From fdd41dbd3da55393c0ac4b422ca924f60a0b92e4 Mon Sep 17 00:00:00 2001 From: Erik Booij Date: Tue, 11 Aug 2026 10:11:26 +0200 Subject: [PATCH 1/2] Exit 125 on flag parsing errors README documents exit code 125 for invalid usage, and validateArgs errors honor that, but a malformed flag never reaches the action: cli.Command.Run returns the parse error to main, where log.Fatal exits with status 1, breaking the documented contract. Set OnUsageError to route parse errors through the same cli.Exit(..., 125) path as other usage errors. This also reports the error once, in the ERROR: prefix style, instead of twice: previously cli printed "Incorrect Usage" plus a full help dump and logrus then repeated the message. Co-Authored-By: Claude Fable 5 --- main.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/main.go b/main.go index f9ef265..ee837c1 100644 --- a/main.go +++ b/main.go @@ -29,6 +29,11 @@ func main() { Flags: cliFlags(), Action: action, StopOnNthArg: &stopOnFirstArg, + // Flag parsing errors never reach action, so they are mapped to + // the documented usage-error exit code here. + OnUsageError: func(_ context.Context, _ *cli.Command, err error, _ bool) error { + return cli.Exit(errorPrefix(err), 125) + }, } if err := cmd.Run(context.Background(), os.Args); err != nil { log.Fatal(err) From c90d9fa349ea16ba9effe3c8eb917b80ef3f32a9 Mon Sep 17 00:00:00 2001 From: Erik Booij Date: Wed, 12 Aug 2026 10:42:56 +0200 Subject: [PATCH 2/2] Enforce Go 1.26.5 as the minimum version The intent of requiring 1.26.5 (the crypto/tls fix for GO-2026-5856) was expressed as go 1.26 plus a toolchain directive, but the toolchain directive is only a suggestion: it is honored under the default GOTOOLCHAIN=auto and silently ignored under GOTOOLCHAIN=local, where a 1.26.0 toolchain would build a binary without the fix. The go directive is the mechanism that actually enforces a floor - an older toolchain either auto-upgrades or fails loudly. Raise the go directive to 1.26.5 and drop the now-redundant toolchain line. The module is not importable as a library, so the stricter directive burdens no dependents. CI stays on go-version: '1.26', which setup-go resolves to the latest 1.26.x patch, so release builds keep picking up future security fixes without manual bumps. Co-Authored-By: Claude Fable 5 --- README.md | 2 +- go.mod | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 341194a..020c0e3 100644 --- a/README.md +++ b/README.md @@ -103,7 +103,7 @@ itself uses: ## Building from source -This project uses [Go modules](https://go.dev/blog/using-go-modules) and requires Go 1.26+. +This project uses [Go modules](https://go.dev/blog/using-go-modules) and requires Go 1.26.5+. ```bash go mod download diff --git a/go.mod b/go.mod index b5de66c..3bfd271 100644 --- a/go.mod +++ b/go.mod @@ -1,8 +1,6 @@ module env-aws-params -go 1.26 - -toolchain go1.26.5 +go 1.26.5 require ( github.com/aws/aws-sdk-go-v2 v1.41.7