fix(build): build with Go 1.27.3 and let go.mod be the one toolchain source (GO-2026-6809)

.github/workflows/agent-ci.yml

@@ -20,5 +20,5 @@ jobs:
     uses: codefly-dev/core/.github/workflows/agent-ci.yml@5b9dbf5d7f03dd048d7b741dc8b79ab2bc407ab3 # v0.19.4
     with:
       # The CLI release the gate runs with. agent.codefly.yaml selects the
-      # source-packager version (0.0.69); go.mod selects Go 1.27.2.
+      # source-packager version (0.0.69); go.mod selects Go 1.27.3.
       codefly-cli-version: "0.1.185"

.github/workflows/ci.yml

@@ -5,9 +5,6 @@ on:
     branches: [main]
   pull_request:
 
-env:
-  GOTOOLCHAIN: go1.27.2
-
 jobs:
   build-test:
     runs-on: ubuntu-latest
@@ -17,7 +14,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.27.2"
+          go-version-file: go.mod
           cache: true
       - run: go build ./...
       - run: go vet ./...
@@ -35,7 +32,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.27.2"
+          go-version-file: go.mod
           cache: true
       - name: build gateway image
         run: docker build -t service-warehouse:e2e .
@@ -55,7 +52,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.27.2"
+          go-version-file: go.mod
           cache: true
       - name: build gateway image
         run: docker build -t service-warehouse:e2e .

AGENTS.md

@@ -115,9 +115,10 @@ preferences; each is a rule an agent broke at real cost.
 
 Derived from [`.github/workflows/ci.yml`](.github/workflows/ci.yml): the
 `build-test` job is those three commands, so a green local run of all three is
-the definition of done. CI pins the Go version as a literal in that workflow
-(`go-version: "1.27.2"`) rather than reading `go.mod`, so bumping `go.mod`
-alone moves your toolchain and not CI's — change both.
+the definition of done. CI reads the Go version from `go.mod`
+(`go-version-file: go.mod`), as the release workflow does, so bumping the `go`
+directive moves your toolchain and CI's together; the gateway Dockerfile's Go
+base image is the one other place to move with it.
 
 ```sh
 go build ./...
@@ -140,12 +141,13 @@ SWH_GATEWAY_IMAGE=service-warehouse:e2e go test -v -tags e2e -count=1 -run TestI
 output for `--- PASS`, never `ok` alone.
 
 `codefly agent ci` is the full agent conformance gate. Its workflow
-(`agent-ci.yml`) is `workflow_dispatch` only until a full run has been seen green
-here. Run `GOTOOLCHAIN=go1.27.2 codefly agent ci` from the repo root with CLI
+(`agent-ci.yml`) runs on pull requests and can also be dispatched manually.
+Run `codefly agent ci` from the repo root with CLI
 0.1.185, also pinned in `agent-ci.yml`. The manifest
 pins source packager `codefly.dev/go:0.0.69`, whose image recipes use immutable
-digests. The gateway build pins Go 1.27.2 by tag and image-index digest and fixes
-`GOTOOLCHAIN`; keep `go.mod`, CI and the image toolchain in sync. A fresh service
+digests. The gateway build pins the Go image by tag and image-index digest and keeps
+that image's `GOTOOLCHAIN=local`, so `go.mod` is the floor and the image must
+match it; move the two together, never pin a toolchain backwards. A fresh service
 declares `backend: mem`; Runtime.Test probes health and authenticated Capabilities
 even when Start was not called, and returns an explicit PASSED/FAILED run result.
 Before the first published lock, set `SWH_GATEWAY_IMAGE` to a local build to

Dockerfile

@@ -9,8 +9,7 @@
 # driver lands and then stop. Both stages name Debian 13 explicitly: the binary
 # links against the build stage's glibc and needs one at least as new in the
 # image it runs in, which "golang:1.27" moving to the next Debian would break.
-FROM golang:1.27.2-trixie@sha256:e58d6f83b3416618d8bcac2b3dde1b7f7e3c4a77d25e88637f8bbae81536c48d AS build
-ENV GOTOOLCHAIN=go1.27.2
+FROM golang:1.27.3-trixie@sha256:c124b9ad3452f46061b5054607d26ea51730dae5372c5e469920063ba2bc6dcc AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download

README.md

@@ -299,7 +299,7 @@ seed is `0.0.1`; `codefly publish` increments it, so the **first release is
    generated-service `codefly ci run`. Done for v0.0.2 (run 38167325616); since
    then `agent-ci.yml` runs on every pull request.
 7. Confirm the repository's `GH_PAT` release secret is configured, and retain
-   source packager `codefly.dev/go:0.0.69` and the patched Go 1.27.2 toolchain.
+   source packager `codefly.dev/go:0.0.69` and the Go 1.27.3 toolchain `go.mod` selects.
 8. From clean, synced `main` with Docker available, run `codefly publish`.
    Verify that the tag matches `agent.codefly.yaml`, the locked image's version
    labels match `0.0.2`, image tags resolve to the locked digest, and the workflow
@@ -343,9 +343,11 @@ go test -race ./...      # unit tests (mem backend + bufconn server) and the age
 The release-gate regression tests use `git` and `jq` (also present in CI).
 
 The source packager is pinned to `codefly.dev/go:0.0.69`, whose image recipes use
-immutable digests. `go.mod` and CI require Go 1.27.2; the gateway Dockerfile pins
-the Go 1.27.2 image index and sets `GOTOOLCHAIN=go1.27.2`. For local conformance,
-run `GOTOOLCHAIN=go1.27.2 codefly agent ci` with CLI **0.1.185**, as pinned in
+immutable digests. `go.mod` sets the Go floor (`go 1.27.3`); CI reads it through
+`go-version-file: go.mod`, and the gateway Dockerfile pins the matching Go image
+index and keeps that image's `GOTOOLCHAIN=local`, so the directive is the one
+source and nothing selects an older toolchain. For local conformance, run
+`codefly agent ci` with CLI **0.1.185**, as pinned in
 `agent-ci.yml`. Before the first image lock, also set
 `SWH_GATEWAY_IMAGE=service-warehouse:e2e` to a locally built image when verifying
 the generated service's test phase. This override is only for runtime and image

go.mod

@@ -1,6 +1,6 @@
 module github.com/codefly-dev/service-warehouse
 
-go 1.27.2
+go 1.27.3
 
 require (
 	github.com/codefly-dev/core v0.19.4