From 250c04453b51839d615015b90eeb4d17334252c6 Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Tue, 27 Oct 2026 15:22:48 -0400 Subject: [PATCH 1/2] fix(build): build with Go 1.27.3 and let go.mod be the one toolchain source (GO-2026-6809) The published image ghcr.io/codefly-dev/service-warehouse:0.0.3 records go1.27.2, and govulncheck -mode=binary reports GO-2026-6809 (crypto/x509, fixed in go1.27.3) as called. Every pin here said 1.27.2 and two of them pinned backwards: `ENV GOTOOLCHAIN=go1.27.2` in the Dockerfile and `GOTOOLCHAIN: go1.27.2` plus literal `go-version: "1.27.2"` in ci.yml. A `go` directive is a floor; an explicit GOTOOLCHAIN=goX.Y.Z is a selector that re-introduces the exposure on every later bump. - go.mod: `go 1.27.3` (no `toolchain` line; `go mod tidy` changed nothing). - Dockerfile: `golang:1.27.3-trixie` by image-index digest; the GOTOOLCHAIN pin is deleted. The official image sets GOTOOLCHAIN=local, which with the go.mod floor makes the build exactly 1.27.3 without pinning backwards. - ci.yml: the GOTOOLCHAIN env is deleted and each `go-version` literal is `go-version-file: go.mod`, the pattern release.yml already uses. - README.md, AGENTS.md, agent-ci.yml comment: describe the pins as they are. Measured on an arm64 build of this tree: `go version -m` prints `go1.27.3`; `govulncheck -mode=binary` reports no vulnerabilities. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/agent-ci.yml | 2 +- .github/workflows/ci.yml | 9 +++------ AGENTS.md | 14 ++++++++------ Dockerfile | 3 +-- README.md | 10 ++++++---- go.mod | 2 +- 6 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/agent-ci.yml b/.github/workflows/agent-ci.yml index f8f0198..d8b7151 100644 --- a/.github/workflows/agent-ci.yml +++ b/.github/workflows/agent-ci.yml @@ -20,5 +20,5 @@ jobs: uses: codefly-dev/core/.github/workflows/agent-ci.yml@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4 with: # The CLI release the gate runs with. agent.codefly.yaml selects the - # source-packager version (0.0.69); go.mod selects Go 1.27.2. + # source-packager version (0.0.69); go.mod selects Go 1.27.3. codefly-cli-version: "0.1.185" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index adcd336..f8a2b60 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,9 +5,6 @@ on: branches: [main] pull_request: -env: - GOTOOLCHAIN: go1.27.2 - jobs: build-test: runs-on: ubuntu-latest @@ -17,7 +14,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.27.2" + go-version-file: go.mod cache: true - run: go build ./... - run: go vet ./... @@ -35,7 +32,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.27.2" + go-version-file: go.mod cache: true - name: build gateway image run: docker build -t service-warehouse:e2e . @@ -55,7 +52,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: - go-version: "1.27.2" + go-version-file: go.mod cache: true - name: build gateway image run: docker build -t service-warehouse:e2e . diff --git a/AGENTS.md b/AGENTS.md index 06a76f6..3094f2e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -115,9 +115,10 @@ preferences; each is a rule an agent broke at real cost. Derived from [`.github/workflows/ci.yml`](.github/workflows/ci.yml): the `build-test` job is those three commands, so a green local run of all three is -the definition of done. CI pins the Go version as a literal in that workflow -(`go-version: "1.27.2"`) rather than reading `go.mod`, so bumping `go.mod` -alone moves your toolchain and not CI's — change both. +the definition of done. CI reads the Go version from `go.mod` +(`go-version-file: go.mod`), as the release workflow does, so bumping the `go` +directive moves your toolchain and CI's together; the gateway Dockerfile's Go +base image is the one other place to move with it. ```sh go build ./... @@ -141,11 +142,12 @@ output for `--- PASS`, never `ok` alone. `codefly agent ci` is the full agent conformance gate. Its workflow (`agent-ci.yml`) is `workflow_dispatch` only until a full run has been seen green -here. Run `GOTOOLCHAIN=go1.27.2 codefly agent ci` from the repo root with CLI +here. Run `codefly agent ci` from the repo root with CLI 0.1.185, also pinned in `agent-ci.yml`. The manifest pins source packager `codefly.dev/go:0.0.69`, whose image recipes use immutable -digests. The gateway build pins Go 1.27.2 by tag and image-index digest and fixes -`GOTOOLCHAIN`; keep `go.mod`, CI and the image toolchain in sync. A fresh service +digests. The gateway build pins the Go image by tag and image-index digest and keeps +that image's `GOTOOLCHAIN=local`, so `go.mod` is the floor and the image must +match it; move the two together, never pin a toolchain backwards. A fresh service declares `backend: mem`; Runtime.Test probes health and authenticated Capabilities even when Start was not called, and returns an explicit PASSED/FAILED run result. Before the first published lock, set `SWH_GATEWAY_IMAGE` to a local build to diff --git a/Dockerfile b/Dockerfile index 4819382..67cb217 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,8 +9,7 @@ # driver lands and then stop. Both stages name Debian 13 explicitly: the binary # links against the build stage's glibc and needs one at least as new in the # image it runs in, which "golang:1.27" moving to the next Debian would break. -FROM golang:1.27.2-trixie@sha256:e58d6f83b3416618d8bcac2b3dde1b7f7e3c4a77d25e88637f8bbae81536c48d AS build -ENV GOTOOLCHAIN=go1.27.2 +FROM golang:1.27.3-trixie@sha256:c124b9ad3452f46061b5054607d26ea51730dae5372c5e469920063ba2bc6dcc AS build WORKDIR /src COPY go.mod go.sum ./ RUN go mod download diff --git a/README.md b/README.md index c50615c..cf7a7aa 100644 --- a/README.md +++ b/README.md @@ -299,7 +299,7 @@ seed is `0.0.1`; `codefly publish` increments it, so the **first release is generated-service `codefly ci run`. Done for v0.0.2 (run 38167325616); since then `agent-ci.yml` runs on every pull request. 7. Confirm the repository's `GH_PAT` release secret is configured, and retain - source packager `codefly.dev/go:0.0.69` and the patched Go 1.27.2 toolchain. + source packager `codefly.dev/go:0.0.69` and the Go 1.27.3 toolchain `go.mod` selects. 8. From clean, synced `main` with Docker available, run `codefly publish`. Verify that the tag matches `agent.codefly.yaml`, the locked image's version labels match `0.0.2`, image tags resolve to the locked digest, and the workflow @@ -343,9 +343,11 @@ go test -race ./... # unit tests (mem backend + bufconn server) and the age The release-gate regression tests use `git` and `jq` (also present in CI). The source packager is pinned to `codefly.dev/go:0.0.69`, whose image recipes use -immutable digests. `go.mod` and CI require Go 1.27.2; the gateway Dockerfile pins -the Go 1.27.2 image index and sets `GOTOOLCHAIN=go1.27.2`. For local conformance, -run `GOTOOLCHAIN=go1.27.2 codefly agent ci` with CLI **0.1.185**, as pinned in +immutable digests. `go.mod` sets the Go floor (`go 1.27.3`); CI reads it through +`go-version-file: go.mod`, and the gateway Dockerfile pins the matching Go image +index and keeps that image's `GOTOOLCHAIN=local`, so the directive is the one +source and nothing selects an older toolchain. For local conformance, run +`codefly agent ci` with CLI **0.1.185**, as pinned in `agent-ci.yml`. Before the first image lock, also set `SWH_GATEWAY_IMAGE=service-warehouse:e2e` to a locally built image when verifying the generated service's test phase. This override is only for runtime and image diff --git a/go.mod b/go.mod index ad9552c..23f5033 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/codefly-dev/service-warehouse -go 1.27.2 +go 1.27.3 require ( github.com/codefly-dev/core v0.19.4 From 2cfbbc688be4518156a37403cb4b3406b6e8084d Mon Sep 17 00:00:00 2001 From: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Tue, 27 Oct 2026 15:55:56 -0400 Subject: [PATCH 2/2] docs: describe the active agent conformance gate --- AGENTS.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 3094f2e..3e8d740 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -141,8 +141,8 @@ SWH_GATEWAY_IMAGE=service-warehouse:e2e go test -v -tags e2e -count=1 -run TestI output for `--- PASS`, never `ok` alone. `codefly agent ci` is the full agent conformance gate. Its workflow -(`agent-ci.yml`) is `workflow_dispatch` only until a full run has been seen green -here. Run `codefly agent ci` from the repo root with CLI +(`agent-ci.yml`) runs on pull requests and can also be dispatched manually. +Run `codefly agent ci` from the repo root with CLI 0.1.185, also pinned in `agent-ci.yml`. The manifest pins source packager `codefly.dev/go:0.0.69`, whose image recipes use immutable digests. The gateway build pins the Go image by tag and image-index digest and keeps