Skip to content

ci: extend go1.26.4 pin to remaining test workflows (follow-up to #5056) #5066

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
darccio merged 1 commit into from
Jul 24, 2026
Merged

ci: extend go1.26.4 pin to remaining test workflows (follow-up to #5056) #5066

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/appsec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ jobs:

- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: stable
go-version: "1.26.4"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Refresh the AppSec module cache for the pinned toolchain

When the AppSec module cache has already been populated by a pre-pin run, this job will still reuse it: the cache key is only go-pkg-mod-${{ hashFiles('**/go.sum') }}, and the lookup-only hit skips re-downloading before the test jobs restore that same cache. Since this pin is meant to avoid Go 1.26.5 module-cache corruption, leaving the key unchanged means a corrupted 1.26.5 cache can continue to break AppSec CI even though this step installs 1.26.4; include the Go patch/toolchain in the cache key or force a one-time cache refresh.

Useful? React with 👍 / 👎.

cache: false

- name: Cache Go modules
Expand Down Expand Up @@ -115,7 +115,7 @@ jobs:
strategy:
matrix:
runs-on: [ macos-14, macos-latest ] # oldest and newest macos runners available
go-version: [ "1.26", "1.25" ]
go-version: [ "1.26.4", "1.25" ]
fail-fast: true # saving some CI time - macos runners are too long to get
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
Expand Down Expand Up @@ -248,7 +248,7 @@ jobs:

- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: stable
go-version: "1.26.4"
cache: false # we manage the caching ourselves

- run: go env -w GOMODCACHE="${{ github.workspace }}\${{ needs.go-mod-caching.outputs.path }}"
Expand Down Expand Up @@ -310,7 +310,7 @@ jobs:
- go-mod-caching
strategy:
matrix:
go-version: [ "1.26", "1.25" ]
go-version: [ "1.26.4", "1.25" ]
distribution: [ trixie, bookworm, alpine ]
platform: [ linux/amd64, linux/arm64 ]

Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/dynamic-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,15 +35,15 @@ jobs:
name: Dynamic Analysis with Debug Detection
uses: ./.github/workflows/unit-integration-tests.yml
with:
go-version: stable
go-version: "1.26.4"
build_tags: "debug"
secrets: inherit

test-with-deadlock:
name: Dynamic Analysis with Deadlock Detection
uses: ./.github/workflows/unit-integration-tests.yml
with:
go-version: stable
go-version: "1.26.4"
build_tags: "deadlock"
secrets: inherit

Expand All @@ -53,7 +53,7 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
go-version: ["oldstable", "stable"]
go-version: ["oldstable", "1.26.4"]
build_tags: ["debug", "debug,deadlock"]
fail-fast: false
env:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/main-branch-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
id-token: write
pull-requests: write
with:
go-version: "1.26" # Should be the highest supported version of Go
go-version: "1.26.4" # Should be the highest supported version of Go
secrets: inherit

warm-repo-cache:
Expand All @@ -48,7 +48,7 @@ jobs:
strategy:
matrix:
runs-on: [ macos-latest, windows-latest, ubuntu-latest ]
go-version: [ "1.25", "1.26" ]
go-version: [ "1.25", "1.26.4" ]
fail-fast: false
uses: ./.github/workflows/multios-unit-tests.yml
permissions:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/orchestrion.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ jobs:
- name: Setup Go and development tools
uses: ./.github/actions/setup-go
with:
go-version: stable
go-version: "1.26.4"
tools-dir: ${{ github.workspace }}/_tools
tools-bin: ${{ github.workspace }}/bin
- name: Run generator
Expand All @@ -72,7 +72,7 @@ jobs:
- name: Setup Go
uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
with:
go-version: stable
go-version: "1.26.4"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pin the Orchestrion matrix output

Pinning this setup step does not pin the Orchestrion integration-test matrix: the next step runs go run ./internal/orchestrion/matrix, whose output is still oldstable/stable (internal/orchestrion/matrix/matrix.go:51), and integration-test uses that output as matrix.go-version (.github/workflows/orchestrion.yml:120). Per the setup-go docs, stable tracks the latest stable Go, currently 1.26.5, so these jobs will still run the unpinned patch rather than 1.26.4; change the matrix output while this pin is needed.

Useful? React with 👍 / 👎.

cache: true
cache-dependency-path: '**/go.mod'
- name: Compute Matrix
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/pull-request.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
- warm-repo-cache
strategy:
matrix:
go-version: [ "1.25", "1.26" ]
go-version: [ "1.25", "1.26.4" ]

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Propagate the pin into unit setup

This pinned PR leg still invokes unit-integration-tests.yml, whose prerequisite set-up job installs go-version: stable before computing the contrib matrix (.github/workflows/unit-integration-tests.yml:47-56). Because setup-go resolves stable to the latest stable patch, currently 1.26.5, PR/main/dynamic workflows can still fail in this setup phase under the patch this change is trying to avoid; pass the requested Go version into that setup step as well.

Useful? React with 👍 / 👎.

fail-fast: false
uses: ./.github/workflows/unit-integration-tests.yml
with:
Expand All @@ -43,7 +43,7 @@ jobs:
strategy:
matrix:
runs-on: [ macos-latest, windows-latest, ubuntu-latest ]
go-version: [ "1.25", "1.26" ]
go-version: [ "1.25", "1.26.4" ]
fail-fast: false
uses: ./.github/workflows/multios-unit-tests.yml
with:
Expand Down
Loading