ci: update Go and harden Rust package builds

[bbednarski9]

Overview

Make Rust package builds deterministic with a cold Cargo cache and restore Windows ARM64 Go binding tests on current GitHub-hosted runners.

These failures reproduce on main and are independent of the uninstall support PR. The Rust failure occurred because target-specific fetching was followed by unfiltered offline metadata resolution. The Windows failure occurred because Relay CI remained pinned to Go 1.26, whose cgo driver passes the MinGW-only -mthreads option to Clang while Relay targets the MSVC ABI.

• I confirm this contribution is my own work, or I have the right to submit it under this project license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Pass --filter-platform to the offline cargo metadata refresh used by Rust package jobs so it resolves only dependencies fetched for the matrix target.
• Upgrade the shared CI Go toolchain pin from 1.26.1 to 1.27.1.
• Rely on the upstream Go 1.27 fix for cmd/go: cgo passes -mthreads to the C compiler on Windows, rejected by clang targeting MSVC golang/go#80290 instead of maintaining a Relay-specific compiler wrapper.
• Keep the Go module compatibility directive at go 1.21; changing the CI toolchain does not raise the module language version or minimum toolchain declaration.
• Breaking changes: none.

The failures were observed on the current main build:

• https://github.com/NVIDIA/NeMo-Relay/actions/runs/34274470309/job/102224035334
• https://github.com/NVIDIA/NeMo-Relay/actions/runs/34274470309/job/102224035127

Validation:

• Verified the official Go 1.27.1 Darwin ARM64 archive against the checksum published by go.dev.
• Verified the downloaded Go 1.27.1 toolchain reports go version go1.27.1 darwin/arm64.
• Verified the Go 1.27.1 cgo driver no longer contains -mthreads and uses -pthread for cgo builds.
• Reproduced the Rust package flow with a cold Cargo cache using target-specific fetch followed by offline, platform-filtered metadata resolution.
• Ran focused pre-commit hooks for all changed files, including actionlint and Python worker protobuf compatibility.
• Parsed all GitHub Actions workflow YAML.
• Ran git diff --check.

The Windows-specific result is left to the PR CI matrix, which installs the shared Go pin on the actual Windows ARM64 runner.

Where should the reviewer start?

Start with .github/ci-tool-versions.env for the Go 1.27.1 pin, then review the target-filtered metadata command in .github/workflows/ci_rust.yml. The key design decision is to consume the released upstream Go fix rather than carry a Relay-specific compiler argument filter.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Relates to: none

Summary by CodeRabbit

• Chores
  • Updated the CI environment to use Go 1.27.1.
  • Improved package metadata processing for target-specific builds.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 88acdec7-f0b7-40d8-8f4d-813147c6c2a4

📥 Commits

Reviewing files that changed from the base of the PR and between a8bdf56 and 726fd14.

📒 Files selected for processing (1)

• .github/ci-tool-versions.env

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (43)

• GitHub Check: Node.js / Package (windows-arm64)
• GitHub Check: Rust / Test (windows-amd64)
• GitHub Check: Node.js / Package (linux-musl-arm64)
• GitHub Check: Node.js / Package (linux-arm64)
• GitHub Check: Rust / Package (macos-arm64)
• GitHub Check: Node.js / Package (linux-amd64)
• GitHub Check: Rust / Package (windows-arm64)
• GitHub Check: Rust / Package (windows-amd64)
• GitHub Check: Rust / Package (linux-arm64)
• GitHub Check: Rust / Package (linux-musl-arm64)
• GitHub Check: Python / Package (linux-musl-amd64)
• GitHub Check: Rust / Package (linux-musl-amd64)
• GitHub Check: Node.js / Package (macos-arm64)
• GitHub Check: Node.js / Package (linux-musl-amd64)
• GitHub Check: Node.js / Test (linux-arm64)
• GitHub Check: Node.js / Package (windows-amd64)
• GitHub Check: Rust / Package (linux-amd64)
• GitHub Check: Rust / Test (windows-arm64)
• GitHub Check: Rust / Test (linux-amd64)
• GitHub Check: Rust / Test (macos-arm64)
• GitHub Check: Python / Package (linux-arm64)
• GitHub Check: Rust / Test (linux-arm64)
• GitHub Check: Node.js / Test (windows-arm64)
• GitHub Check: Node.js / Test (windows-amd64)
• GitHub Check: Python / Package (linux-musl-arm64)
• GitHub Check: Node.js / Test (linux-amd64)
• GitHub Check: Python / Package (windows-arm64)
• GitHub Check: Python / Package (linux-amd64)
• GitHub Check: Python / Test (linux-amd64)
• GitHub Check: Python / Package (macos-arm64)
• GitHub Check: Node.js / Test (macos-arm64)
• GitHub Check: Python / Test (linux-arm64)
• GitHub Check: Python / Package (windows-amd64)
• GitHub Check: Go / Test (windows-arm64)
• GitHub Check: Python / Test (windows-amd64)
• GitHub Check: Python / Test (windows-arm64)
• GitHub Check: Python / Test (macos-arm64)
• GitHub Check: Go / Test (linux-arm64)
• GitHub Check: Node.js / Package OpenClaw plugin
• GitHub Check: Go / Test (linux-amd64)
• GitHub Check: Go / Test (windows-amd64)
• GitHub Check: Go / Test (macos-arm64)
• GitHub Check: Check / Run

🧰 Additional context used

📓 Path-based instructions (1)

Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.

⚙️ CodeRabbit configuration file

Files:

• .github/ci-tool-versions.env

🔇 Additional comments (1)

.github/ci-tool-versions.env (1)

4-4: LGTM!

---

Walkthrough

The Rust package workflow now filters offline Cargo metadata by matrix target. CI also updates the Go version from 1.26.1 to 1.27.1.

Changes

CI tooling updates

Layer / File(s)	Summary
Target-specific Cargo metadata .github/workflows/ci_rust.yml	Offline cargo metadata resolution now uses the active matrix target.
Go tool version update .github/ci-tool-versions.env	The CI Go version changes from 1.26.1 to 1.27.1.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 726fd

This updates CI to Go 1.27.1 and scopes Rust metadata resolution to each matrix target. No actionable correctness, security, or availability risk remains for merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows Conventional Commits format with the allowed lowercase type ci. It uses an imperative summary, accurately describes the Rust package and Windows Go build changes, stays under 72 ch…
Description check	✅ Passed	The description includes all required template sections, completed overview confirmations, change details, reviewer guidance, related-issue syntax, validation results, and breaking-change information.…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[bbednarski9]

/merge