[cristim]

Main CI is red since c8bdd460 (#1165) on the govulncheck gate, and the cause is not #1165. The Go stdlib advisory GO-2026-6809 (crypto/x509: distrust compromised intermediate certificates) was published, and it is fixed in go1.26.10. govulncheck reports a call path through crypto/x509.Certificate.Verify, so every build pinned to 1.26.9 now fails.

Change: bump every 1.26.9 pin to 1.26.10:

• go.mod and go.work;
• ci.yml GO_VERSION; the other workflows read go-version-file: go.mod;
• Dockerfile, Dockerfile.dev and Dockerfile.test, pinned to golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca (the multi-arch index digest from docker buildx imagetools inspect);
• the docs that state the floor.

tests/e2e/go.mod stays at go 1.25 (stdlib-only module).

Local, with go1.26.10 and GOTOOLCHAIN=local:

• go build ./..., go vet ./... and go test -race -short ./... pass.
• govulncheck@v1.1.4 ./...: 0 called vulnerabilities in . and none in tests/e2e.
• pre-commit passes (hadolint, actionlint, zizmor, markdownlint, trivy, go mod tidy).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Updated the project’s required Go version to 1.26.10.
  • Updated CI, development, testing, and deployment environments to use Go 1.26.10.

• Documentation

  • Updated setup, contribution, development, deployment, and workflow documentation to reflect the Go 1.26.10 requirement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 1d95806b-7dec-45dd-a001-22d2cc6a62d6

📥 Commits

Reviewing files that changed from the base of the PR and between c8bdd46 and 26a2960.

⛔ Files ignored due to path filters: 1

• go.work is excluded by !**/*.work

📒 Files selected for processing: 9

• .github/workflows/README.md
• .github/workflows/ci.yml
• CONTRIBUTING.md
• Dockerfile
• Dockerfile.dev
• Dockerfile.test
• docs/DEPLOYMENT.md
• docs/DEVELOPMENT.md
• go.mod

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The Go version changes from 1.26.9 to 1.26.10 in the module requirement, CI configuration, container image bases, and documentation.

Changes: Go version upgrade

Layer / File(s)	Summary
Version requirements and CI go.mod, .github/workflows/*, CONTRIBUTING.md, docs/DEPLOYMENT.md, docs/DEVELOPMENT.md	The module Go version, CI setting, documented prerequisites, and local workspace example now use Go 1.26.10.
Container image versions Dockerfile, Dockerfile.dev, Dockerfile.test	The Go base image versions and pinned digests now use Go 1.26.10.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 26a29

The Go version references and container images are consistent across the reviewed upgrade surfaces, with no actionable merge-blocking issue established.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the Go version update and links it to the relevant security advisory. It accurately summarizes the main change.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (9 skipped: 9 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

VERDICT: APPROVE 26a2960

Findings: none blocking, no nits.

Attacked:

• Diff (1 commit, 10 files, +14/-14) vs origin/main c8bdd46 (merge-base == origin/main): go.mod:3, go.work:1, ci.yml:9,29, Dockerfile:15,18, Dockerfile.dev:4,8, Dockerfile.test:8, CONTRIBUTING.md:51,91, docs/DEPLOYMENT.md:59, docs/DEVELOPMENT.md:6, .github/workflows/README.md:55.
• Advisory: vuln.go.dev/ID/GO-2026-6809.json -> stdlib crypto/x509, fixed 1.26.10 (and 1.27.3). go.dev/dl JSON lists go1.26.10 as a release.
• Digest: docker buildx imagetools inspect golang:1.26.10-alpine3.24 and crane digest both return sha256:9ce231b2...f7ca, mediaType OCI image index, 8 platforms incl. linux/amd64 and linux/arm64/v8; config Env GOLANG_VERSION=1.26.10. Matches all three Dockerfiles.
• Stale pins: git grep '1\.26\.[0-9]' at HEAD finds no 1.26.9 (only a historical audit doc mentioning 1.26.6). Other workflows (pre-commit, database-migration) use go-version-file: go.mod; ci.yml jobs use env.GO_VERSION. Lambda/Fargate/Azure/GCP builds go through terraform/modules/build -> root Dockerfile. No .devcontainer, .tool-versions or .go-version files exist. Makefile/scripts derive the version from go.mod. tests/e2e/go.mod stays go 1.25 (fine, stdlib-only).
• Local, go1.26.10 (GOTOOLCHAIN=local): root go build ./... OK, go vet ./... OK, govulncheck@v1.1.4: "Your code is affected by 0 vulnerabilities" (1 uncalled module vuln). tests/e2e (//go:build e2e): go vet -tags e2e OK, govulncheck plain and -tags e2e: No vulnerabilities found.
• Fail-before: origin/main with go1.26.9 + same govulncheck -> rc=3, Vulnerability build: publish the self-hosted platform as a standalone repository #1 GO-2026-6809, fixed in crypto/x509@go1.26.10. So the bump is the root fix for the red main.
• Mutation probes: n/a for a version bump; the fail-before/pass-after govulncheck run is the equivalent probe.
• Docker image build not run locally (heavy); digest/platform/GOLANG_VERSION verified instead, CI "Build Docker Image" covers it.
• CI at 26a2960 (at review time): pass for Lint Code, gosec, Snyk, E2E Tests, Lint Workflows, Terraform validate x3, parity/scope checks; PENDING: Unit Tests, Integration Tests, Security Scanning (govulncheck gate), Build Docker Image, Run pre-commit hooks, CodeRabbit. Merge must wait for these green.

