diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 08c06c5..76e16b8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -44,7 +44,7 @@ jobs: - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.6 + go-version: 1.27.0 cache: false - name: Set up Node.js @@ -171,7 +171,7 @@ jobs: - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.6 + go-version: 1.27.0 cache: false - name: Set up Node.js diff --git a/AGENTS.md b/AGENTS.md index 7e8f7f8..a1f7cae 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2,7 +2,7 @@ ## Cursor Cloud specific instructions -`ci-runner` is a single Go module (`github.com/melodic-software/ci-runner`, `go 1.26.6`) +`ci-runner` is a single Go module (`github.com/melodic-software/ci-runner`, `go 1.27.0`) that ships two commands: the operator CLI `./cmd/ci-runner` and the windowless `./cmd/ci-runner-controller`. The product's real runtime target is Windows (DPAPI, Docker Desktop, WSL, Task Scheduler), but every Windows-only source file @@ -13,26 +13,32 @@ lanes live in `.github/workflows/ci.yml`; the CLI surface is documented in ### Go toolchain (non-obvious) -The base `go` on `PATH` is 1.22.2. Go's `GOTOOLCHAIN=auto` reads the `go 1.26.6` -directive in `go.mod` and transparently fetches/execs the go1.26.6 toolchain when -you run `go` from the repo, so `go version` reports 1.26.6 here. Nothing extra is +The base `go` on `PATH` is 1.22.2. Go's `GOTOOLCHAIN=auto` reads the `go 1.27.0` +directive in `go.mod` and transparently fetches/execs the go1.27.0 toolchain when +you run `go` from the repo, so `go version` reports 1.27.0 here. Nothing extra is needed for `go build`/`go test`. ### Lint (critical gotcha) Lint is golangci-lint v2 driven by `.golangci.yml`. Do **not** use the prebuilt release binary or `curl | sh` installer: those binaries are built with an older -Go and refuse to run against this go1.26.6 module with +Go and refuse to run against this go1.27.0 module with `the Go language version (goX.Y) used to build golangci-lint is lower than the -targeted Go version (1.26.6)`. You must build golangci-lint from source with the +targeted Go version (1.27.0)`. You must build golangci-lint from source with the repo's toolchain (it is not part of the startup update script): ```bash -GOTOOLCHAIN=go1.26.6 GOFLAGS=-mod=mod go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.0 +GOTOOLCHAIN=go1.27.0 GOFLAGS=-mod=mod go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1 golangci-lint run ./... ``` -`GOTOOLCHAIN=go1.26.6` is required — without it, `go install` honors +golangci-lint must be **v2.13.1 or newer**: go1.27 support landed in v2.13.0 +([golangci-lint#6643](https://github.com/golangci/golangci-lint/issues/6643)), +and older releases reject this module outright. The version is kept aligned with +`GOLANGCI_LINT_VERSION` in the shared `go-quality` reusable that +`.github/workflows/ci.yml` calls, so local lint matches CI. + +`GOTOOLCHAIN=go1.27.0` is required — without it, `go install` honors golangci-lint's own (older) `toolchain` directive and produces a binary that fails the version check above. Keep the pin aligned with `go.mod`'s `go` line. diff --git a/go.mod b/go.mod index 5c8931a..e9632bc 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/melodic-software/ci-runner -go 1.26.6 +go 1.27.0 require ( github.com/Microsoft/go-winio v0.6.2 @@ -11,28 +11,21 @@ require ( github.com/moby/moby/api v1.55.0 github.com/moby/moby/client v0.5.1 github.com/opencontainers/image-spec v1.1.1 + go.opentelemetry.io/otel v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 + go.opentelemetry.io/otel/metric v1.45.0 + go.opentelemetry.io/otel/sdk v1.45.0 + go.opentelemetry.io/otel/sdk/metric v1.45.0 + go.opentelemetry.io/otel/trace v1.45.0 go.yaml.in/yaml/v3 v3.0.5 golang.org/x/sys v0.47.0 ) require ( github.com/cenkalti/backoff/v5 v5.0.3 // indirect - github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect - go.opentelemetry.io/proto/otlp v1.11.0 // indirect - golang.org/x/net v0.57.0 // indirect - golang.org/x/text v0.40.