fix: update Workflow toolchains and generated runtime boundaries

CONTRIBUTING.md

@@ -6,7 +6,7 @@ Thank you for your interest in contributing to the workflow engine. This guide c
 
 ### Prerequisites
 
-- Go 1.26.5+
+- Go 1.27.2+
 - Node.js 24+ (for UI development)
 - Git
 - `golangci-lint` (install: `go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest`)

DOCUMENTATION.md

@@ -334,7 +334,7 @@ YAML from the pipeline context, such as an HTTP route's `request_body`.
 | `config_from` | string | exactly one of `config_file`/`config_from` | Pipeline context path resolving to workflow config YAML. |
 | `output` | string | no | Output binary path; defaults to `bin/app`. |
 | `module_path` | string | no | Generated Go module path; defaults to `app`. |
-| `go_version` | string | no | Generated `go.mod` Go version; defaults to `1.22`. |
+| `go_version` | string | no | Generated `go.mod` Go version; defaults to `1.27.2`. |
 | `embed_config` | boolean | no | Embed `app.yaml` in the generated binary; defaults to `true`. |
 | `dry_run` | boolean | no | Return generated files without compiling. |
 | `os` | string | no | Target OS (`GOOS`); defaults to the current OS. |

Dockerfile.admin

@@ -9,7 +9,7 @@
 #       -t workflow-server-admin:local .
 
 # --- Stage 1: Build the Go server binary ---
-FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS go-builder
+FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine AS go-builder
 
 ARG TARGETOS TARGETARCH
 

Dockerfile.legacy

@@ -9,7 +9,7 @@
 
 # --- Stage 1: Build the Go binary ---
 # Use BUILDPLATFORM so go mod download runs natively; cross-compile via TARGETOS/TARGETARCH.
-FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS go-builder
+FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine AS go-builder
 
 ARG TARGETOS TARGETARCH
 

README.md

@@ -1,6 +1,6 @@
 # Workflow Engine
 
-[![Go](https://img.shields.io/badge/Go-1.26+-00ADD8?logo=go&logoColor=white)](https://go.dev)
+[![Go](https://img.shields.io/badge/Go-1.27.2+-00ADD8?logo=go&logoColor=white)](https://go.dev)
 [![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Built on Modular](https://img.shields.io/badge/Built%20on-GoCodeAlone%2Fmodular-green)](https://github.com/GoCodeAlone/modular)
 [![Go Reference](https://pkg.go.dev/badge/github.com/GoCodeAlone/workflow.svg)](https://pkg.go.dev/github.com/GoCodeAlone/workflow)
@@ -133,7 +133,7 @@ scaffolds, see [Repository Layout](docs/REPO_LAYOUT.md).
 
 ### Requirements
 
-- Go 1.26.5+
+- Go 1.27.2+
 - Node.js 24+ (for UI development)
 
 ### Run the Server
@@ -349,7 +349,7 @@ cd ui && npm run lint
 
 | Component | Technology |
 |-----------|-----------|
-| Language | Go 1.26 |
+| Language | Go 1.27 |
 | Framework | [GoCodeAlone/modular](https://github.com/GoCodeAlone/modular) v1.12.3 |
 | UI | React, ReactFlow, Zustand, Vite, TypeScript |
 | Hot-Reload | [Yaegi](https://github.com/traefik/yaegi) Go interpreter |

cigen/render_circleci.go

@@ -102,7 +102,7 @@ func circleJobName(prefix string, phase DeployPhase, p *CIPlan) string {
 
 func writeCirclePlanJob(b *strings.Builder, jobName string, phase DeployPhase, p *CIPlan, version string) {
 	fmt.Fprintf(b, "  %s:\n", jobName)
-	b.WriteString("    docker:\n      - image: cimg/go:1.26\n")
+	b.WriteString("    docker:\n      - image: cimg/go:1.27.2\n")
 	b.WriteString("    steps:\n")
 	b.WriteString("      - checkout\n")
 	writeCircleSetup(b, p, phase, version)
@@ -111,7 +111,7 @@ func writeCirclePlanJob(b *strings.Builder, jobName string, phase DeployPhase, p
 
 func writeCircleApplyJob(b *strings.Builder, jobName string, phase DeployPhase, p *CIPlan, version string, isLast bool) {
 	fmt.Fprintf(b, "  %s:\n", jobName)
-	b.WriteString("    docker:\n      - image: cimg/go:1.26\n")
+	b.WriteString("    docker:\n      - image: cimg/go:1.27.2\n")
 	b.WriteString("    steps:\n")
 	b.WriteString("      - checkout\n")
 	writeCircleSetup(b, p, phase, version)

cigen/render_circleci_test.go

@@ -66,6 +66,41 @@ func TestRenderCircleCI_NilPlan(t *testing.T) {
 	}
 }
 
+func TestRenderCircleCI_GoVersionImages(t *testing.T) {
+	files, err := cigen.RenderCircleCI(richCIPlan())
+	if err != nil {
+		t.Fatalf("RenderCircleCI: %v", err)
+	}
+	var parsed struct {
+		Jobs map[string]struct {
+			Docker []struct {
+				Image string `yaml:"image"`
+			} `yaml:"docker"`
+		} `yaml:"jobs"`
+	}
+	if err := yaml.Unmarshal([]byte(files[".circleci/config.yml"]), &parsed); err != nil {
+		t.Fatalf("parse CircleCI config: %v", err)
+	}
+	for _, name := range []string{"plan-prereq", "plan-deploy", "apply-prereq", "apply-deploy", "smoke"} {
+		t.Run(name, func(t *testing.T) {
+			job, ok := parsed.Jobs[name]
+			if !ok {
+				t.Fatalf("missing job %s", name)
+			}
+			if len(job.Docker) != 1 {
+				t.Fatalf("job %s has %d Docker images, want 1", name, len(job.Docker))
+			}
+			want := "cimg/go:1.27.2"
+			if name == "smoke" {
+				want = "cimg/base:current"
+			}
+			if got := job.Docker[0].Image; got != want {
+				t.Errorf("job %s image = %q, want %q", name, got, want)
+			}
+		})
+	}
+}
+
 func TestRenderCircleCI_SinglePhase(t *testing.T) {
 	p := richCIPlan()
 	p.Phases = []cigen.DeployPhase{{Name: "deploy", ConfigPath: "deploy.yaml"}}

cmd/wfctl/deploy.go

@@ -974,7 +974,7 @@ func writeDockerfile(path string) error {
 	const content = `# Auto-generated by wfctl deploy docker
 # Multi-stage build for a workflow engine application.
 
-FROM golang:1.26.5-alpine AS builder
+FROM golang:1.27.2-alpine AS builder
 RUN apk add --no-cache git ca-certificates
 WORKDIR /build
 COPY go.mod go.sum ./

cmd/wfctl/deploy_test.go

@@ -146,7 +146,7 @@ func TestWriteDockerfile(t *testing.T) {
 	if err != nil {
 		t.Fatalf("read Dockerfile: %v", err)
 	}
-	for _, want := range []string{"FROM golang", "go build", "FROM alpine", "EXPOSE 8080"} {
+	for _, want := range []string{"FROM golang:1.27.2-alpine AS builder", "go build", "FROM alpine", "EXPOSE 8080"} {
 		if !strings.Contains(data, want) {
 			t.Errorf("Dockerfile missing %q", want)
 		}

cmd/wfctl/fixture_build_artifacts_contract_test.go

@@ -51,7 +51,7 @@ func fixtureControlCommand(ctx context.Context, root, output string, extra ...st
 			cmd.Env = append(cmd.Env, item)
 		}
 	}
-	cmd.Env = append(cmd.Env, "GOWORK=off", "GOENV=off", "GOFLAGS=", "GOTOOLCHAIN=go1.27.1")
+	cmd.Env = append(cmd.Env, "GOWORK=off", "GOENV=off", "GOFLAGS=", "GOTOOLCHAIN=go1.27.2")
 	return cmd
 }
 