[cristim]

Independent review 2 (claude-fleet, cold): APPROVE 26a2960

This fixes GO-2026-6809. No 1.26.9 pin remains, all three image digests match the registry, and govulncheck is clean on head.

Findings (none blocking):

• [non-blocking, cross-PR] Dockerfile.dev conflicts textually with sec(build): build Dockerfile.dev's migrate from source like the production image #1210.
  • git merge-tree of this head and sec(build): build Dockerfile.dev's migrate from source like the production image #1210's head reports a conflict in Dockerfile.dev only.
  • sec(build): build Dockerfile.dev's migrate from source like the production image #1210 rewrites the "Keep this digest in sync" comment directly above the FROM line, and it still pins golang:1.26.9-alpine3.24 in both Dockerfile and Dockerfile.dev.
  • If this PR lands first, sec(build): build Dockerfile.dev's migrate from source like the production image #1210 must rebase onto the 1.26.10 digest in both files. Otherwise its own TestDockerfilesBuildMigrateIdentically fails, or the 1.26.9 pin comes back.
  • This is not a defect in this PR.

Attacked:

• Completeness: I grepped the head (excluding node_modules) for 1.26.9, go1.26, golang:1.26 and 1.26.<n> across workflows, Dockerfiles, go.mod/go.work, Makefile, scripts, terraform/iac and pre-commit.
  • No 1.26.9 remains.
  • database-migration.yml and pre-commit.yml use go-version-file: go.mod, and every ci.yml setup-go uses ${{ env.GO_VERSION }}.
  • The Makefile tidy-check and scripts/gofmt-hook.sh read the version from go.mod.
  • tests/e2e/go.mod has go 1.25, a floor that go.work (1.26.10) governs.
  • There is no .tool-versions, devcontainer or toolchain line. The only other Go images are illustrative examples in a runbook.
  • diff -rq base vs head shows exactly the 10 files in the diff.
• Dockerfile.dev is bumped too. The production builder and the dev image now pin the same digest:
  • Dockerfile:18 FROM --platform=$BUILDPLATFORM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS builder
  • Dockerfile.dev:8 FROM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS development
• Digests: verified with docker buildx imagetools inspect golang:1.26.10-alpine3.24.
  • The index digest is sha256:9ce231b2...f7ca, an OCI index from docker-library/golang 1.26/alpine3.24, annotated 1.26.10-alpine3.24.
  • It includes linux/amd64 and linux/arm64/v8, and it matches all three files.
  • The variant (alpine3.24) is unchanged.
• Advisory: govulncheck v1.1.4 (the CI pin), built with go1.26.10.
  • On head, root and tests/e2e both exit 0.
  • On base, root (go1.26.9) exits 3 and reports GO-2026-6809. Base tests/e2e exits 0, since that module does not reach the symbol.
  • This base-vs-head run is the fail-before/pass-after evidence. Mutation probes are not meaningful for a pin-only diff.

Verified locally, on go1.26.10 with no cloud credentials, under the heavy lock:

• Root: go build ./..., go vet ./... and go test -short -count=1 ./... all pass.
• tests/e2e: go vet -tags e2e ./... ok, and the suite compiles under -tags e2e.

Reviewed by an independent agent with no author context (second reviewer). Review only: nothing was pushed, and the GitHub review state is unchanged.

[IAmJSD]

Local verification at 26a2960a merged onto current main (a14dc8f2; merge-tree e329950a; Linux, Go 1.26.10 fetched by GOTOOLCHAIN=auto from this PR's go.mod):

• go build ./..., go vet ./... and go vet -tags integration ./... pass.
• The full go test -race -short -count=1 ./... suite passes on main + this PR + fix(config): compare resolve checked_at at the database's microsecond precision #1252 (tree 6fe4a56e), which is the order they will land in.
• go test -race -tags integration ./internal/config/ passes on that tree against a local throwaway Postgres 16 container (the CI image digest) with all migrations applied.
• This PR changes no Go code, only the toolchain pin, so the race suite on the new toolchain is the relevant check. All of its CI checks are green, including Security Scanning (GO-2026-6809).
• Nothing was applied to any cloud.

[IAmJSD]

Merged by IAmJSD's agent, at IAmJSD's request (cristim is traveling), after the 2 independent reviews above and local verification, all at 26a2960a.