chore(deps): lock Go 1.27.4 for release builds (GO-2026-6859)

.github/actions/ca-trust-guard/README.md

@@ -67,7 +67,7 @@ The stdlib-only `cmd/ca-trust-guard` is built using the runner-image Go toolchai
 with `GOTOOLCHAIN=local`, `GOPROXY=off` and `GOSUMDB=off`. **Only the bootstrap
 build** uses `GO111MODULE=off`: it has no dependencies and a Go 1.22+ language/API
 floor, so an older runner Go is not forced to satisfy the repository module's
-Go 1.27.3 directive. Vet/tests retain that module/toolchain requirement. Nothing
+Go 1.27.4 directive. Vet/tests retain that module/toolchain requirement. Nothing
 is downloaded; a missing/too-old compiler fails closed. The runner Go compiler
 is a residual bootstrap dependency in the same trust class as the runner agent.
 

.github/actions/locked-tools/tool-locks.txt

@@ -10,13 +10,13 @@ gon f4c3f2be10a2ee8d50067d2c8a8828a14c83977c darwin/* source
 syft v1.42.3 linux/amd64 0d6be741479eddd2c8644a288990c04f3df0d609bbc1599a005532a9dff63509 https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_linux_amd64.tar.gz
 syft v1.42.3 darwin/arm64 d71ee7db2be0fe2e96f679fd9d69ef04274cc86c8604707797080a21070b3f32 https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_darwin_arm64.tar.gz
 syft v1.42.3 windows/amd64 e1b9f4945aa64c2b34970bec617623d7f803d0661b48a50b966768b363322e2d https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_windows_amd64.zip
-go go1.27.3 linux/amd64 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 https://go.dev/dl/go1.27.3.linux-amd64.tar.gz
-go go1.27.3 darwin/arm64 dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2 https://go.dev/dl/go1.27.3.darwin-arm64.tar.gz
-go go1.27.3 windows/amd64 f26081f438319757f8a1b46d7d0b2c5ec7583d4038e485e0aa725cfde7885fff https://go.dev/dl/go1.27.3.windows-amd64.zip
+go go1.27.4 linux/amd64 7226736c2339719cda28fbf3a54d71aa63bcefe376e98cef00034268dab24840 https://go.dev/dl/go1.27.4.linux-amd64.tar.gz
+go go1.27.4 darwin/arm64 91a44a2b8a716600ad94a4f143e156116620db8828086a6e3602291be9bd0bb4 https://go.dev/dl/go1.27.4.darwin-arm64.tar.gz
+go go1.27.4 windows/amd64 178ab98950ac69ab25069307dc6ade79f3816e414cce95b4da166a115cde1e7e https://go.dev/dl/go1.27.4.windows-amd64.zip
 # Node checksums: https://nodejs.org/dist/v26.12.1/SHASUMS256.txt
 node v26.12.1 linux/amd64 0fd1eb7770598f52a21995edf6ed35fc690400fa437c2386af329519e9143132 https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-x64.tar.gz
 node v26.12.1 darwin/arm64 1901d539912c02afa10d1cc126943a8855a7eedebe830119463470db5e6c59e8 https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-arm64.tar.gz
 # Minisign macOS ZIP uses the upstream release URL and SHA256 below.
 minisign 0.12 darwin/arm64 89000b19535765f9cffc65a65d64a820f433ef6db8020667f7570e06bf6aac63 https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-macos.zip
 node v26.12.1 windows/amd64 b3efd5c70cba3308ed46e7e699a9b8aac075bbc6b027fcb39c84c31acc25e2b4 https://nodejs.org/dist/v26.12.1/node-v26.12.1-win-x64.zip
-go go1.27.3 linux/arm64 a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49 https://go.dev/dl/go1.27.3.linux-arm64.tar.gz
+go go1.27.4 linux/arm64 3392582988a273a87ab5043ee1b2c9c17a2c3c00580bf9326c47a2e0aaaeac92 https://go.dev/dl/go1.27.4.linux-arm64.tar.gz

