fix(golang): respect a caller-set GOTOOLCHAIN when installing hook envs

internal/languages/golang.go

@@ -25,15 +25,27 @@ func (g *Golang) HealthCheck(prefix, version string) error {
 	return nil
 }
 
-func (g *Golang) InstallEnvironment(prefix, version string, additionalDeps []string) error {
-	envDir := filepath.Join(prefix, g.EnvironmentDir()+"-"+version)
-
+// goInstallEnv builds the env overrides for installing a golang hook env.
+// GOTOOLCHAIN defaults to "local" so a hook repo's go.mod can't pull in a
+// different toolchain — unless the caller set GOTOOLCHAIN explicitly. CI pins
+// a repo-matching toolchain (e.g. GOTOOLCHAIN=go1.26.4) so hooks whose module
+// requires a newer Go than the one on PATH can still build; forcing "local"
+// over that pin makes such installs unbuildable.
+func goInstallEnv(envDir string) []string {
 	env := []string{
 		fmt.Sprintf("GOPATH=%s", envDir),
 		fmt.Sprintf("GOBIN=%s", filepath.Join(envDir, "bin")),
-		// Don't let a hook repo's go.mod pull in a different toolchain.
-		"GOTOOLCHAIN=local",
 	}
+	if os.Getenv("GOTOOLCHAIN") == "" {
+		env = append(env, "GOTOOLCHAIN=local")
+	}
+	return env
+}
+
+func (g *Golang) InstallEnvironment(prefix, version string, additionalDeps []string) error {
+	envDir := filepath.Join(prefix, g.EnvironmentDir()+"-"+version)
+
+	env := goInstallEnv(envDir)
 
 	// Install the hook package.
 	args := []string{"install", "./..."}

internal/languages/golang_test.go

@@ -0,0 +1,30 @@
+package languages
+
+import (
+	"slices"
+	"testing"
+)
+
+// ---------------------------------------------------------------------------
+// Golang — install env composition
+// ---------------------------------------------------------------------------
+
+func TestGoInstallEnvDefaultsToLocalToolchain(t *testing.T) {
+	t.Setenv("GOTOOLCHAIN", "")
+
+	env := goInstallEnv("/prefix/go_env-default")
+	if !slices.Contains(env, "GOTOOLCHAIN=local") {
+		t.Errorf("env %v should pin GOTOOLCHAIN=local when the caller sets nothing", env)
+	}
+}
+
+func TestGoInstallEnvRespectsCallerToolchain(t *testing.T) {
+	// CI pins a repo-matching toolchain so hooks whose module requires a
+	// newer Go than PATH's can still build; the install must not override it.
+	t.Setenv("GOTOOLCHAIN", "go1.26.4")
+
+	env := goInstallEnv("/prefix/go_env-default")
+	if slices.Contains(env, "GOTOOLCHAIN=local") {
+		t.Errorf("env %v must not force GOTOOLCHAIN=local over the caller's pin", env)
+	}
+}