Move the Go toolchain pins to 1.26, in CI and in every image

Two Dependabot PRs are stuck behind the same number.

#35 raises the go directive to 1.26.0 in six modules, because
golang.org/x/crypto v0.56.0 requires it -- x/crypto tracks the two most
recent Go releases and 0.56 dropped 1.25. A module that says 1.26 cannot
be built by the 1.25 this repository pins in two places, so that PR
fails every Go job.

#29 raises actions/setup-go to v7, which sets GOTOOLCHAIN=local. With
that set, `go install golang.org/x/vuln/cmd/govulncheck@latest` cannot
quietly fetch a newer toolchain, and stops with

  golang.org/x/[email protected] requires go >= 1.26.0 (running go 1.25.14)

Under setup-go v5 the same install succeeded by downloading 1.26 behind
our backs, which is its own reason to be on 1.26 deliberately instead.

So: security-scan's go-version and all eight Dockerfiles move together,
1.25 -> 1.26. Nothing else needs to. A newer toolchain builds an older
directive happily, so this stands on its own before #35 lands, and the
go.mod files stay where they are here.

Checked by building rather than by reading: the api and ingest images
both build on golang:1.26-alpine, and api, ingest and enterprise still
`go build ./...` clean against their existing 1.25 directives.

This commit is contained in:

jcoffey-dev

2026-09-10 09:54:45 -07:00

parent 907bf52541

commit c60028aad1

9 changed files with 20 additions and 19 deletions

									
										alerting/Dockerfile
									
		+1
		-1
	
												View File
												
				@@ -2,7 +2,7 @@

				# so unlike api/ingest/search this build context is just alerting/ itself,

				# same shape as cli/Dockerfile:

				#   docker build -f alerting/Dockerfile -t cairnobs-alerting alerting/

				FROM golang:1.25-alpine AS builder

				FROM golang:1.26-alpine AS builder

				WORKDIR /src

				COPY . .

				RUN CGO_ENABLED=0 GOOS=linux go build -o /out/alerting ./cmd/alerting