melodic-software · kyle-sexton · Aug 27, 2026 · Aug 27, 2026 · Aug 27, 2026 · Aug 27, 2026
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.6
+          go-version: 1.27.0
           cache: false
 
       - name: Set up Node.js
@@ -171,7 +171,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.6
+          go-version: 1.27.0
           cache: false
 
       - name: Set up Node.js

diff --git a/AGENTS.md b/AGENTS.md
@@ -2,7 +2,7 @@
 
 ## Cursor Cloud specific instructions
 
-`ci-runner` is a single Go module (`github.com/melodic-software/ci-runner`, `go 1.26.6`)
+`ci-runner` is a single Go module (`github.com/melodic-software/ci-runner`, `go 1.27.0`)
 that ships two commands: the operator CLI `./cmd/ci-runner` and the windowless
 `./cmd/ci-runner-controller`. The product's real runtime target is Windows
 (DPAPI, Docker Desktop, WSL, Task Scheduler), but every Windows-only source file
@@ -13,26 +13,32 @@ lanes live in `.github/workflows/ci.yml`; the CLI surface is documented in
 
 ### Go toolchain (non-obvious)
 
-The base `go` on `PATH` is 1.22.2. Go's `GOTOOLCHAIN=auto` reads the `go 1.26.6`
-directive in `go.mod` and transparently fetches/execs the go1.26.6 toolchain when
-you run `go` from the repo, so `go version` reports 1.26.6 here. Nothing extra is
+The base `go` on `PATH` is 1.22.2. Go's `GOTOOLCHAIN=auto` reads the `go 1.27.0`
+directive in `go.mod` and transparently fetches/execs the go1.27.0 toolchain when
+you run `go` from the repo, so `go version` reports 1.27.0 here. Nothing extra is
 needed for `go build`/`go test`.
 
 ### Lint (critical gotcha)
 
 Lint is golangci-lint v2 driven by `.golangci.yml`. Do **not** use the prebuilt
 release binary or `curl | sh` installer: those binaries are built with an older
-Go and refuse to run against this go1.26.6 module with
+Go and refuse to run against this go1.27.0 module with
 `the Go language version (goX.Y) used to build golangci-lint is lower than the
-targeted Go version (1.26.6)`. You must build golangci-lint from source with the
+targeted Go version (1.27.0)`. You must build golangci-lint from source with the
 repo's toolchain (it is not part of the startup update script):
 
 ```bash
-GOTOOLCHAIN=go1.26.6 GOFLAGS=-mod=mod go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.0
+GOTOOLCHAIN=go1.27.0 GOFLAGS=-mod=mod go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1
 golangci-lint run ./...
 ```
 
-`GOTOOLCHAIN=go1.26.6` is required — without it, `go install` honors
+golangci-lint must be **v2.13.1 or newer**: go1.27 support landed in v2.13.0
+([golangci-lint#6643](https://github.com/golangci/golangci-lint/issues/6643)),
+and older releases reject this module outright. The version is kept aligned with
+`GOLANGCI_LINT_VERSION` in the shared `go-quality` reusable that
+`.github/workflows/ci.yml` calls, so local lint matches CI.
+
+`GOTOOLCHAIN=go1.27.0` is required — without it, `go install` honors
 golangci-lint's own (older) `toolchain` directive and produces a binary that
 fails the version check above. Keep the pin aligned with `go.mod`'s `go` line.
 

diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/melodic-software/ci-runner
 
