From c641382740fd3702d7e9107cdd0d29da807c7075 Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Mon, 24 Aug 2026 11:40:59 -0400 Subject: [PATCH 1/2] fix(authbridge): Bump go.work to go 1.26.5 Dependency updates that raise a module's minimum Go version fail the Go CI (authlib) job. That job is the only one which reads go.work -- the cmd/* matrix and dependabot-tidy both set GOWORK=off -- so with go.work pinned at 1.26.4 any module requiring >= 1.26.5 errors: go: module . listed in go.work file requires go >= 1.26.5, but go.work lists go 1.26.4 and it cascades to every module in the workspace, making the failure look broader than the one dependency that caused it. Dependabot only edits the directory it is updating, so it can never fix go.work itself; the failure recurs on every toolchain-raising bump. Currently blocking #771 (bifrost/core 1.7.0 -> 1.7.13). Modules stay at go 1.26.4. go.work only needs to be >= the highest module directive, so raising it alone is sufficient and stays valid once modules move to 1.26.5. The authlib job leaves GOTOOLCHAIN at its default (auto), so it fetches the newer toolchain as needed. Signed-off-by: Hai Huang Assisted-By: Claude (Anthropic AI) --- authbridge/go.work | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authbridge/go.work b/authbridge/go.work index cf30a6c6a..5b18e4912 100644 --- a/authbridge/go.work +++ b/authbridge/go.work @@ -1,4 +1,4 @@ -go 1.26.4 +go 1.26.5 use ( ./authlib From 934843e403cf60778b0855994e55ce3d6e6a9378 Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Mon, 24 Aug 2026 12:09:37 -0400 Subject: [PATCH 2/2] fix(authbridge): Raise the workspace Go directive to 1.26.5 Bumping go.work alone does not work, and the reason is worth recording: actions/setup-go exports GOTOOLCHAIN=local itself and installs the version named by go-version-file (authbridge/authlib/go.mod). A toolchain pinned at 1.26.4 and forbidden from upgrading can never satisfy a go.work that asks for 1.26.5: go: ../go.work requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local) So the module directives have to move together with go.work: authlib's is what selects the CI toolchain, and every module that replaces authlib must not declare an older Go than authlib does. All seven workspace modules go to 1.26.5 in one step. This is not speculative -- #771 (bifrost/core 1.7.0 -> 1.7.13) already raises four of them, and Dependabot cannot touch go.work, so the split would recur on every toolchain-raising bump. Doing it deliberately keeps GOTOOLCHAIN=local hermetic and makes #771 a clean rebase. Checked: the CI matrix covers only proxy and envoy, both of which read their own go.mod with GOWORK=off; dependabot-tidy reads the same authlib/go.mod and follows automatically; the cmd Dockerfiles use golang:1.26-alpine, and 1.26.7 is released. Signed-off-by: Hai Huang Assisted-By: Claude (Anthropic AI) --- authbridge/authlib/go.mod | 2 +- authbridge/cmd/abctl/go.mod | 2 +- authbridge/cmd/authbridge-cpex/go.mod | 2 +- authbridge/cmd/authbridge-envoy/go.mod | 2 +- authbridge/cmd/authbridge-praxis/go.mod | 2 +- authbridge/cmd/authbridge-proxy/go.mod | 2 +- authbridge/storage/redis/go.mod | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/authbridge/authlib/go.mod b/authbridge/authlib/go.mod index fdee51ab1..6f4c0f723 100644 --- a/authbridge/authlib/go.mod +++ b/authbridge/authlib/go.mod @@ -1,6 +1,6 @@ module github.com/rossoctl/cortex/authbridge/authlib -go 1.26.4 +go 1.26.5 require ( github.com/contextforge-org/cpex/go/cpex v0.2.2 diff --git a/authbridge/cmd/abctl/go.mod b/authbridge/cmd/abctl/go.mod index cfa828592..479737967 100644 --- a/authbridge/cmd/abctl/go.mod +++ b/authbridge/cmd/abctl/go.mod @@ -1,6 +1,6 @@ module github.com/rossoctl/cortex/authbridge/cmd/abctl -go 1.26.4 +go 1.26.5 // Workspace-only: this replace is satisfied by authbridge/go.work during // local development. Standalone `go get` / `go install` outside the diff --git a/authbridge/cmd/authbridge-cpex/go.mod b/authbridge/cmd/authbridge-cpex/go.mod index 6ccb51429..82ceb0f1c 100644 --- a/authbridge/cmd/authbridge-cpex/go.mod +++ b/authbridge/cmd/authbridge-cpex/go.mod @@ -1,6 +1,6 @@ module github.com/rossoctl/cortex/authbridge/cmd/authbridge-cpex -go 1.26.4 +go 1.26.5 require github.com/rossoctl/cortex/authbridge/authlib v0.0.0-00010101000000-000000000000 diff --git a/authbridge/cmd/authbridge-envoy/go.mod b/authbridge/cmd/authbridge-envoy/go.mod index b37510942..165c15c99 100644 --- a/authbridge/cmd/authbridge-envoy/go.mod +++ b/authbridge/cmd/authbridge-envoy/go.mod @@ -1,6 +1,6 @@ module github.com/rossoctl/cortex/authbridge/cmd/authbridge-envoy -go 1.26.4 +go 1.26.5 replace ( github.com/rossoctl/cortex/authbridge/authlib => ../../authlib diff --git a/authbridge/cmd/authbridge-praxis/go.mod b/authbridge/cmd/authbridge-praxis/go.mod index b39607c23..fde9bc2c4 100644 --- a/authbridge/cmd/authbridge-praxis/go.mod +++ b/authbridge/cmd/authbridge-praxis/go.mod @@ -1,6 +1,6 @@ module github.com/rossoctl/cortex/authbridge/cmd/authbridge-praxis -go 1.26.4 +go 1.26.5 require github.com/rossoctl/cortex/authbridge/authlib v0.0.0-20260819180630-8386e3004363 diff --git a/authbridge/cmd/authbridge-proxy/go.mod b/authbridge/cmd/authbridge-proxy/go.mod index fd2add45d..cd5a1fdf2 100644 --- a/authbridge/cmd/authbridge-proxy/go.mod +++ b/authbridge/cmd/authbridge-proxy/go.mod @@ -1,6 +1,6 @@ module github.com/rossoctl/cortex/authbridge/cmd/authbridge-proxy -go 1.26.4 +go 1.26.5 require ( github.com/rossoctl/cortex/authbridge/authlib v0.0.0 diff --git a/authbridge/storage/redis/go.mod b/authbridge/storage/redis/go.mod index 4d8532c1c..a2ea47808 100644 --- a/authbridge/storage/redis/go.mod +++ b/authbridge/storage/redis/go.mod @@ -1,6 +1,6 @@ module github.com/rossoctl/cortex/authbridge/storage/redis -go 1.26.4 +go 1.26.5 require ( github.com/alicebob/miniredis/v2 v2.38.0