sixfold-space/madtea

SHA256

Fork 0

chore: adopt Go 1.27.2 and keep the gate green #742

Merged

hexajon merged 3 commits from chore-bump-go-1-27-2 into main

2026-10-09 17:11:52 +00:00

hexajon commented

2026-10-09 17:11:50 +00:00

Owner

Summary

Go 1.27.2 is a security patch. govulncheck flagged 9 standard-library CVEs (net/http, http2, crypto/tls, net/textproto), fixed only in 1.27.2. Moving to it needs two companion changes to keep the gate honest and green, so they ride together.

Three commits:

Bump Go to 1.27.2. The toolchain-honesty gate requires go.mod's go directive and the pinned golang:1.27-trixie image digest (ci.yml, drift.yml) to match the toolchain, so all three move in one commit. The resolved image bundles go1.27.2.
Time-box staticcheck. staticcheck v0.8.1, its latest release, cannot decode go1.27.2 export data, so it analyzes nothing. gate.sh now treats that one error as a loud, tracked skip: staticcheck still runs, the result shows - staticcheck (skipped), and any real finding still fails. The skip self-clears when a supporting staticcheck ships. Tracked by #741.
Remove the dead static issue-number danglingref check. It rejected every three-or-more-digit #NNN on the assumption the tracker stayed two-digit. The tracker grew past that, so the check only flagged real, resolving issues and guarded nothing. The separate ADR-citation check stays.

Gate is green locally; staticcheck shows as the tracked skip.

## Summary Go 1.27.2 is a security patch. govulncheck flagged 9 standard-library CVEs (net/http, http2, crypto/tls, net/textproto), fixed only in 1.27.2. Moving to it needs two companion changes to keep the gate honest and green, so they ride together. Three commits: 1. Bump Go to 1.27.2. The toolchain-honesty gate requires go.mod's `go` directive and the pinned `golang:1.27-trixie` image digest (`ci.yml`, `drift.yml`) to match the toolchain, so all three move in one commit. The resolved image bundles go1.27.2. 2. Time-box staticcheck. staticcheck v0.8.1, its latest release, cannot decode go1.27.2 export data, so it analyzes nothing. `gate.sh` now treats that one error as a loud, tracked skip: staticcheck still runs, the result shows `- staticcheck (skipped)`, and any real finding still fails. The skip self-clears when a supporting staticcheck ships. Tracked by #741. 3. Remove the dead static issue-number danglingref check. It rejected every three-or-more-digit `#NNN` on the assumption the tracker stayed two-digit. The tracker grew past that, so the check only flagged real, resolving issues and guarded nothing. The separate ADR-citation check stays. Gate is green locally; staticcheck shows as the tracked skip.

hexajon added 3 commits

2026-10-09 17:11:50 +00:00

chore: bump Go to 1.27.2 13640b0213

Go 1.27.2 is a security patch: govulncheck flags 9 standard-library CVEs
(net/http, http2, crypto/tls, net/textproto) fixed only in 1.27.2.

Move the pinned places together, as the toolchain-honesty gate requires:
the go directive in go.mod, and the golang:1.27-trixie image digest in
ci.yml and drift.yml. The resolved image bundles go1.27.2.

build(gate): time-box staticcheck while it lacks Go 1.27.2 support efbc3bbce3

staticcheck v0.8.1, its latest release, cannot decode go1.27.2 export
data: every run fails with "export data version 5 is greater than maximum
supported version 4", so it analyzes nothing. Until a release supports the
current toolchain, gate.sh treats that one error as a tracked skip:
staticcheck still runs, the result line shows "- staticcheck (skipped)",
never a tick, and any real finding still fails the gate. The skip
self-clears when a supporting staticcheck ships.

chore(danglingref): remove the dead static issue-number check

drift / surface-diff (push) Successful in 4s

Details

drift / forgejo-smoke (push) Has been skipped

Details

ci / gate (pull_request) Successful in 38m37s

Details

ci / gate (push) Successful in 36m31s

Details

drift / govulncheck (pull_request) Has been skipped

Details

drift / surface-diff (pull_request) Successful in 1m25s

Details

drift / forgejo-smoke (pull_request) Has been skipped

Details

ci / mcp-conformance (pull_request) Successful in 2m23s

Details

ci / mcp-conformance (push) Successful in -14s

Details

drift / govulncheck (push) Has been skipped

Details

94c4ec628f

The static issue/PR-number dangling-reference check rejected every
three-or-more-digit "#NNN" citation on the assumption that the tracker
stayed two-digit. The tracker grew past that count, so the check only
flagged real, resolving issues and guarded nothing. Remove it and its
tests. Keep the separate ADR-citation check, which still has a purpose.

hexajon merged commit 94c4ec628f into main

2026-10-09 17:11:52 +00:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!742

No description provided.

Rows
Columns