docs/release-workflow.md

@@ -356,10 +356,10 @@ wrappers under `scripts/` are not supported.
 | syft v1.42.3 | linux/amd64 | `0d6be741479eddd2c8644a288990c04f3df0d609bbc1599a005532a9dff63509` | [Linux archive](https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_linux_amd64.tar.gz) |
 | syft v1.42.3 | darwin/arm64 | `d71ee7db2be0fe2e96f679fd9d69ef04274cc86c8604707797080a21070b3f32` | [Darwin archive](https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_darwin_arm64.tar.gz) |
 | syft v1.42.3 | windows/amd64 | `e1b9f4945aa64c2b34970bec617623d7f803d0661b48a50b966768b363322e2d` | [Windows archive](https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_windows_amd64.zip) |
-| go go1.27.3 | linux/amd64 | `65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40` | [Linux toolchain](https://go.dev/dl/go1.27.3.linux-amd64.tar.gz) |
-| go go1.27.3 | linux/arm64 | `a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49` | [Linux arm64 toolchain](https://go.dev/dl/go1.27.3.linux-arm64.tar.gz) |
-| go go1.27.3 | darwin/arm64 | `dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2` | [Darwin toolchain](https://go.dev/dl/go1.27.3.darwin-arm64.tar.gz) |
-| go go1.27.3 | windows/amd64 | `f26081f438319757f8a1b46d7d0b2c5ec7583d4038e485e0aa725cfde7885fff` | [Windows toolchain](https://go.dev/dl/go1.27.3.windows-amd64.zip) |
+| go go1.27.4 | linux/amd64 | `7226736c2339719cda28fbf3a54d71aa63bcefe376e98cef00034268dab24840` | [Linux toolchain](https://go.dev/dl/go1.27.4.linux-amd64.tar.gz) |
+| go go1.27.4 | linux/arm64 | `3392582988a273a87ab5043ee1b2c9c17a2c3c00580bf9326c47a2e0aaaeac92` | [Linux arm64 toolchain](https://go.dev/dl/go1.27.4.linux-arm64.tar.gz) |
+| go go1.27.4 | darwin/arm64 | `91a44a2b8a716600ad94a4f143e156116620db8828086a6e3602291be9bd0bb4` | [Darwin toolchain](https://go.dev/dl/go1.27.4.darwin-arm64.tar.gz) |
+| go go1.27.4 | windows/amd64 | `178ab98950ac69ab25069307dc6ade79f3816e414cce95b4da166a115cde1e7e` | [Windows toolchain](https://go.dev/dl/go1.27.4.windows-amd64.zip) |
 | node v26.12.1 | linux/amd64 | `0fd1eb7770598f52a21995edf6ed35fc690400fa437c2386af329519e9143132` | [Linux package](https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-x64.tar.gz) |
 | node v26.12.1 | darwin/arm64 | `1901d539912c02afa10d1cc126943a8855a7eedebe830119463470db5e6c59e8` | [Darwin package](https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-arm64.tar.gz) |
 | node v26.12.1 | windows/amd64 | `b3efd5c70cba3308ed46e7e699a9b8aac075bbc6b027fcb39c84c31acc25e2b4` | [Windows package](https://nodejs.org/dist/v26.12.1/node-v26.12.1-win-x64.zip) |

go.mod

@@ -1,5 +1,5 @@
 module github.com/ConductorOne/github-workflows
 
-go 1.27.3
+go 1.27.4
 
 require google.golang.org/protobuf v1.36.5

scripts/ca-trust-guard.sh

@@ -3,7 +3,7 @@
 # delegate observations/decisions to Go and OS mutations to their own scripts.
 # Only this bootstrap build is module-off for runner-Go compatibility (Go 1.22+
 # language/API floor, stdlib only, still local/offline). Vet/tests retain the
-# repository module and its Go 1.27.3 toolchain requirement.
+# repository module and its Go 1.27.4 toolchain requirement.
 set -euo pipefail
 root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 fixtures="$root/.github/actions/ca-trust-guard/fixtures"

scripts/test-tool-integrity.py

@@ -226,7 +226,7 @@ def test_node_stale_url_and_duplicate_locks_fail_before_network(self) -> None:
         self.run_script("install-tool.sh", "node", self.root / "dest", ok=False)
         self.assertFalse(self.calls.exists())
 
-    def go_contract(self, version: str = "go1.27.3", lock: Path | None = None) -> None:
+    def go_contract(self, version: str = "go1.27.4", lock: Path | None = None) -> None:
         lock = lock or self.lock
         self.env.update(EXPECTED_GO_VERSION=version, LOCK_PATH=str(lock.resolve()),
                         EXPECTED_LOCK_SHA256=hashlib.sha256(lock.read_bytes()).hexdigest())
@@ -235,7 +235,7 @@ def mock_go_gate(self) -> None:
         self.executable("go", r'''
 printf 'go %s\n' "$*" >> "$CALLS"
 case "$1" in
-  version) echo "go version ${TEST_GO_VERSION:-go1.27.3} linux/arm64" ;;
+  version) echo "go version ${TEST_GO_VERSION:-go1.27.4} linux/arm64" ;;
   list)
     [ "$2" = -m ] && [ "$GOTOOLCHAIN" = local ] && [ "$GOWORK" = off ]
     [ "$GOPROXY" = off ] && [ "$GOSUMDB" = off ]
@@ -254,27 +254,27 @@ def test_go_version_and_module_gates(self) -> None:
         self.go_contract()
         self.mock_go_gate()
         self.run_script("verify-locked-go.sh", "version")
-        self.env["TEST_GO_VERSION"] = "go1.27.4"
+        self.env["TEST_GO_VERSION"] = "go1.27.5"
         self.run_script("verify-locked-go.sh", "version", ok=False)
         self.env.pop("TEST_GO_VERSION")
         self.calls.unlink()
         module = self.root / "go.mod"
-        for version in ("1.13", "1.27", "1.27.3"):
+        for version in ("1.13", "1.27", "1.27.3", "1.27.4"):
             module.write_text(f"module example.com/fixture\n\ngo {version}\n")
             self.run_script("verify-locked-go.sh", "module", module)
-        module.write_bytes(b"module example.com/fixture\r\n\r\ngo 1.27.3\r\n")
+        module.write_bytes(b"module example.com/fixture\r\n\r\ngo 1.27.4\r\n")
         self.run_script("verify-locked-go.sh", "module", module)
-        self.assertEqual(self.calls.read_text().count("go list -m"), 4)
+        self.assertEqual(self.calls.read_text().count("go list -m"), 5)
         self.calls.unlink()
-        module.write_bytes(b"module example.com/fixture\r\n\r\ngo 1.27.4\r\n")
+        module.write_bytes(b"module example.com/fixture\r\n\r\ngo 1.27.5\r\n")
         result = self.run_script("verify-locked-go.sh", "module", module, ok=False)
-        self.assertIn(f"::error title=locked-tools::{module} requires Go 1.27.4, newer than locked go1.27.3", result.stderr)
-        for directive in ("go 1.27.4", "go 1.28", "go 2.0", "go 1.28rc1", "", "go 1.27\ngo 1.26"):
+        self.assertIn(f"::error title=locked-tools::{module} requires Go 1.27.5, newer than locked go1.27.4", result.stderr)
+        for directive in ("go 1.27.5", "go 1.28", "go 2.0", "go 1.28rc1", "", "go 1.27\ngo 1.26"):
             module.write_text(f"module example.com/fixture\n\n{directive}\n")
             self.run_script("verify-locked-go.sh", "module", module, ok=False)
         self.assertFalse(self.calls.exists(), "invalid directives must fail before invoking Go")
         module.write_text("module fixture\ngo 1.27.3\n")
-        self.env["TEST_GO_VERSION"] = "go1.27.4"
+        self.env["TEST_GO_VERSION"] = "go1.27.5"
         self.run_script("verify-locked-go.sh", "module", module, ok=False)
         self.assertNotIn("go list", self.calls.read_text())
         self.env.pop("TEST_GO_VERSION")
@@ -375,7 +375,7 @@ def test_gon_source_gates_and_build(self) -> None:
         self.run_script("gon-source.sh", "ref")
         self.assertEqual(self.output_file.read_text(), f"ref={commit}\n")
         self.env.update(GOFLAGS="-mod=readonly", GOPROXY="https://proxy.golang.org", GOSUMDB="sum.golang.org")
-        self.executable("go", 'echo "go $*" >> "$CALLS"\ncase "$1" in version) echo "go version go1.27.3 linux/arm64";; list) awk \'$1 == "go" { print $2 }\' go.mod;; build) [[ "$PWD" == */cmd/gon ]]; [ "$1 $2 $3" = "build -trimpath -o" ]; printf fixture > "$4";; *) exit 99;; esac\n')
+        self.executable("go", 'echo "go $*" >> "$CALLS"\ncase "$1" in version) echo "go version go1.27.4 linux/arm64";; list) awk \'$1 == "go" { print $2 }\' go.mod;; build) [[ "$PWD" == */cmd/gon ]]; [ "$1 $2 $3" = "build -trimpath -o" ]; printf fixture > "$4";; *) exit 99;; esac\n')
         module = self.repo / "go.mod"
         module.write_text("module fixture\ngo 1.13\n")
         (self.repo / "cmd/gon").mkdir(parents=True)
@@ -465,7 +465,7 @@ def test_action_go_outputs_feed_environment_gate(self) -> None:
     def test_action_prepare_owns_single_go_version_sanity(self) -> None:
         self.fixture_download("go", "linux/amd64")
         self.env.update(LOCKED_TOOLS="go", LOCKS_INPUT="", ACTION_DIR=str(self.action_dir))
-        self.lock.write_text(self.lock.read_text().replace("go go1.27.3 darwin/arm64", "go go1.27.4 darwin/arm64"))
+        self.lock.write_text(self.lock.read_text().replace("go go1.27.4 darwin/arm64", "go go1.27.5 darwin/arm64"))
         self.run_script("locked-tools.sh", "prepare", ok=False)
         self.assertFalse(self.calls.exists())
         self.assertFalse(self.path_file.exists())