From ce5a2ba47223e334078fbc50b8b2fd8b5a13dffb Mon Sep 17 00:00:00 2001 From: Multica Eve Date: Thu, 22 Oct 2026 13:14:26 +0800 Subject: [PATCH] ci: upgrade Go build toolchains to 1.27.3 (#9420) Co-authored-by: Yushen Co-authored-by: multica-agent --- .github/RELEASING.md | 6 +++--- .github/workflows/ci.yml | 19 ++++++++++--------- .github/workflows/desktop-smoke.yml | 4 ++-- .github/workflows/openclaw-config-smoke.yml | 2 +- .github/workflows/release.yml | 12 ++++++------ Dockerfile | 2 +- 6 files changed, 23 insertions(+), 22 deletions(-) diff --git a/.github/RELEASING.md b/.github/RELEASING.md index e46742293..fcb56239f 100644 --- a/.github/RELEASING.md +++ b/.github/RELEASING.md @@ -10,9 +10,9 @@ formulae, and container images. The verification job runs the Go tests and `govulncheck` before any publishing job starts. The vulnerability scan is fail-closed by default. -CI and release jobs require Go `~1.26.9`: at least 1.26.9, while accepting -newer 1.26 patches. This security floor is independent of the development -minimum in `server/go.mod`. A plain `1.26.x` can resolve to an older patch +CI and release jobs require Go `~1.27.3`: at least 1.27.3, while accepting +newer 1.27 patches. This security floor is independent of the development +minimum in `server/go.mod`. A plain `1.27.x` can resolve to an older patch while the `setup-go` version manifest catches up with an official Go release. When raising the security floor, update all Go workflows and the pinned Go builder image in `Dockerfile` together so shipped binaries also receive diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dde8402f6..74147b80b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -72,7 +72,7 @@ jobs: - name: Setup Go uses: actions/setup-go@v5 with: - go-version: "~1.26.9" + go-version: "~1.27.3" check-latest: true cache-dependency-path: server/go.sum @@ -349,8 +349,8 @@ jobs: uses: actions/setup-go@v5 with: # Keep the security floor even when the setup-go manifest lags; - # continue accepting newer patches within Go 1.26. - go-version: "~1.26.9" + # continue accepting newer patches within Go 1.27. + go-version: "~1.27.3" check-latest: true cache: false @@ -450,7 +450,7 @@ jobs: id: go uses: actions/setup-go@v5 with: - go-version: "~1.26.9" + go-version: "~1.27.3" check-latest: true cache: false @@ -489,8 +489,8 @@ jobs: uses: actions/setup-go@v5 with: # Keep the security floor even when the setup-go manifest lags; - # continue accepting newer patches within Go 1.26. - go-version: "~1.26.9" + # continue accepting newer patches within Go 1.27. + go-version: "~1.27.3" check-latest: true cache-dependency-path: server/go.sum @@ -528,8 +528,8 @@ jobs: uses: actions/setup-go@v5 with: # Keep the security floor even when the setup-go manifest lags; - # continue accepting newer patches within Go 1.26. - go-version: "~1.26.9" + # continue accepting newer patches within Go 1.27. + go-version: "~1.27.3" check-latest: true cache-dependency-path: server/go.sum @@ -795,7 +795,8 @@ jobs: - uses: actions/checkout@v6 - uses: actions/setup-go@v5 with: - go-version: "~1.26.9" + go-version: "~1.27.3" + check-latest: true cache-dependency-path: server/go.sum - name: Verify Cursor background lifecycle and watchdog races shell: bash diff --git a/.github/workflows/desktop-smoke.yml b/.github/workflows/desktop-smoke.yml index 4a6664788..dbb80cd25 100644 --- a/.github/workflows/desktop-smoke.yml +++ b/.github/workflows/desktop-smoke.yml @@ -31,8 +31,8 @@ jobs: uses: actions/setup-go@v5 with: # Keep the security floor even when the setup-go manifest lags; - # continue accepting newer patches within Go 1.26. - go-version: "~1.26.9" + # continue accepting newer patches within Go 1.27. + go-version: "~1.27.3" check-latest: true cache-dependency-path: server/go.sum diff --git a/.github/workflows/openclaw-config-smoke.yml b/.github/workflows/openclaw-config-smoke.yml index 56fa1a9c5..f82304973 100644 --- a/.github/workflows/openclaw-config-smoke.yml +++ b/.github/workflows/openclaw-config-smoke.yml @@ -35,7 +35,7 @@ jobs: - name: Setup Go uses: actions/setup-go@v5 with: - go-version: "~1.26.9" + go-version: "~1.27.3" check-latest: true cache-dependency-path: server/go.sum diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c46ed315f..1125056ac 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,8 +55,8 @@ jobs: uses: actions/setup-go@v5 with: # Keep the security floor even when the setup-go manifest lags; - # continue accepting newer patches within Go 1.26. - go-version: "~1.26.9" + # continue accepting newer patches within Go 1.27. + go-version: "~1.27.3" check-latest: true cache-dependency-path: server/go.sum @@ -99,8 +99,8 @@ jobs: uses: actions/setup-go@v5 with: # Keep the security floor even when the setup-go manifest lags; - # continue accepting newer patches within Go 1.26. - go-version: "~1.26.9" + # continue accepting newer patches within Go 1.27. + go-version: "~1.27.3" check-latest: true cache-dependency-path: server/go.sum @@ -425,8 +425,8 @@ jobs: uses: actions/setup-go@v5 with: # Keep the security floor even when the setup-go manifest lags; - # continue accepting newer patches within Go 1.26. - go-version: "~1.26.9" + # continue accepting newer patches within Go 1.27. + go-version: "~1.27.3" check-latest: true cache-dependency-path: server/go.sum diff --git a/Dockerfile b/Dockerfile index 6710b85c0..fc94387de 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # --- Build stage --- -FROM golang:1.26.9-alpine AS builder +FROM golang:1.27.3-alpine AS builder RUN apk add --no-cache git