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect - google.golang.org/grpc v1.83.0 // indirect - google.golang.org/protobuf v1.36.11 // indirect -) - -require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect github.com/distribution/reference v0.6.0 // indirect @@ -42,15 +35,19 @@ require ( github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/golang-jwt/jwt/v4 v4.5.2 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect // Keep the Scale Set Client's OpenTelemetry family on one reviewed, patched release (GHSA-mh2q-q3fh-2475). go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect - go.opentelemetry.io/otel v1.45.0 - go.opentelemetry.io/otel/metric v1.45.0 - go.opentelemetry.io/otel/sdk v1.45.0 - go.opentelemetry.io/otel/sdk/metric v1.45.0 - go.opentelemetry.io/otel/trace v1.45.0 + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect + go.opentelemetry.io/proto/otlp v1.11.0 // indirect + golang.org/x/net v0.57.0 // indirect + golang.org/x/text v0.40.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect + google.golang.org/grpc v1.83.0 // indirect + google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/release/dependencies.json b/release/dependencies.json index 69f51c7..4a08f19 100644 --- a/release/dependencies.json +++ b/release/dependencies.json @@ -2,7 +2,7 @@ "schemaVersion": 1, "resolvedAt": "2026-08-27T08:00:00.0000000Z", "go": { - "version": "1.26.6", + "version": "1.27.0", "source": "https://go.dev/dl/?mode=json" }, "node": { diff --git a/release/dependency-drift-review.json b/release/dependency-drift-review.json index 947b4b6..af1d4ef 100644 --- a/release/dependency-drift-review.json +++ b/release/dependency-drift-review.json @@ -1,33 +1,38 @@ { "schemaVersion": 1, - "reviewedAt": "2026-08-21T07:40:00.0000000Z", + "reviewedAt": "2026-08-27T08:00:00.0000000Z", "issue": 283, - "cycle": "2026-08-21", - "held": [ - { - "dependency": "go", - "pinned": "1.26.6", - "latestObservedAtReview": "1.27.0", - "decision": "no-bump-this-cycle", - "rationale": "Go 1.27.0 is a one-day-old minor, not a security patch. The lint contract in AGENTS.md builds golangci-lint v2.6.0 with GOTOOLCHAIN matching go.mod; golangci-lint binaries built with go1.26 do not support go1.27 (golangci/golangci-lint#6643). go1.27 support landed in golangci-lint v2.13.0, which also carries a large linter delta (errcheck 1.10→1.20, exhaustruct deprecation). A Go bump is therefore a coupled go.mod + AGENTS.md + lint-pin qualification, not a mechanical pin. Freshness policy targets validation within 7 days and hard-fails at 14; holding a 1-day-old x.27.0 is inside the window. Frontier consensus (Fable + Sol) unanimously chose HOLD_GO." - } - ], + "cycle": "2026-08-27", + "held": [], "bumped": [ { - "dependency": "github-action:docker/setup-buildx-action", - "from": "4.2.0", - "to": "4.3.0", + "dependency": "go", + "from": "1.26.6", + "to": "1.27.0", "decision": "bump", - "rationale": "Mechanical publication-toolchain pin. v4.3.0 (2026-08-19) is JS dependency updates only (@docker/actions-toolkit 0.92.0→0.95.0, brace-expansion, js-yaml, postcss, undici) with no input/behavior changes. Tag v4.3.0 resolves to commit 37fe631027851001ddb9b187196cc803df7f5f0e. Frontier consensus (Fable + Sol) unanimously chose BUMP_BUILDX." + "rationale": "The 2026-08-21 hold's recorded exit condition is met: golangci-lint v2.13.0 (go1.27 support, golangci/golangci-lint#6643) shipped 2026-08-19 and v2.13.1 on 2026-08-20, and ci-workflows v0.17.2 absorbs 2.13.1 into the shared go-quality reusable, so CI and the AGENTS.md local contract can both lint a go1.27 module. The coupled qualification the hold called for was performed rather than assumed: go1.27.0 