sec(build): build Dockerfile.dev's migrate from source like the production image by IAmJSD · Pull Request #1210 · LeanerCloud/cloud-commitments-platform

IAmJSD · 2026-10-20T14:02:48Z

Root cause

Dockerfile.dev still downloaded golang-migrate's prebuilt v4.17.0 release tarball. The production Dockerfile stopped doing that in cli#1833 / cli#1835 / cli#1849, and now builds migrate from this module's go.mod on the digest-pinned Go image with -tags=pgx5. Nothing checked that the dev image kept up. The "keep this digest in sync" comment covered only the base image, so the migrate step drifted unnoticed (the same drift #45's 2026-07-28 comment pointed out).

The prebuilt binary carries upstream's own toolchain and dependency pins. Read from the binary, not the tag:

	toolchain (`go version -m`)	build tags	`govulncheck -mode=binary`
before: v4.17.0 `migrate.linux-arm64.tar.gz` (checksum matched the one Dockerfile.dev pinned)	`go1.21.5`	upstream default (links lib/pq)	130 distinct OSV IDs ("affected by 130 vulnerabilities from 12 modules and the Go standard library")
after: Dockerfile.dev's RUN instruction	`go1.26.9`	`-tags=pgx5`	No vulnerabilities found (0 `finding` entries in the JSON stream)

Fix

Dockerfile.dev: removed the curl/sha256/tar download. Added the same RUN instruction the production builder stage uses, byte for byte after whitespace normalization, placed after go mod download so MIGRATE_VERSION is read from go.mod (currently v4.19.1). ARG TARGETARCH / ARG TARGETOS=linux are declared right before it, as in Dockerfile. The dev stage has no --platform=$BUILDPLATFORM, so this is a native build, and the cross-compile GOBIN wrinkle from cli#1835 doesn't apply (production also moved from go install to go build -o since then).
Drift guard. Dockerfile and Dockerfile.dev are separate files, so they can't share a build stage. There's also no version ARG to share: the version comes from go.mod for both. Instead, the new internal/database/postgres/migrations/dockerfile_migrate_test.go (TestDockerfilesBuildMigrateIdentically) parses both Dockerfiles (joins continuations, drops comments, collapses whitespace) and fails if any of these hold:
- either file pulls in a prebuilt migrate (a golang-migrate/migrate/releases URL, or the migrate/migrate image via FROM / COPY --from);
- either file doesn't have exactly one RUN instruction that builds github.com/golang-migrate/migrate/v4/cmd/migrate;
- Dockerfile.dev's migrate RUN instruction differs from Dockerfile's;
- the base image of the stage that runs it differs, or isn't digest-pinned;
- Dockerfile's instruction stops using go build, gains an @version suffix, or drops -tags=pgx5 (it reuses migrateCLIBuildTag).
migrate_security_test.go: updated the "Known limit" comment on TestLibPqDriverNotRegistered, which said no Go test notices the Dockerfile's tag changing back to postgres. The new test now notices.

No docs change was needed: docs/DEVELOPMENT.md already uses pgx5:// URLs for docker-compose exec app migrate ..., and the pgx5-only binary is what makes those correct.

Closes #203
Closes #45

Verification

All of this is local evidence on macOS arm64 (Docker Desktop 28.2.2, Go 1.26.9), run with AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null because this machine's default AWS profile is invalid. It's file-parsing and binary-inspection evidence. No cloud resources are involved.

Fail before / pass after (regression test, run against the origin/main Dockerfile.dev and then the fixed one):

go test ./internal/database/postgres/migrations/ -run TestDockerfilesBuildMigrateIdentically -count=1
# before: FAIL
#   "RUN MIGRATE_ARCH=... curl -Lo migrate.tar.gz \"https://github.com/golang-migrate/migrate/releases/download/v4.17.0/...\" ..." should not contain "golang-migrate/migrate/releases"
#   Dockerfile.dev must contain exactly one RUN instruction that builds github.com/golang-migrate/migrate/v4/cmd/migrate, found 0: []
# after:  ok

