Skip to content

Bump golang from 1.24 to 1.26 #406

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
+2 −2
Open

Bump golang from 1.24 to 1.26 #406

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM golang:1.24
FROM golang:1.26

@coderabbitai coderabbitai Bot Apr 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "go.mod (toolchain + go directives):"
sed -n '1,40p' go.mod

echo
echo "hack/build-go.sh: look for go invocations and any GOTOOLCHAIN pinning:"
if [ -f hack/build-go.sh ]; then
  rg -n --context 3 'GOTOOLCHAIN|toolchain|go1\.' hack/build-go.sh || true
  rg -n --context 2 '\bgo (build|test|list|install)\b' hack/build-go.sh || true
else
  echo "Missing hack/build-go.sh in repo root; adjust path if different."
fi

Repository: openshift/whereabouts-cni

Length of output: 1546

🏁 Script executed:

# Check if hack/build-go.sh exists and read it
fd -t f 'build.*\.sh' . 2>/dev/null | head -20

Repository: openshift/whereabouts-cni

Length of output: 170

🏁 Script executed:

# Read the Dockerfile to understand the full context
cat -n Dockerfile

Repository: openshift/whereabouts-cni

Length of output: 871

🏁 Script executed:

# Check for any .sh files in hack directory
ls -la hack/ 2>/dev/null || echo "No hack directory found"

Repository: openshift/whereabouts-cni

Length of output: 994

🏁 Script executed:

cat -n hack/build-go.sh

Repository: openshift/whereabouts-cni

Length of output: 2602

Go toolchain mismatch: golang:1.26 builder with toolchain go1.24.6 in go.mod.

The Dockerfile uses golang:1.26, but go.mod pins toolchain go1.24.6. Since hack/build-go.sh does not set GOTOOLCHAIN=local and invokes plain go build, Go 1.26 will attempt to download and use the pinned Go 1.24.6 toolchain per the go.mod directive. This adds unnecessary network dependency and slows the Docker build.

Recommended fixes:

  • Update go.mod to go 1.26 and toolchain go1.26.x, or
  • Add GOTOOLCHAIN=local to the build environment in hack/build-go.sh (or in the Dockerfile before RUN ./hack/build-go.sh)
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Dockerfile` at line 1, Dockerfile is using golang:1.26 while go.mod pins
toolchain go1.24.6 causing Go to download the older toolchain during build; fix
by either updating go.mod's "go" and "toolchain" directives to match 1.26 (e.g.,
change toolchain to go1.26.x in go.mod) or ensure the build uses the container's
toolchain by exporting GOTOOLCHAIN=local before invoking the build (set
GOTOOLCHAIN=local in hack/build-go.sh or export it in the Dockerfile prior to
RUN ./hack/build-go.sh) so plain go build uses the local Go image instead of
downloading toolchains.

ADD . /usr/src/whereabouts
RUN mkdir -p $GOPATH/src/github.com/k8snetworkplumbingwg/whereabouts
WORKDIR $GOPATH/src/github.com/k8snetworkplumbingwg/whereabouts
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile.arm64
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM golang:1.24
FROM golang:1.26

@coderabbitai coderabbitai Bot Apr 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Find and read go.mod to verify toolchain version
find . -name "go.mod" -type f | head -5

Repository: openshift/whereabouts-cni

Length of output: 78

🏁 Script executed:

# Find and read hack/build-go.sh to understand toolchain handling
find . -path "*/hack/build-go.sh" -type f

Repository: openshift/whereabouts-cni

Length of output: 88

🏁 Script executed:

cat -n ./go.mod | head -20

Repository: openshift/whereabouts-cni

Length of output: 801

🏁 Script executed:

cat -n ./hack/build-go.sh

Repository: openshift/whereabouts-cni

Length of output: 2602

Use golang:1.24.6 in Dockerfile.arm64 to match the go.mod toolchain directive.

The FROM golang:1.26 creates a mismatch with go.mod's toolchain go1.24.6 directive. When hack/build-go.sh runs go build, Go 1.26 will detect the toolchain directive and attempt to download/select Go 1.24.6 instead, adding unnecessary overhead to the build process. Pin the base image to golang:1.24.6 to match the intended toolchain.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.arm64` at line 1, Update the base image in the Dockerfile FROM
line to match the go toolchain in go.mod: replace the current "golang:1.26" base
image with "golang:1.24.6" so the Docker build uses the same Go version as the
toolchain directive and avoids Go downloading/selecting a different toolchain at
build time.

ADD . /usr/src/whereabouts

ENV GOARCH="arm64"
Expand Down