build, vet, and the full test suite (15/15 packages) pass, the CGO_ENABLED=0 GOOS=windows cross-compile of ./cmd/... succeeds, and golangci-lint v2.13.1 built with GOTOOLCHAIN=go1.27.0 reports 0 issues, matching the v2.12.2/go1.26.6 baseline — the feared errcheck 1.10->1.20 and exhaustruct-deprecation delta surfaces no findings on this codebase. Go 1.27's encoding/json v2 switch (rejects invalid UTF-8 and duplicate object names) is the one behavior change with real exposure here, since the module parses compatibility manifests, Docker API responses, and runner job JSON; the existing suite, including the internal/control transport fuzz corpus, passes unchanged. This bump also relieves freshness pressure: go1.26.7 (2026-08-19T14:43:46Z) and go1.27.0 (2026-08-19T16:45:14Z) published the same day, and the freshness check dates the row from the earliest unadopted tag, so the 14-day hard fail trips on the 2026-09-03 scheduled run whether or not 1.27.0 is adopted — adopting 1.26.7 alone would move the drift date by about two hours and leave 1.27.0 unadopted.", + "requiresFleetRollout": true, + "rolloutNote": "Go is a compatibility-pair input (release/dependencies.json go.version flows into compatibility.json). Promotion requires a new reviewed compatibility pair and the provisioning rolling-upgrade runbook, not a merge alone." }, { "dependency": "repository-pin:melodic-software/ci-workflows", - "from": "7107b34832a7b6db5d08d3b132621c599fbe5e50", - "fromVersion": "v0.14.2", - "to": "d26c750691b5498fab529d115b63f84aa7aecebe", - "toVersion": "v0.17.0", + "from": "d26c750691b5498fab529d115b63f84aa7aecebe", + "fromVersion": "v0.17.0", + "to": "0f8176e87e0be518f382664779655011bf95784a", + "toVersion": "v0.17.2", "decision": "bump", - "rationale": "The 2026-08-14 hold's recorded exit condition is met: ci-workflows published v0.17.0 targeting exactly d26c750691b5498fab529d115b63f84aa7aecebe. Every uses: reference moves together in this dedicated compatibility PR. Gate reusables (semantic-pr, do-not-merge-gate, pr-issue-linkage, link-check, zizmor) are unchanged vs v0.14.2; go-quality.yml carries the already-reviewed govulncheck update. Frontier consensus (Fable + Sol) unanimously chose BUMP_CI_WORKFLOWS." + "rationale": "Prerequisite for the Go bump above: v0.17.2 is what raises the shared go-quality reusable's GOLANGCI_LINT_VERSION from 2.12.2 to 2.13.1. The freshness check reports this row's 'latest' as the ci-workflows default-branch HEAD, which is untagged; the reviewed-pin contract targets published releases, so the target is the newest release tag v0.17.2, and the row will keep reporting drift until a later cycle catches up. Across d26c750...0f8176e only two consumed reusables change: go-quality.yml (golangci-lint 2.12.2 -> 2.13.1 with new checksums for the Linux and Windows lanes) and the check-jsonschema action (astral-sh/setup-uv v9.0.0 -> v10.0.0). Every gate reusable this repo calls — semantic-pr, do-not-merge-gate, pr-issue-linkage, link-check, zizmor, ci-status — is byte-identical to v0.17.0. All 21 uses: references move together.", + "requiresFleetRollout": false } - ] + ], + "pending": [ + { + "dependency": "github-hosted-powershell", + "pinned": "7.6.4", + "proposed": "7.6.5", + "decision": "proposed-in-separate-pr", + "rationale": "Reviewed in this cycle but carried in its own pull request so it keeps an independent revert boundary; its reviewed-decision record is appended by that PR." + } + ], + "reviewNote": "Recorded by an automated drain lane. Every row above is proposed, not promoted: each ships as its own review-only pull request carrying the do-not-merge label, per the docs/releases.md rule that controller, runner, image, toolchain, Scale Set Client, Action, and release changes are never auto-merged. Issue 283 is deliberately left open; the daily dependency-drift job reconciles it itself." }