ci: upgrade Go build toolchains to 1.27.3 (#9420)

Co-authored-by: Yushen <[email protected]>
Co-authored-by: multica-agent <[email protected]>
This commit is contained in:
Multica Eve
2026-10-22 13:14:26 +08:00
committed by GitHub
co-authored by Yushen multica-agent
parent 53c0088f17
commit ce5a2ba472
6 changed files with 23 additions and 22 deletions
+3 -3
View File
@@ -10,9 +10,9 @@ formulae, and container images.
The verification job runs the Go tests and `govulncheck` before any publishing
job starts. The vulnerability scan is fail-closed by default.
CI and release jobs require Go `~1.26.9`: at least 1.26.9, while accepting
newer 1.26 patches. This security floor is independent of the development
minimum in `server/go.mod`. A plain `1.26.x` can resolve to an older patch
CI and release jobs require Go `~1.27.3`: at least 1.27.3, while accepting
newer 1.27 patches. This security floor is independent of the development
minimum in `server/go.mod`. A plain `1.27.x` can resolve to an older patch
while the `setup-go` version manifest catches up with an official Go release.
When raising the security floor, update all Go workflows and the pinned
Go builder image in `Dockerfile` together so shipped binaries also receive
+10 -9
View File
@@ -72,7 +72,7 @@ jobs:
- name: Setup Go
uses: actions/setup-go@v5
with:
go-version: "~1.26.9"
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
@@ -349,8 +349,8 @@ jobs:
uses: actions/setup-go@v5
with:
# Keep the security floor even when the setup-go manifest lags;
# continue accepting newer patches within Go 1.26.
go-version: "~1.26.9"
# continue accepting newer patches within Go 1.27.
go-version: "~1.27.3"
check-latest: true
cache: false
@@ -450,7 +450,7 @@ jobs:
id: go
uses: actions/setup-go@v5
with:
go-version: "~1.26.9"
go-version: "~1.27.3"
check-latest: true
cache: false
@@ -489,8 +489,8 @@ jobs:
uses: actions/setup-go@v5
with:
# Keep the security floor even when the setup-go manifest lags;
# continue accepting newer patches within Go 1.26.
go-version: "~1.26.9"
# continue accepting newer patches within Go 1.27.
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
@@ -528,8 +528,8 @@ jobs:
uses: actions/setup-go@v5
with:
# Keep the security floor even when the setup-go manifest lags;
# continue accepting newer patches within Go 1.26.
go-version: "~1.26.9"
# continue accepting newer patches within Go 1.27.
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
@@ -795,7 +795,8 @@ jobs:
- uses: actions/checkout@v6
- uses: actions/setup-go@v5
with:
go-version: "~1.26.9"
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
- name: Verify Cursor background lifecycle and watchdog races
shell: bash
+2 -2
View File
@@ -31,8 +31,8 @@ jobs:
uses: actions/setup-go@v5
with:
# Keep the security floor even when the setup-go manifest lags;
# continue accepting newer patches within Go 1.26.
go-version: "~1.26.9"
# continue accepting newer patches within Go 1.27.
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
+1 -1
View File
@@ -35,7 +35,7 @@ jobs:
- name: Setup Go
uses: actions/setup-go@v5
with:
go-version: "~1.26.9"
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
+6 -6
View File
@@ -55,8 +55,8 @@ jobs:
uses: actions/setup-go@v5
with:
# Keep the security floor even when the setup-go manifest lags;
# continue accepting newer patches within Go 1.26.
go-version: "~1.26.9"
# continue accepting newer patches within Go 1.27.
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
@@ -99,8 +99,8 @@ jobs:
uses: actions/setup-go@v5
with:
# Keep the security floor even when the setup-go manifest lags;
# continue accepting newer patches within Go 1.26.
go-version: "~1.26.9"
# continue accepting newer patches within Go 1.27.
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
@@ -425,8 +425,8 @@ jobs:
uses: actions/setup-go@v5
with:
# Keep the security floor even when the setup-go manifest lags;
# continue accepting newer patches within Go 1.26.
go-version: "~1.26.9"
# continue accepting newer patches within Go 1.27.
go-version: "~1.27.3"
check-latest: true
cache-dependency-path: server/go.sum
+1 -1
View File
@@ -1,5 +1,5 @@
# --- Build stage ---
FROM golang:1.26.9-alpine AS builder
FROM golang:1.27.3-alpine AS builder
RUN apk add --no-cache git