Mutation probes. Each of these was applied to the fixed files, failed the test with the message shown, and was then reverted:

mutation	failing assertion
Dockerfile.dev `-tags=pgx5` -> `-tags=postgres`	RUN instruction not equal to Dockerfile's
Dockerfile.dev drops `-s -w` from ldflags	RUN instruction not equal
Dockerfile.dev base digest changed	not the same pinned Go image
both files `-tags=postgres`	Dockerfile must build with `-tags=pgx5`
both files `cmd/migrate@v4.19.1`	`@version` suffix rejected
Dockerfile.dev gains a second `go install .../cmd/migrate`	exactly one RUN expected, found 2
Dockerfile.dev re-adds a release-tarball `curl` next to the build	prebuilt migrate rejected
Dockerfile.dev adds `COPY --from=migrate/migrate:v4.17.0 ...`	prebuilt migrate rejected

Image-level check (the issue's verification bar). I built a slim probe image made of Dockerfile.dev's FROM line, SHELL, WORKDIR /app, COPY go.mod go.sum ./, and its ARG + migrate RUN lines, extracted verbatim with awk. Then I read the binary back out of it:

docker run --rm --entrypoint go <probe> version -m /usr/local/bin/migrate
  /usr/local/bin/migrate: go1.26.9
  dep  github.com/jackc/pgx/v5  v5.9.2
  build -tags=pgx5   build GOARCH=arm64   build GOOS=linux
docker run --rm --entrypoint /usr/local/bin/migrate <probe> -version   -> v4.19.1
govulncheck@v1.1.4 -mode=binary <binary copied out of the image>          -> No vulnerabilities found.

The same build command, cross-compiled locally for linux/amd64, also reports go1.26.9 and no govulncheck findings. For the JSON runs I counted finding objects by decoding the stream, not with a grep -c.

Not done: a full docker compose build app of the dev image. The machine was short on disk (about 11-15 GB free while I worked), and the full image pulls build-base plus every module dependency. The probe skips apk add, the air install and the full go mod download. None of those feed the migrate build, which fetches its own closure through the module proxy. A reviewer with disk to spare can confirm with docker compose build app && docker compose run --rm --entrypoint go app version -m /usr/local/bin/migrate.

Repo checks:

go build ./...: ok.
go vet ./internal/database/postgres/migrations/: ok.
go test -short -race ./internal/database/postgres/migrations/ -count=1: ok.
go test ./internal/mocks/ -count=1: ok.
golangci-lint v2.10.1 run --allow-parallel-runners ./internal/database/postgres/migrations/...: 0 issues.
gocyclo -over 10 -ignore "_test\.go" internal/database/postgres/migrations/: silent.
bash scripts/gosec-hook.sh <changed .go files>: clean.
hadolint v2.15.1@sha256:32dac941... (the pre-commit pin) with .hadolint.yaml: clean on Dockerfile.dev and Dockerfile.
trivy config --severity HIGH,CRITICAL (aquasec/trivy:0.69.3) on Dockerfile.dev: 0 findings.
git-secrets: scanned the changed files in a fresh git init repo with an isolated HOME, set up by scripts/setup-git-secrets.sh. Clean. scripts/test-git-secrets-allowlist.sh: 42 PASS, 0 FAIL.

Out of scope / notes

fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45 ("bump golang-migrate in Dockerfile.test to v4.19.1"): its original premise was already moot. Dockerfile.test hasn't installed golang-migrate since 877653d38, as the maintainer noted on 2026-07-27. The 2026-07-28 comment widened it to Dockerfile.dev's v4.17.0 pin, and this PR resolves that part by building from source rather than bumping the tarball. So fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45 looks fully moot once this merges. I left it alone and this PR does not close it.
go install github.com/air-verse/air@v1.61.7 in Dockerfile.dev still resolves air's own go.mod (flagged in the 2026-09-02 audit next to this finding). It's a separate dev-only tool and isn't touched here.
The new test checks the instruction text and the base image, not the built image. Scanning the images CI builds is cli#1836's scope.

Maintainer: please mirror #203's triage labels onto this PR: impact/internal, triaged, priority/p3, severity/low, urgency/eventually, effort/s, type/security.

