appsec.yml index 97bd7e5d1bf..223cde3aaf7 100644 --- a/.github/workflows/appsec.yml +++ b/.github/workflows/appsec.yml @@ -86,7 +86,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: stable + go-version: "1.26.4" cache: false - name: Cache Go modules @@ -115,7 +115,7 @@ jobs: strategy: matrix: runs-on: [ macos-14, macos-latest ] # oldest and newest macos runners available - go-version: [ "1.26", "1.25" ] + go-version: [ "1.26.4", "1.25" ] fail-fast: true # saving some CI time - macos runners are too long to get steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -248,7 +248,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: stable + go-version: "1.26.4" cache: false # we manage the caching ourselves - run: go env -w GOMODCACHE="${{ github.workspace }}\${{ needs.go-mod-caching.outputs.path }}" @@ -310,7 +310,7 @@ jobs: - go-mod-caching strategy: matrix: - go-version: [ "1.26", "1.25" ] + go-version: [ "1.26.4", "1.25" ] distribution: [ trixie, bookworm, alpine ] platform: [ linux/amd64, linux/arm64 ] diff --git a/.github/workflows/dynamic-checks.yml b/.github/workflows/dynamic-checks.yml index 35aeada4c71..1abad2978b7 100644 --- a/.github/workflows/dynamic-checks.yml +++ b/.github/workflows/dynamic-checks.yml @@ -35,7 +35,7 @@ jobs: name: Dynamic Analysis with Debug Detection uses: ./.github/workflows/unit-integration-tests.yml with: - go-version: stable + go-version: "1.26.4" build_tags: "debug" secrets: inherit @@ -43,7 +43,7 @@ jobs: name: Dynamic Analysis with Deadlock Detection uses: ./.github/workflows/unit-integration-tests.yml with: - go-version: stable + go-version: "1.26.4" build_tags: "deadlock" secrets: inherit @@ -53,7 +53,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - go-version: ["oldstable", "stable"] + go-version: ["oldstable", "1.26.4"] build_tags: ["debug", "debug,deadlock"] fail-fast: false env: diff --git a/.github/workflows/main-branch-tests.yml b/.github/workflows/main-branch-tests.yml index 6fef458668e..f287b16dad2 100644 --- a/.github/workflows/main-branch-tests.yml +++ b/.github/workflows/main-branch-tests.yml @@ -26,7 +26,7 @@ jobs: id-token: write pull-requests: write with: - go-version: "1.26" # Should be the highest supported version of Go + go-version: "1.26.4" # Should be the highest supported version of Go secrets: inherit warm-repo-cache: @@ -48,7 +48,7 @@ jobs: strategy: matrix: runs-on: [ macos-latest, windows-latest, ubuntu-latest ] - go-version: [ "1.25", "1.26" ] + go-version: [ "1.25", "1.26.4" ] fail-fast: false uses: ./.github/workflows/multios-unit-tests.yml permissions: diff --git a/.github/workflows/orchestrion.yml b/.github/workflows/orchestrion.yml index 2511b32d4bc..fcf92b675d7 100644 --- a/.github/workflows/orchestrion.yml +++ b/.github/workflows/orchestrion.yml @@ -47,7 +47,7 @@ jobs: - name: Setup Go and development tools uses: ./.github/actions/setup-go with: - go-version: stable + go-version: "1.26.4" tools-dir: ${{ github.workspace }}/_tools tools-bin: ${{ github.workspace }}/bin - name: Run generator @@ -72,7 +72,7 @@ jobs: - name: Setup Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: stable + go-version: "1.26.4" cache: true cache-dependency-path: '**/go.mod' - name: Compute Matrix diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index e1c244f0cb1..126a80146e4 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -31,7 +31,7 @@ jobs: - warm-repo-cache strategy: matrix: - go-version: [ "1.25", "1.26" ] + go-version: [ "1.25", "1.26.4" ] fail-fast: false uses: ./.github/workflows/unit-integration-tests.yml with: @@ -43,7 +43,7 @@ jobs: strategy: matrix: runs-on: [ macos-latest, windows-latest, ubuntu-latest ] - go-version: [ "1.25", "1.26" ] + go-version: [ "1.25", "1.26.4" ] fail-fast: false uses: ./.github/workflows/multios-unit-tests.yml with: