From 6691e9eaf3c2579b6cb0ee487870b51f5fbe54a4 Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Sat, 3 Oct 2026 11:57:55 -0400
Subject: [PATCH] fix: align migration image Go toolchain

---
 cmd/workflow-migrate/Dockerfile |  2 +-
 release_toolchain_test.go       | 40 +++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 release_toolchain_test.go

diff --git a/cmd/workflow-migrate/Dockerfile b/cmd/workflow-migrate/Dockerfile
index ee3b0a4..076795b 100644
--- a/cmd/workflow-migrate/Dockerfile
+++ b/cmd/workflow-migrate/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 # Build stage — Go version pinned to match go.mod exactly; bump here if go.mod is updated
-FROM --platform=$BUILDPLATFORM golang:1.26.4-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine AS builder
 ARG TARGETARCH
 WORKDIR /src
 COPY go.mod go.sum ./
diff --git a/release_toolchain_test.go b/release_toolchain_test.go
new file mode 100644
index 0000000..859e263
--- /dev/null
+++ b/release_toolchain_test.go
@@ -0,0 +1,40 @@
+package migrations_test
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"regexp"
+	"testing"
+)
+
+func TestMigrationImageToolchainMatchesGoMod(t *testing.T) {
+	moduleJSON, err := exec.Command("go", "mod", "edit", "-json", "go.mod").Output()
+	if err != nil {
+		t.Fatalf("read go.mod metadata: %v", err)
+	}
+	var module struct {
+		Go string
+	}
+	if err := json.Unmarshal(moduleJSON, &module); err != nil {
+		t.Fatalf("parse go.mod metadata: %v", err)
+	}
+	if module.Go == "" {
+		t.Fatal("go.mod has no Go version")
+	}
+
+	const dockerfile = "cmd/workflow-migrate/Dockerfile"
+	data, err := os.ReadFile(dockerfile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	from := regexp.MustCompile(`(?m)^FROM(?:[ \t]+--[^ \t\r\n]+)*[ \t]+([^ \t\r\n]+)[ \t]+AS[ \t]+builder[ \t]*\r?$`)
+	builders := from.FindAllStringSubmatch(string(data), -1)
+	if len(builders) != 1 {
+		t.Fatalf("%s has %d builder stages; want exactly one", dockerfile, len(builders))
+	}
+	want := "golang:" + module.Go + "-alpine"
+	if got := builders[0][1]; got != want {
+		t.Fatalf("%s builder image = %q; go.mod requires %q", dockerfile, got, want)
+	}
+}