🤖 Generated with Claude Code

@Version

…ction image Dockerfile.dev still downloaded the prebuilt golang-migrate v4.17.0 release tarball. That binary is built on upstream's go1.21.5 with upstream's own dependency pins, and govulncheck -mode=binary reports 130 advisories in it. The production Dockerfile stopped doing this in cli#1833/#1835/#1849 and builds migrate from this module's go.mod on the pinned Go image with -tags=pgx5. Dockerfile.dev now uses the same RUN instruction as Dockerfile's builder stage, placed after `go mod download` so the version comes from go.mod (v4.19.1). The resulting binary reports go1.26.9, -tags=pgx5, and no govulncheck findings. The two images are separate Dockerfiles, so they cannot share a build stage. TestDockerfilesBuildMigrateIdentically parses both files and fails if Dockerfile.dev's migrate RUN instruction or its stage's digest-pinned base image differ from Dockerfile's, if either file pulls in a prebuilt migrate (release tarball or migrate/migrate image), or if Dockerfile stops building with go build, no @Version suffix and -tags=pgx5. Closes LeanerCloud#203 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-20T14:02:57Z

Warning

Review limit reached

Run on-demand review

_{This review includes 3 billable files and costs up to $0.75.}

Or wait 59 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: LeanerCloud/cloud-commitments-platform
Branch: main
File: .coderabbit.yaml
Commit: 1ceaafd
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: d6db44d3-bf72-4e35-ad08-d0780ca75453

Commits

Reviewing files that changed from the base of the PR and between 1ceaafd and 8ccc488.

Files selected for processing: 3

Dockerfile.dev
internal/database/postgres/migrations/dockerfile_migrate_test.go
internal/database/postgres/migrations/migrate_security_test.go

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

cristim · 2026-10-21T02:19:15Z

Independent review 2 (claude-fleet, cold): APPROVE a4b9150

Against #203: the PR fixes the root cause.

Dockerfile.dev:40-48 now uses the same RUN instruction as the production builder stage (Dockerfile:73-79), on the same pinned image, after go mod download. It builds v4.19.1 from go.mod with -tags=pgx5.
The issue suggested go install -tags=postgres ...@ver. Production has since dropped that approach because of the lib/pq advisories and the @version dependency pins, so following the current Dockerfile is the right call.
docs/DEVELOPMENT.md:39-55 already uses pgx5:// URLs, so losing postgres:// support is already documented.
Nothing else runs migrate inside the dev container. docker-compose.yml:31 is Dockerfile.dev's only consumer.

Findings (none blocking):

[non-blocking] internal/database/postgres/migrations/dockerfile_migrate_test.go:18-22 - prebuiltMigrateSources only matches migrate/migrate: and migrate/migrate@.
- An untagged COPY --from=migrate/migrate ... or FROM migrate/migrate AS m gets through (probes P3, P4).
- Fix: match migrate/migrate followed by whitespace, end of string, : or @.
[non-blocking] The same test checks only the instruction text, not where the instruction sits.
- Moving the dev build after COPY . . passes (P5). In that position go.work (use . ./tests/e2e) would be in effect, and the workspace could resolve different dependency versions than production.
- A later RUN that overwrites /usr/local/bin/migrate also passes (P7).
- The PR acknowledges this limit and points to cli#1836.
[non-blocking] The body's "govulncheck: No vulnerabilities found" is out of date.
- The vuln DB now reports GO-2026-6809 (crypto/x509, fixed in go1.26.10) against go1.26.9 binaries.
- It hits the production image and the server binary equally, and this PR did not cause it. fix(deps): bump Go to 1.26.10 for GO-2026-6809 #1236 bumps the toolchain.
- Merge-order note: this test requires Dockerfile.dev's builder image to equal Dockerfile's, so whichever of fix(deps): bump Go to 1.26.10 for GO-2026-6809 #1236 and this PR lands second must bump both files.
[non-blocking] The issue's verification bar (build the dev image, then go version -m on the binary) was not done end to end by the author or by me. Instead I built the exact RUN command natively (below).

Attacked:

Fail-before: the new test on base FAILS twice, on the "golang-migrate/migrate/releases" check and on "exactly one RUN ... found 0".
Mutation probes on a scratch copy, each restored and confirmed identical with cmp:
- Caught:
  - P1, dev -tags=postgres: RUN not equal.
  - P2, dev digest changed: base image mismatch.
  - P8, prod drops -s -w: RUN not equal.
  - P9, both files -tags=postgres: must use pgx5.
- Gaps:
  - P3 and P4, the untagged forms.
  - P5, the build moved after COPY . ..
  - P7, a later overwrite of the binary.
- Harmless gap: P6, dev drops ARG TARGETOS. GOOS defaults to linux in that native stage.
Edge cases:
- An empty TARGETARCH under the legacy builder falls back to the host architecture.
- USER 1001 can run the root-owned, mode-755 binary.
- The test has no build tag, so it runs in unit CI, and its helpers exist in the untagged migrate_security_test.go.
Merge: merge-tree with current origin/main c8bdd46 is clean. Since the base, main changed only a go.mod // indirect marker. Dockerfile, Dockerfile.dev and the migrations package are untouched there.

