From 286b1924ff626238e87f319a82ed908501297ae8 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint Date: Thu, 20 Aug 2026 12:08:59 -0400 Subject: [PATCH 1/2] fix: pin Go toolchain to 1.26.6 for stdlib security fixes (#18) Adds a toolchain directive so builds and releases use the 1.26.6 standard library, resolving the HIGH stdlib advisories. Co-Authored-By: Claude Opus 4.8 --- go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/go.mod b/go.mod index aff3cad..f1b01b3 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,8 @@ module github.com/codefly-dev/service-s3 go 1.26 +toolchain go1.26.6 + require ( github.com/codefly-dev/core v0.3.4 google.golang.org/grpc v1.83.0 From 859541dc342b4c54eb8b3f8e3c11929f8f3f329b Mon Sep 17 00:00:00 2001 From: Antoine Toussaint Date: Thu, 20 Aug 2026 12:47:57 -0400 Subject: [PATCH 2/2] ci: disable setup-go cache to avoid toolchain tar collision (#18) The `toolchain go1.26.6` directive added for the stdlib security fix makes go.mod pin a toolchain newer than the `go` line. setup-go then installs the older Go and GOTOOLCHAIN downloads the 1.26.6 toolchain into the module cache; setup-go's cache tar collides on those read-only toolchain files (tar: .../cgo: File exists), which would fail every CI run. Skipping the cache is the same mitigation the shared release workflow already applies for this pattern. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3ee148d..9254312 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,6 +15,11 @@ jobs: - uses: actions/setup-go@v5 with: go-version-file: 'go.mod' + # go.mod pins a `toolchain` newer than the `go` line, so setup-go + # installs the older Go and GOTOOLCHAIN downloads the toolchain into + # the module cache; setup-go's cache tar then collides on those + # read-only toolchain files (tar: .../cgo: File exists). Skip caching. + cache: false - name: Build run: go build ./... - name: Vet