-go 1.26.6
+go 1.27.0
 
 require (
 	github.com/Microsoft/go-winio v0.6.2
@@ -11,28 +11,21 @@ require (
 	github.com/moby/moby/api v1.55.0
 	github.com/moby/moby/client v0.5.1
 	github.com/opencontainers/image-spec v1.1.1
+	go.opentelemetry.io/otel v1.45.0
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.45.0
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.45.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0
+	go.opentelemetry.io/otel/metric v1.45.0
+	go.opentelemetry.io/otel/sdk v1.45.0
+	go.opentelemetry.io/otel/sdk/metric v1.45.0
+	go.opentelemetry.io/otel/trace v1.45.0
 	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/sys v0.47.0
 )
 
 require (
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
-	google.golang.org/grpc v1.83.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
-)
-
-require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
@@ -42,15 +35,19 @@ require (
 	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	// Keep the Scale Set Client's OpenTelemetry family on one reviewed, patched release (GHSA-mh2q-q3fh-2475).
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
-	go.opentelemetry.io/otel v1.45.0
-	go.opentelemetry.io/otel/metric v1.45.0
-	go.opentelemetry.io/otel/sdk v1.45.0
-	go.opentelemetry.io/otel/sdk/metric v1.45.0
-	go.opentelemetry.io/otel/trace v1.45.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
+	google.golang.org/grpc v1.83.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 )
diff --git a/release/dependencies.json b/release/dependencies.json
@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "resolvedAt": "2026-08-27T08:00:00.0000000Z",
   "go": {
-    "version": "1.26.6",
+    "version": "1.27.0",
     "source": "https://go.dev/dl/?mode=json"
   },
   "node": {