Verified locally, with no cloud credentials, under the heavy lock:

Head:
- go build ./..., go vet ./internal/database/postgres/migrations/ and gofmt -l: clean.
- go test -count=1 ./internal/database/postgres/migrations/: ok.
- -run 'TestDockerfilesBuildMigrateIdentically|TestLibPq' -v: all PASS.
The dev RUN command built natively with CGO_ENABLED=0 GOOS=linux GOARCH={arm64,amd64} go build -tags=pgx5 ...:
- The binary reports v4.19.1, go1.26.9, -tags=pgx5 and pgx/v5 v5.9.2, with no lib/pq.
- govulncheck -mode=binary reports only GO-2026-6809.
Merged tree: go build ./... and the package tests: ok.
No migration, frontend or terraform changes.

Reviewed by an independent agent with no author context (second reviewer). Review only: nothing was pushed, and the GitHub review state is unchanged.

cristim · 2026-10-25T14:41:14Z

VERDICT: REQUEST_CHANGES a4b9150

PR #1210 (closes #203, #45), head a4b9150, vs origin/main 6776e27.

Findings:

BLOCKING Dockerfile.dev:4-11 - merge-tree CONFLICT with fix(deps): bump Go to 1.26.10 for GO-2026-6809 #1236 (Go 1.26.10): PR keeps FROM golang:1.26.9-alpine3.24@sha256:cdfd4fe2... and the 1.26.9 refresh comment, main moved both to 1.26.10 @sha256:9ce231b2.... Correction to the other reviewer's note: the PR does not touch Dockerfile at all (production image unchanged); the 1.26.9 pin is only in Dockerfile.dev. Taking the PR side of the conflict makes TestDockerfilesBuildMigrateIdentically FAIL (expected 1.26.10 digest, actual 1.26.9), so the new guard works as designed. Fix: rebase onto main, take main's FROM line and refresh comment, keep the PR's comment text.
process: single commit, 173 changed lines (under cap).

Attacked (on main + PR files, conflict resolved to main's image):

go test TestDockerfilesBuildMigrateIdentically + TestLibPq*: ok. hadolint Dockerfile.dev / Dockerfile: clean (repo .hadolint.yaml).
docker build -f Dockerfile.dev (arm64): builds; migrate -version v4.19.1, go version -m shows go1.26.10, build -tags=pgx5, no lib/pq; module h1 hash matches go.sum (OCyb44lF...). Reproducibility: version from go.mod, integrity via go.sum + digest-pinned base, equivalent to the old sha256 tarball pin.
RUN instruction byte-identical to Dockerfile:73-79 after normalization; placed after COPY go.mod/go.sum + go mod download, so go list -m resolves.
Mutation probes: old curl Dockerfile.dev -> FAIL; dev -tags=postgres -> FAIL; digest stripped from both -> FAIL; appended FROM migrate/migrate:v4.19.1 -> FAIL. Restored -> ok.
fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45: Dockerfile.test no longer installs migrate (cristim 2026-07-27 comment), and the 2026-07-28 comment redirects it to Dockerfile.dev, so closing fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45 here is justified.
CI: all green except Snyk skipping, but run on old base b6355a8 (Oct 20, pre-1.26.10); green CI does not cover the conflict.

Brings the branch up to date with main so the PR is mergeable again. Dockerfile.dev conflicted with LeanerCloud#1236 (Go 1.26.10) and LeanerCloud#1293 (GOWORK=off): take main's golang:1.26.10 FROM line and refresh comment, keep this PR's longer sync comment, and keep both the from-source golang-migrate build and main's ENV GOWORK=off block. TestDockerfilesBuildMigrateIdentically passes against the 1.26.10 digest that Dockerfile's builder stage uses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

IAmJSD · 2026-10-26T00:19:16Z

Reply to the REQUEST_CHANGES review on a4b9150, point by point:

