From 4504ee24cb467e05a642a2f22a38e4e53a7f44fa Mon Sep 17 00:00:00 2001 From: Arne Luenser Date: Thu, 12 Nov 2026 18:11:10 +0100 Subject: [PATCH 1/2] fix: build releases with Go 1.27 The pinned xgoreleaser image ships Go 1.26.0 with GOTOOLCHAIN=local, so goreleaser's `go mod download` hook fails for modules that declare go 1.27 ("go.mod requires go >= 1.27"). ory/cli is the first to hit it. Pass GOTOOLCHAIN=go1.27.4+auto into the container so it fetches and uses Go 1.27.4, or a newer toolchain if a go.mod requires one. Bump the runner's setup-go to 1.27 to match. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01DUBUDqE7fMHh9gNQ3mFxhj --- releaser/action.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/releaser/action.yml b/releaser/action.yml index 3da81f8..90fa2a4 100644 --- a/releaser/action.yml +++ b/releaser/action.yml @@ -45,7 +45,7 @@ runs: node-version: "16" - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: - go-version: "1.25" + go-version: "1.27" - run: | git config --global user.email "60093411+ory-bot@users.noreply.github.com" git config --global user.name "ory-bot" @@ -108,6 +108,10 @@ runs: COSIGN_PWD: ${{ inputs.cosign_pwd }} DOCKER_USERNAME: ${{ inputs.docker_username }} DOCKER_PASSWORD: ${{ inputs.docker_password }} + # The xgoreleaser image ships Go 1.26.0 with GOTOOLCHAIN=local, which + # refuses modules that declare go >= 1.27. Have it fetch Go 1.27.4 + # instead, and switch higher if a go.mod asks for a newer toolchain. + GOTOOLCHAIN: go1.27.4+auto run: | cat "$notes" # clean up ory/changelog checkout @@ -123,6 +127,7 @@ runs: -e DOCKER_USERNAME \ -e DOCKER_PASSWORD \ -e GORELEASER_CURRENT_TAG \ + -e GOTOOLCHAIN \ -v /var/run/docker.sock:/var/run/docker.sock \ oryd/xgoreleaser:1.26.0-2.14.1@sha256:635fdea1104f933c13298228601ceeda725eb7ce3ed3c1757aae712f44bdd773 release --release-header "/notes.md" --clean --timeout 60m From 12eaf50f47cd5a833737a92db8c0c1466ef2b0e9 Mon Sep 17 00:00:00 2001 From: Arne Luenser Date: Fri, 13 Nov 2026 12:37:20 +0100 Subject: [PATCH 2/2] fix: release with the Go 1.27.4 xgoreleaser image Pin oryd/xgoreleaser:1.27.4-2.14.1 by its multi-arch index digest. It ships Go 1.27.4, so the GOTOOLCHAIN override that fetched a newer toolchain into the 1.26.0 image is no longer needed. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01DUBUDqE7fMHh9gNQ3mFxhj --- releaser/action.yml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/releaser/action.yml b/releaser/action.yml index 90fa2a4..85dc9f1 100644 --- a/releaser/action.yml +++ b/releaser/action.yml @@ -108,16 +108,12 @@ runs: COSIGN_PWD: ${{ inputs.cosign_pwd }} DOCKER_USERNAME: ${{ inputs.docker_username }} DOCKER_PASSWORD: ${{ inputs.docker_password }} - # The xgoreleaser image ships Go 1.26.0 with GOTOOLCHAIN=local, which - # refuses modules that declare go >= 1.27. Have it fetch Go 1.27.4 - # instead, and switch higher if a go.mod asks for a newer toolchain. - GOTOOLCHAIN: go1.27.4+auto run: | cat "$notes" # clean up ory/changelog checkout rm -rf changelog - docker pull --platform linux/amd64 oryd/xgoreleaser:1.26.0-2.14.1@sha256:635fdea1104f933c13298228601ceeda725eb7ce3ed3c1757aae712f44bdd773 + docker pull --platform linux/amd64 oryd/xgoreleaser:1.27.4-2.14.1@sha256:c70e99a0bcc3139304b40b96abc2df2094029100a41aefb4654a81355a8878ea docker run --privileged --mount type=bind,source="$(pwd)",target=/project \ --mount type=bind,source="$notes",target=/notes.md \ --platform linux/amd64 \ @@ -127,9 +123,8 @@ runs: -e DOCKER_USERNAME \ -e DOCKER_PASSWORD \ -e GORELEASER_CURRENT_TAG \ - -e GOTOOLCHAIN \ -v /var/run/docker.sock:/var/run/docker.sock \ - oryd/xgoreleaser:1.26.0-2.14.1@sha256:635fdea1104f933c13298228601ceeda725eb7ce3ed3c1757aae712f44bdd773 release --release-header "/notes.md" --clean --timeout 60m + oryd/xgoreleaser:1.27.4-2.14.1@sha256:c70e99a0bcc3139304b40b96abc2df2094029100a41aefb4654a81355a8878ea release --release-header "/notes.md" --clean --timeout 60m git add -A git stash || true