Repository navigation
CI fails when a plugin module or workflow disagrees with the root go.mod's Go toolchain - #3021
Open
Grant McCloskey (MushuEE) wants to merge 1 commit into
Open
Grant McCloskey (MushuEE) wants to merge 1 commit into
Grant McCloskey (MushuEE) wants to merge 1 commit into
Conversation
Grant McCloskey (MushuEE)
marked this pull request as draft
October 20, 2026 22:43
The toolchain directive in the root go.mod pins the Go release that builds what we ship. Plugin modules ship too, and CI sets up Go from go.mod, but nothing checked that they agree. A plugin left on an older toolchain, or a workflow that hard-codes a Go version, would pass CI and build or test with a Go other than the patched one. hack/verify/go-toolchain.sh fails when the root go.mod has no full-release toolchain directive, when a module under internal/plugins has a different or missing one, or when a workflow takes its Go version from anything but a go.mod. Dev-time tools under hack/tools and tools/ are not checked: they need no security patches and may not build on a newer Go.
Grant McCloskey (MushuEE)
force-pushed
the
build/verify-go-toolchain
branch
from
October 20, 2026 22:43
036b7e7 to
cc0987d
Compare
Grant McCloskey (MushuEE)
changed the title
Grant McCloskey (MushuEE)
marked this pull request as ready for review
October 20, 2026 22:48
Collaborator
Author
|
Drafted #3025 which stages the Renovate config. Will need repo owner to add the app though. Verified the free tier should work fine. It will expose us to some but very minimal availability risk that Mend goes down. |
Quentin Bisson (QuentinBisson)
added a commit
to giantswarm/substrate
that referenced
this pull request
Oct 23, 2026
agent-substrate#2984 added toolchain go1.27.3 to every module, so the Go pin commit of require-golang-org-x-net-v0-61 and pin-go-1-27-3 are class 2 and drop at the re-pin onto a commit containing 3c9a3cd. The one-line toolchain pull request drafted on 2026-10-20 is withdrawn; upstream's own automation is agent-substrate#3013 (agent-substrate#3021, agent-substrate#3025).
Bowei Du (bowei)
added
area/dev-infra
kind/feature
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The toolchain directive in the root
go.modpins the Go release that builds what we ship. Plugin modules ship too, and CI sets up Go fromgo.mod, but nothing checked that they agree. A plugin left on an older toolchain, or a workflow that hard-codes a Go version, would pass CI and build or test with a Go other than the patched one. This is phase 1 of the plan in #3013. Phase 2 is a Renovate config that keeps the pin current.hack/verify/go-toolchain.shruns as part ofhack/verify-all.sh. It fails when:go.modhas notoolchaindirective naming a full release, such asgo1.27.3internal/plugins/has a differenttoolchainline or none. The error includes thego mod edit -toolchain=...command that fixes it.go.modIt does not check the dev-time tools under
hack/tools/andtools/, or the benchmarking Dockerfiles. They don't ship, they need no security patches, and some tools may not build on a newer Go.Part of #3013
AI use: Yes, written with Claude Code.
main. Each rule was broken on purpose (partial and missing root pin, plugin pin different and missing, workflow literal version and non-go.modfile), and each made it fail. Changing thehack/toolsandtools/pins still passes. shellcheck 0.9.0 and the license-header check are clean.