BLOCKING, Dockerfile.dev:4-11 conflict with fix(deps): bump Go to 1.26.10 for GO-2026-6809 #1236 (Go 1.26.10): fixed in 8ccc488. I brought the branch up to date with a git merge origin/main (a merge commit, no rebase or force-push), not the suggested rebase. Resolution: main's FROM golang:1.26.10-alpine3.24@sha256:9ce231b2... line and 1.26.10 refresh comment, plus this PR's longer "keep this digest in sync" comment. Main had also added ENV GOWORK=off (chore(dev): match the dev container user to the host uid/gid and fix Air builds #1293) next to the migrate block, so both are kept: the from-source migrate RUN, then ENV GOWORK=off. git diff origin/main...8ccc4883 is still the same three files (Dockerfile.dev, dockerfile_migrate_test.go, migrate_security_test.go).
- TestDockerfilesBuildMigrateIdentically and TestLibPq* pass against the 1.26.10 digest.
- docker build -f Dockerfile.dev (amd64, classic builder) succeeds. In the image, migrate -version prints v4.19.1, and go version -m shows go1.26.10, -tags=pgx5, and module hash h1:OCyb44lF..., which matches go.sum.
process, single commit of 173 lines: no change needed. The only new commit is the merge.
Correction to the other reviewer's note (production Dockerfile untouched): agreed. The PR still doesn't touch Dockerfile.

Checks on 8ccc488: go build ./..., go vet ./..., go vet -tags integration ./..., and go vet -tags e2e in tests/e2e all pass. golangci-lint 2.10.1 on the migrations package, with and without --build-tags integration, reports 0 issues. gocyclo has nothing to check because no non-test Go file changed. go test -race -short and go test -race -tags integration (testcontainers Postgres) on the migrations package both pass. The secrets scan prints "clean; planted key flagged", and scripts/test-git-secrets-allowlist.sh reports 183 PASS, 0 FAIL.

New head: 8ccc488

IAmJSD · 2026-10-26T01:00:25Z

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 8ccc48830d60d4211cf37c155b07481824469c36

Blocking:

none

Non-blocking:

dockerfile_migrate_test.go checks only the RUN text and the stage base image. It wouldn't notice a preceding ENV GOFLAGS=.../GOTOOLCHAIN=... or a different go.mod copy in one file that changes what the identical RUN builds. That's acceptable for a drift guard, and image scanning is cli#1836's scope, as the body says.

Attacked:

Fail-before: I restored origin/main's Dockerfile.dev in the scratch tree. go test -run TestDockerfilesBuildMigrateIdentically ./internal/database/postgres/migrations/ failed on both the release-URL assertion and "should have 1 item(s), but has 0". It passes again on the PR's file.
I built the real Dockerfile.dev up to and including the migrate RUN (everything before ENV GOWORK=off, so apk add, the air install and the full go mod download are included) with the legacy builder. That builder leaves TARGETARCH empty, which is the unset-GOARCH path, and the build works. go version -m /usr/local/bin/migrate gives go1.26.10, build -tags=pgx5, jackc/pgx/v5 v5.9.2 and no lib/pq dep. migrate -version gives v4.19.1. govulncheck isn't installed here, so I didn't re-run it.
pgx5-only fallout in the dev path: docker-compose.yml's app uses DB_AUTO_MIGRATE (the in-app Go migrator, not the CLI), and docs/DEVELOPMENT.md already uses pgx5:// URLs. Nothing in the dev path calls the CLI with a postgres:// URL, so the old v4.17.0 binary's postgres scheme isn't lost anywhere that's used.
Ran: go build ./...; go vet on the package with and without -tags integration; go test -race -short -count=1 on the package (ok); go test -race -tags integration -run 'TestDockerfiles|TestLibPq' (ok); golangci-lint v2.10.1 with and without --build-tags integration (0 issues); gocyclo -over 10 (silent); secrets-scan.sh ("clean; planted key flagged"). GitHub reports MERGEABLE/CLEAN.

Body-stale:

"Closes sec(build): Dockerfile.dev still downloads a prebuilt migrate binary, and an older one (v4.17.0) #203 / Closes fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45" at the top contradicts the fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45 note under Out of scope: "I left it alone and this PR does not close it." GitHub's closingIssuesReferences is [45, 203], so merging will close fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45. That matches IAmJSD's comment on fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45 and is fine on the merits, since fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45's remaining scope was Dockerfile.dev. The Out of scope sentence should be deleted.
The toolchain in the table and the image-level check is go1.26.9; the current pinned base gives go1.26.10.

