CI "minimum" leg builds with go1.26.11, so the go 1.26.0 floor is untested
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 62/100
Research direction
Start in .github/workflows/go.yml, where the build (minimum) leg uses actions/setup-go with go-version-file: 'go.mod', which installs the toolchain line (go1.26.11) instead of the go 1.26.0 directive in go.mod. Either pass the go directive version to setup-go as go-version (read with a sed step) or reword the comment and leg name to say it tests the toolchain line. Done when the leg's log shows the directive version, or the comment matches what it tests, and the 1.26.0 floor decision is noted next to the lipgloss ignore in .github/dependabot.yml.
Written by the indexing model from the issue text.
Description
Summary
The CI leg that claims to prove the go.mod floor installs the toolchain version instead, so nothing builds or tests with Go 1.26.0, the version that also holds back a dependency upgrade.
Where
.github/workflows/go.yml:11.github/workflows/go.yml:28go.mod:3go.mod:5.github/dependabot.yml:15
Details
go.yml:11-13 says "minimum" proves the go.mod floor (1.26.0) still builds and passes, and the leg uses actions/setup-go with go-version-file: 'go.mod' (go.yml:28-33). go.mod has go 1.26.0 (line 3) and toolchain go1.26.11 (line 5); setup-go takes the toolchain line. The log of job build (minimum) in run 43648865601 (head d0c56f0) reads Setup go version spec 1.26.11, Successfully set up Go version 1.26.11, go version go1.26.11 linux/amd64, with GOTOOLCHAIN: local. No other job installs 1.26.0 (the rest use stable, which was go1.27.4, or the same go.mod file).
Impact
No CI job has built or tested the code with Go 1.26.0 since the toolchain directive was added (#243). The floor is what keeps lipgloss on v2.0.x (dependabot.yml:15-19 ignores >= 2.1.0 because it needs go 1.26.7; docs/DEVELOPER_GUIDE.md:340-341 repeats the rule), so an available upgrade is held back for a minimum that nothing verifies. A user who builds with GOTOOLCHAIN=local on 1.26.0 to 1.26.10 is on an untested path. The "Check go directive" step only compares the text of the line.
Steps to reproduce
gh api repos/TMHSDigital/subenum/actions/jobs/132612623946/logs, then search for Setup go version spec.
Suggested fix
Make the leg install the go line's version: read it in a step (sed -n 's/^go //p' go.mod) and pass it to setup-go as go-version (setup-go already sets GOTOOLCHAIN=local, so 1.26.0 is then what compiles). Or, if 1.26.0 is not really meant to be supported, say in the comment that the leg tests the toolchain line, raise the go directive on purpose, and drop the lipgloss ignore.
Notes
Related: #243 (added the toolchain directive).
Acceptance criteria
- The leg's log shows the version of the
godirective, or the comment and leg name say it tests the toolchain line - The decision about the 1.26.0 floor is written down next to the Dependabot ignore rule
Getting started
- Relevant files:
.github/workflows/go.yml,go.mod,.github/dependabot.yml - How to run tests:
make test(orgo test ./...). Tests must stay hermetic: use-simulate,-simulate-zoneor the local DNS test server, never a live domain. - Related docs:
docs/DEVELOPER_GUIDE.md,docs/ARCHITECTURE.md
Filed by repo-audit/full-audit at d0c56f0. Severity: low. Effort: S. audit-key: ci|.github/workflows/go.yml|build.minimum.go-version-file
- Dominant language
- Go
- Stars
- 1
- Forks
- 1
- Avg merge
- 6h 42m
- Merged PRs (30d)
- 7
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from TMHSDigital/subenum
-
good first issue severity: low tech-debt
Difficulty 2/5 Half a day Newbie friendliness 75/100
TMHSDigital/subenum#329 ·
Maintainers usually reply within 1 day
-
area: docs documentation good first issue severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
TMHSDigital/subenum#327 ·
Maintainers usually reply within 1 day
-
area: release dependencies good first issue severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
TMHSDigital/subenum#324 ·
Maintainers usually reply within 1 day
-
area: output bug good first issue severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
TMHSDigital/subenum#319 ·
Maintainers usually reply within 1 day
-
community documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
TMHSDigital/subenum#135 ·
Maintainers usually reply within 1 day
All issues in TMHSDigital/subenum
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
volcano-sh/volcano#6323 ·
Maintainers usually reply within 1 day
-
needs-triage typo
Difficulty 1/5 Under an hour Newbie friendliness 88/100
llm-d-incubation/llm-d-scaling-manager#122 ·
Maintainers usually reply within 1 day
-
[Bug] Backend summarize min() / max() panics when a field has no numeric valuesPossibly taken @weng5e claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
grafana/grafana-infinity-datasource#1832 ·
Maintainers usually reply within 1 day
-
tech-debt
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
GillMacedo/godebugdiff#13 ·