Skip to content

Bump golang from 1.26.8-alpine3.24 to 1.27.1-alpine3.24 #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
juliojimenez merged 3 commits into from
Sep 28, 2026
Merged

Bump golang from 1.26.8-alpine3.24 to 1.27.1-alpine3.24 #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3779071
Bump golang from 1.26.8-alpine3.24 to 1.27.1-alpine3.24
dependabot[bot] Sep 21, 2026
f6bcc7c
Merge branch 'main' into dependabot/docker/golang-1.27.1-alpine3.24
juliojimenez Sep 28, 2026
70c9f57
Sync setup-go with Docker toolchain
Copilot Sep 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
- name: 🔧 Setup Go
uses: actions/setup-go@v7
with:
go-version: '1.26.8'
go-version: '1.27.1'
cache: true

- name: 📦 Download dependencies
Expand Down Expand Up @@ -63,7 +63,7 @@ jobs:
- name: 🔧 Setup Go
uses: actions/setup-go@v7
with:
go-version: '1.26.8'
go-version: '1.27.1'
cache: true

- name: 📦 Install CycloneDX CLI
Expand Down Expand Up @@ -132,7 +132,7 @@ jobs:
- name: 🔧 Setup Go
uses: actions/setup-go@v7
with:
go-version: '1.26.8'
go-version: '1.27.1'
cache: true

- name: 🔍 Run golangci-lint
Expand Down Expand Up @@ -178,7 +178,7 @@ jobs:
- name: 🔧 Setup Go
uses: actions/setup-go@v7
with:
go-version: '1.26.8'
go-version: '1.27.1'
cache: true

- name: 🏗️ Build for ${{ matrix.goos }}/${{ matrix.goarch }}
Expand Down Expand Up @@ -312,7 +312,7 @@ jobs:
- name: 🔧 Setup Go
uses: actions/setup-go@v7
with:
go-version: '1.26.8'
go-version: '1.27.1'
cache: true

- name: 🏗️ Build
Expand Down Expand Up @@ -349,7 +349,7 @@ jobs:
- name: 🔧 Setup Go
uses: actions/setup-go@v7
with:
go-version: '1.26.8'
go-version: '1.27.1'
cache: true

- name: ⚡ Run benchmarks
Expand All @@ -375,7 +375,7 @@ jobs:
- name: 🔧 Setup Go
uses: actions/setup-go@v7
with:
go-version: '1.26.8'
go-version: '1.27.1'
cache: true

- name: 🔍 Run Trivy vulnerability scanner
Expand Down
2 changes: 1 addition & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ docker build --platform linux/amd64 -t clickbom:test .
docker run --rm --platform linux/amd64 --entrypoint /usr/local/bin/cyclonedx clickbom:test --version
```

[go.mod](go.mod) declares `go 1.25` as the minimum language version; the toolchain actually used is **Go 1.26.8** in both CI ([.github/workflows/tests.yml](.github/workflows/tests.yml), all `setup-go` steps) and the Dockerfile builder (`golang:1.26.8-alpine3.24`). Keep those two in lockstep and on the newest 1.26.x patch: the `test_security` job runs `govulncheck ./...` against that exact toolchain and fails on any reachable stdlib CVE (with 1.26.4 it reported six), which is the intended signal that the shipped binary needs a rebuild. Dependabot bumps the Dockerfile tag; bump `setup-go` in the same PR. (`govulncheck@latest`, x/vuln ≥ 1.8, also refuses to run on anything older than 1.26.) Pre-commit hooks ([.pre-commit-config.yaml](.pre-commit-config.yaml)) run `gofmt`, `goimports -local github.com/ClickHouse/ClickBOM`, `go test -short -race`, `go mod tidy`, `gocyclo -over 26`, and `golangci-lint --fix`.
[go.mod](go.mod) declares `go 1.25` as the minimum language version; the toolchain actually used is **Go 1.27.1** in both CI ([.github/workflows/tests.yml](.github/workflows/tests.yml), all `setup-go` steps) and the Dockerfile builder (`golang:1.27.1-alpine3.24`). Keep those two in lockstep and on the newest 1.27.x patch: the `test_security` job runs `govulncheck ./...` against that exact toolchain and fails on any reachable stdlib CVE (with 1.26.4 it reported six), which is the intended signal that the shipped binary needs a rebuild. Dependabot bumps the Dockerfile tag; bump `setup-go` in the same PR. (`govulncheck@latest`, x/vuln ≥ 1.8, also refuses to run on anything older than 1.26.) Pre-commit hooks ([.pre-commit-config.yaml](.pre-commit-config.yaml)) run `gofmt`, `goimports -local github.com/ClickHouse/ClickBOM`, `go test -short -race`, `go mod tidy`, `gocyclo -over 26`, and `golangci-lint --fix`.

## Architecture

Expand Down
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# hadolint global ignore=DL3047,DL4001,DL4006

Check failure on line 1 in Dockerfile

View workflow job for this annotation

GitHub Actions / 🐋 Dockerfile Security Scan 

CKV_DOCKER_3: "Ensure that a user for the container has been created"

Check failure on line 1 in Dockerfile

View workflow job for this annotation

GitHub Actions / 🐋 Dockerfile Security Scan 

CKV_DOCKER_2: "Ensure that HEALTHCHECK instructions have been added to container images"
# Multi-stage build for Go application
FROM golang:1.26.8-alpine3.24 AS builder
FROM golang:1.27.1-alpine3.24 AS builder
Comment thread
juliojimenez marked this conversation as resolved.

# Ensure base packages are up-to-date to pick up security fixes before installing build deps
RUN apk update && apk upgrade --available --no-cache
Expand Down
Loading