@@ -410,7 +410,11 @@ func TestFixtureBuildArtifactsRealOverlayMutation(t *testing.T) {
 	root := fixtureControlSource(t)
 	external := t.TempDir()
 	asset, overlay := filepath.Join(external, "asset.txt"), filepath.Join(external, "overlay.json")
-	fixtureControlWrite(t, overlay, fmt.Sprintf(`{"Replace":{%q:%q}}`, filepath.Join(root, "asset.txt"), asset))
+	sourceAsset, err := filepath.EvalSymlinks(filepath.Join(root, "asset.txt"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixtureControlWrite(t, overlay, fmt.Sprintf(`{"Replace":{%q:%q}}`, sourceAsset, asset))
 	for _, want := range []string{"first-overlay", "second-overlay"} {
 		fixtureControlWrite(t, asset, want)
 		output := filepath.Join(t.TempDir(), "executable")
@@ -744,7 +748,7 @@ func TestFixtureBuildArtifactsObservation(t *testing.T) {
 				if observation.goVersion != "" || observation.goRoot != "" || observation.goToolDir != "" || observation.toolchain != "" {
 					t.Fatalf("unobserved selection invented: %s", observation)
 				}
-			} else if observation.goVersion != "go1.27.1" || observation.toolchain != "go1.27.1" || observation.goRoot == "" || observation.goToolDir == "" || observation.goOS == "" || observation.goArch == "" {
+			} else if observation.goVersion != "go1.27.2" || observation.toolchain != "go1.27.2" || observation.goRoot == "" || observation.goToolDir == "" || observation.goOS == "" || observation.goArch == "" {
 				t.Fatalf("actual selected child compiler missing: %s", observation)
 			}
 			if observation.probeElapsed < 0 || observation.keyElapsed < observation.probeElapsed || observation.buildElapsed < 0 || observation.totalElapsed < observation.keyElapsed+observation.buildElapsed {
@@ -775,7 +779,7 @@ func TestFixtureBuildArtifactsObservation(t *testing.T) {
 				t.Fatal(err)
 			}
 			fixtureControlCounts(t, &c, 1, 2, 0)
-			if hit.buildRuns != 0 || hit.buildElapsed != 0 || hit.goVersion != "go1.27.1" || hit.failed {
+			if hit.buildRuns != 0 || hit.buildElapsed != 0 || hit.goVersion != "go1.27.2" || hit.failed {
 				t.Fatalf("cache reuse incorrectly reported an executed build: %s", hit)
 			}
 		})
@@ -799,13 +803,13 @@ func TestFixtureBuildArtifactsObservationReuse(t *testing.T) {
 	if err := build(t.Context(), false); err != nil {
 		t.Fatal(err)
 	}
-	if observation.buildRuns != 1 || observation.goVersion != "go1.27.1" {
+	if observation.buildRuns != 1 || observation.goVersion != "go1.27.2" {
 		t.Fatalf("initial observed build missing: %s", observation)
 	}
 	if err := build(t.Context(), false); err != nil {
 		t.Fatal(err)
 	}
-	if observation.buildRuns != 0 || observation.buildElapsed != 0 || observation.goVersion != "go1.27.1" {
+	if observation.buildRuns != 0 || observation.buildElapsed != 0 || observation.goVersion != "go1.27.2" {
 		t.Fatalf("reused observation retained executed build: %s", observation)
 	}
 	if err := build(t.Context(), true); err != nil {

cmd/wfctl/generate.go

@@ -177,7 +177,7 @@ func writeCIWorkflow(path string, features *projectFeatures) error {
 	fmt.Fprintf(&b, "      - uses: %s\n", githubActionsCheckoutRef)
 	fmt.Fprintf(&b, "      - uses: %s\n", githubActionsSetupGoRef)
 	b.WriteString("        with:\n")
-	b.WriteString("          go-version: '1.26.5'\n")
+	b.WriteString("          go-version: '1.27.2'\n")
 	b.WriteString("      - name: Install wfctl\n")
 	b.WriteString("        run: go install github.com/GoCodeAlone/workflow/cmd/wfctl@latest\n")
 	b.WriteString("      - name: Validate config\n")
@@ -230,7 +230,7 @@ func writeCDWorkflow(path string, features *projectFeatures, registry, platforms
 	fmt.Fprintf(&b, "      - uses: %s\n", githubActionsCheckoutRef)
 	fmt.Fprintf(&b, "      - uses: %s\n", githubActionsSetupGoRef)
 	b.WriteString("        with:\n")
-	b.WriteString("          go-version: '1.26.5'\n")
+	b.WriteString("          go-version: '1.27.2'\n")
 
 	if features.hasUI {
 		fmt.Fprintf(&b, "      - uses: %s\n", githubActionsSetupNodeRef)
@@ -280,7 +280,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.26.5'
+          go-version: '1.27.2'
       - name: Build plugin binaries
         run: |
           mkdir -p dist