DoDiODev opened a new pull request, #9056:
URL: https://github.com/apache/devlake/pull/9056
### Summary
Upgrade the job-local Go bootstrap from 1.26.2 to 1.26.6 in the Apache CI
workflows. Go 1.26.6 contains the fixes for the standard-library advisories
reported against earlier 1.26 patch releases.
The change intentionally keeps `backend/go.mod` and all `golang:1.26-*` image
tags on the floating 1.26 minor line. It only changes:
- `backend/scripts/install-go.sh`: version and official Linux amd64/arm64
SHA-256 checksums;
- the four visible bootstrap step names in the lint, unit-test, MySQL E2E and
PostgreSQL E2E jobs.
### Security verification
`govulncheck` v1.7.0 was run with Go 1.26.6 against the complete backend
package
graph after mock generation. It reports **zero reachable standard-library
findings**. Remaining findings belong to Go modules and are handled
separately;
this PR does not mix module upgrades into the toolchain patch.
Both Linux archive checksums were verified against the official Go download
catalog and the downloaded archives. In the unchanged
`mericodev/lake-builder:latest` image, the installer was tested from the
image's
Go 1.20.4 baseline:
1. install Go 1.26.6 into `/opt/go/1.26.6`;
2. verify `go version go1.26.6 linux/amd64`;
3. run the installer again and verify the no-op path.
### Verification
- `sh -n backend/scripts/install-go.sh`
- `actionlint` on all three changed workflows
- installer checksum/install/idempotency test in
`mericodev/lake-builder:latest`
- `make mock` — 64 generated mock files
- `make unit-test` — green, including Azure DevOps 8 passed/1 skipped and
pydevlake 10 passed
- `make e2e-test-go-plugins` and `make e2e-test` against isolated MySQL 8 —
green
- `make e2e-test-go-plugins` and `make e2e-test` against isolated PostgreSQL
14.2 — green
- `govulncheck ./...` with Go 1.26.6 — 0 reachable standard-library findings
### Builder image
The published builder image still contains Go 1.20.4. The job-local,
checksum-verified bootstrap keeps the affected jobs independent of a builder
republish; refreshing the image remains a separate maintainer follow-up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