_{Reviewer: rB25. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

IAmJSD · 2026-10-26T01:16:02Z

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 8ccc48830d60d4211cf37c155b07481824469c36

Blocking:

none

Non-blocking:

internal/database/postgres/migrations/dockerfile_migrate_test.go: the test lives in the migrations package and reads ../../../.. Dockerfiles through mainModuleRoot. That is fine. Note that it only pins the instruction text and the base image. Whether the build actually runs is still only checked by the production image build in CI, and Dockerfile.dev isn't built in CI at all. The PR says so.

Attacked:

Compared the two Dockerfiles' context around the migrate RUN. Both copy only go.mod/go.sum, run go mod download, and come before COPY . ./go.work, so go list -m and go build resolve the same way. The only difference is --platform=$BUILDPLATFORM in production. In the dev image, an empty TARGETARCH under the legacy builder falls back to a native build.
Built a slim probe image: Dockerfile.dev's FROM, SHELL, WORKDIR, COPY go.mod go.sum, ARGs and migrate RUN, taken verbatim, on the legacy builder. go version -m reports go1.26.10, -tags=pgx5, pgx/v5 v5.9.2 and no lib/pq dependency, and migrate -version prints v4.19.1. docs/DEVELOPMENT.md already uses pgx5://, so the dev workflow keeps working with the pgx5-only binary.
Fail-before: restored main's Dockerfile.dev, and TestDockerfilesBuildMigrateIdentically fails on both "should not contain golang-migrate/migrate/releases" and "should have 1 item(s)". Mutation: Dockerfile.dev with -tags=postgres fails too.
Ran go build ./..., go vet (plain and -tags integration), go test -race -short -count=1 and golangci-lint (with and without --build-tags integration) on internal/database/postgres/migrations. All were clean or passed.

Body-stale:

"Out of scope" says fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45 is left alone and "this PR does not close it", but the body has Closes #45, and IAmJSD's comment on fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45 says this PR closes it. Closing fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45 is right, since its premise is moot and its widened Dockerfile.dev part is fixed here. The "does not close it" sentence should go.
The body quotes the toolchain as go1.26.9. The base image is now golang:1.26.10, and the built binary reports go1.26.10.

_{Reviewer: rB26. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

IAmJSD · 2026-10-26T01:34:28Z

Local verification at 8ccc48830d60d4211cf37c155b07481824469c36 merged onto main (99f0b614), together with #1144, #1210, #1213, #1220 in that order (combined tree 3c7f65ac, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 2 approving independent review(s) on it. Nothing was run against any cloud.

IAmJSD · 2026-10-26T01:34:34Z

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 2 approving independent review(s) on 8ccc4883 (two required: money, auth or security path), green CI, and the combined-tree verification above. Squash-merged at exactly 8ccc48830d60d4211cf37c155b07481824469c36.

IAmJSD added impact/internal Team-internal only triaged Item has been triaged priority/p3 Polish / idea / may never ship severity/low Minor harm urgency/eventually No deadline effort/s Hours type/security Security finding labels Oct 20, 2026

cristim mentioned this pull request Oct 21, 2026

fix(deps): bump Go to 1.26.10 for GO-2026-6809 #1236

Merged

This was referenced Oct 22, 2026

fix(docker): build golang-migrate from go.mod in Dockerfile.dev #1250

Closed

fix(docker): bump golang-migrate in Dockerfile.test to v4.19.1 #45

Closed

IAmJSD mentioned this pull request Oct 26, 2026

sec(ci): delete the GCP staging VPC peering before removing it from state (#330) #1144

Merged

IAmJSD marked this pull request as ready for review October 26, 2026 01:34

IAmJSD merged commit 5758141 into LeanerCloud:main Oct 26, 2026
38 checks passed

This was referenced Oct 26, 2026

sec(ci): allowlist the roles a per-secret Secret Manager grant may carry #1213

Merged

chore(auth): remove the unused whole-row store UpdateUser #1220

Merged

Navigation Menu

Repository navigation

sec(build): build Dockerfile.dev's migrate from source like the production image - #1210

sec(build): build Dockerfile.dev's migrate from source like the production image#1210
IAmJSD merged 2 commits into
LeanerCloud:mainfrom
IAmJSD:fix/issue-203

IAmJSD commented Oct 20, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Review limit reached

Uh oh!

cristim commented Oct 21, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

IAmJSD commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root cause

Fix

Verification

Out of scope / notes

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

cristim commented Oct 21, 2026

Uh oh!

cristim commented Oct 25, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

Uh oh!

IAmJSD commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

IAmJSD commented Oct 20, 2026 •

edited

Loading

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading