From 30c88d41ca15b01bedd7d0e57ce0071f604d642d Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Mon, 2 Nov 2026 14:21:20 -0500
Subject: [PATCH] chore: Build on the Go 1.27 toolchain

Go 1.26 stops getting security fixes when Go 1.28 ships in February 2027.
Building on 1.27 now keeps the binaries patched and the fleet on one Go line.

Key features/changes:
- Move the build images to golang:1.27
- Add a go.mod toolchain line, which actions/setup-go uses over the go line,
  so CI also builds and tests on 1.27
- Move golangci-lint to v2.15.0, which can type-check the Go 1.27 standard
  library
- Leave the go line unchanged, so the binaries keep their current GODEBUG
  runtime defaults; raising it is a separate change
---
 .devcontainer/devcontainer.json | 2 +-
 .github/workflows/lint.yml      | 2 +-
 Dockerfile                      | 2 +-
 Makefile                        | 2 +-
 go.mod                          | 2 ++
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index bc211d6..7a39018 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
   "name": "Kubebuilder DevContainer",
-  "image": "docker.io/golang:1.26",
+  "image": "docker.io/golang:1.27",
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:4": {},
     "ghcr.io/devcontainers/features/git:1": {}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b485209..2cecdb7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,4 +24,4 @@ jobs:
       - name: Run linter
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.12.2
+          version: v2.15.0
diff --git a/Dockerfile b/Dockerfile
index b0d75fc..33755cb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM docker.io/golang:1.26 AS builder
+FROM docker.io/golang:1.27 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 
diff --git a/Makefile b/Makefile
index 10e5475..e6aab11 100644
--- a/Makefile
+++ b/Makefile
@@ -181,7 +181,7 @@ DEFAULTER_GEN_VERSION ?= v0.32.3
 ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}')
 #ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31)
 ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
-GOLANGCI_LINT_VERSION ?= v2.1.6
+GOLANGCI_LINT_VERSION ?= v2.15.0
 
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
diff --git a/go.mod b/go.mod
index 7e33037..2cc8cb7 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module go.datum.net/datum
 
 go 1.26.0
 
+toolchain go1.27.3
+
 godebug default=go1.24
 
 require (