diff --git a/release/dependency-drift-review.json b/release/dependency-drift-review.json
@@ -1,33 +1,38 @@
 {
   "schemaVersion": 1,
-  "reviewedAt": "2026-08-21T07:40:00.0000000Z",
+  "reviewedAt": "2026-08-27T08:00:00.0000000Z",
   "issue": 283,
-  "cycle": "2026-08-21",
-  "held": [
-    {
-      "dependency": "go",
-      "pinned": "1.26.6",
-      "latestObservedAtReview": "1.27.0",
-      "decision": "no-bump-this-cycle",
-      "rationale": "Go 1.27.0 is a one-day-old minor, not a security patch. The lint contract in AGENTS.md builds golangci-lint v2.6.0 with GOTOOLCHAIN matching go.mod; golangci-lint binaries built with go1.26 do not support go1.27 (golangci/golangci-lint#6643). go1.27 support landed in golangci-lint v2.13.0, which also carries a large linter delta (errcheck 1.10→1.20, exhaustruct deprecation). A Go bump is therefore a coupled go.mod + AGENTS.md + lint-pin qualification, not a mechanical pin. Freshness policy targets validation within 7 days and hard-fails at 14; holding a 1-day-old x.27.0 is inside the window. Frontier consensus (Fable + Sol) unanimously chose HOLD_GO."
-    }
-  ],
+  "cycle": "2026-08-27",
+  "held": [],
   "bumped": [
     {
-      "dependency": "github-action:docker/setup-buildx-action",
-      "from": "4.2.0",
-      "to": "4.3.0",
+      "dependency": "go",
+      "from": "1.26.6",
+      "to": "1.27.0",
       "decision": "bump",
-      "rationale": "Mechanical publication-toolchain pin. v4.3.0 (2026-08-19) is JS dependency updates only (@docker/actions-toolkit 0.92.0→0.95.0, brace-expansion, js-yaml, postcss, undici) with no input/behavior changes. Tag v4.3.0 resolves to commit 37fe631027851001ddb9b187196cc803df7f5f0e. Frontier consensus (Fable + Sol) unanimously chose BUMP_BUILDX."
+      "rationale": "The 2026-08-21 hold's recorded exit condition is met: golangci-lint v2.13.0 (go1.27 support, golangci/golangci-lint#6643) shipped 2026-08-19 and v2.13.1 on 2026-08-20, and ci-workflows v0.17.2 absorbs 2.13.1 into the shared go-quality reusable, so CI and the AGENTS.md local contract can both lint a go1.27 module. The coupled qualification the hold called for was performed rather than assumed: go1.27.0 build, vet, and the full test suite (15/15 packages) pass, the CGO_ENABLED=0 GOOS=windows cross-compile of ./cmd/... succeeds, and golangci-lint v2.13.1 built with GOTOOLCHAIN=go1.27.0 reports 0 issues, matching the v2.12.2/go1.26.6 baseline — the feared errcheck 1.10->1.20 and exhaustruct-deprecation delta surfaces no findings on this codebase. Go 1.27's encoding/json v2 switch (rejects invalid UTF-8 and duplicate object names) is the one behavior change with real exposure here, since the module parses compatibility manifests, Docker API responses, and runner job JSON; the existing suite, including the internal/control transport fuzz corpus, passes unchanged. This bump also relieves freshness pressure: go1.26.7 (2026-08-19T14:43:46Z) and go1.27.0 (2026-08-19T16:45:14Z) published the same day, and the freshness check dates the row from the earliest unadopted tag, so the 14-day hard fail trips on the 2026-09-03 scheduled run whether or not 1.27.0 is adopted — adopting 1.26.7 alone would move the drift date by about two hours and leave 1.27.0 unadopted.",
+      "requiresFleetRollout": true,
+      "rolloutNote": "Go is a compatibility-pair input (release/dependencies.json go.version flows into compatibility.json). Promotion requires a new reviewed compatibility pair and the provisioning rolling-upgrade runbook, not a merge alone."
     },
     {
       "dependency": "repository-pin:melodic-software/ci-workflows",
-      "from": "7107b34832a7b6db5d08d3b132621c599fbe5e50",
-      "fromVersion": "v0.14.2",
-      "to": "d26c750691b5498fab529d115b63f84aa7aecebe",
-      "toVersion": "v0.17.0",
+      "from": "d26c750691b5498fab529d115b63f84aa7aecebe",
+      "fromVersion": "v0.17.0",
+      "to": "0f8176e87e0be518f382664779655011bf95784a",
+      "toVersion": "v0.17.2",
       "decision": "bump",
-      "rationale": "The 2026-08-14 hold's recorded exit condition is met: ci-workflows published v0.17.0 targeting exactly d26c750691b5498fab529d115b63f84aa7aecebe. Every uses: reference moves together in this dedicated compatibility PR. Gate reusables (semantic-pr, do-not-merge-gate, pr-issue-linkage, link-check, zizmor) are unchanged vs v0.14.2; go-quality.yml carries the already-reviewed govulncheck update. Frontier consensus (Fable + Sol) unanimously chose BUMP_CI_WORKFLOWS."
+      "rationale": "Prerequisite for the Go bump above: v0.17.2 is what raises the shared go-quality reusable's GOLANGCI_LINT_VERSION from 2.12.2 to 2.13.1. The freshness check reports this row's 'latest' as the ci-workflows default-branch HEAD, which is untagged; the reviewed-pin contract targets published releases, so the target is the newest release tag v0.17.2, and the row will keep reporting drift until a later cycle catches up. Across d26c750...0f8176e only two consumed reusables change: go-quality.yml (golangci-lint 2.12.2 -> 2.13.1 with new checksums for the Linux and Windows lanes) and the check-jsonschema action (astral-sh/setup-uv v9.0.0 -> v10.0.0). Every gate reusable this repo calls — semantic-pr, do-not-merge-gate, pr-issue-linkage, link-check, zizmor, ci-status — is byte-identical to v0.17.0. All 21 uses: references move together.",
+      "requiresFleetRollout": false
     }
-  ]
+  ],
+  "pending": [
+    {
+      "dependency": "github-hosted-powershell",
+      "pinned": "7.6.4",
+      "proposed": "7.6.5",
+      "decision": "proposed-in-separate-pr",
+      "rationale": "Reviewed in this cycle but carried in its own pull request so it keeps an independent revert boundary; its reviewed-decision record is appended by that PR."
+    }
+  ],
+  "reviewNote": "Recorded by an automated drain lane. Every row above is proposed, not promoted: each ships as its own review-only pull request carrying the do-not-merge label, per the docs/releases.md rule that controller, runner, image, toolchain, Scale Set Client, Action, and release changes are never auto-merged. Issue 283 is deliberately left open; the daily dependency-drift job reconciles it itself."
 }