build: Pin GoReleaser and stop on a toolchain mismatch #18

Merged

linus merged 1 commit from ash/toolchain-preflight-17 into develop

2026-10-17 19:20:56 +00:00

ash commented

2026-10-17 18:56:09 +00:00

Collaborator

What

make build now depends on a check-toolchain target (GORELEASER_VERSION ?= v2.18.3) that runs scripts/check-toolchain.sh (forge standard copy) before anything else.
go.mod pins toolchain go1.27.2 (written in go mod tidy format, since the GoReleaser before-hook runs tidy and would otherwise rewrite it on every build).
CI (test-pr.yaml) and release (release-tag.yaml) run the preflight right after setup-go. Release moves to setup-go@v5 and goreleaser-action@v6 with version: v2.18.3.
README build section says what's checked and how to fix a mismatch.
One fix to the standard script: it built the GoReleaser version as "v" GitVersion, which reads vv2.18.3 for a go install-ed GoReleaser (the exact fix it prints), so the check could never pass. It now strips a leading v first. forge-standards' copy needs the same one-line change.

Why

make build ran whatever goreleaser was on PATH and the release job used goreleaser-action@master / version: latest / setup-go@main, so a release could come from a different GoReleaser than any local build. Forge rule (2026-10-10): one-at-a-time toolchains get a preflight.

Test (jumpbox, GNU Make 4.4.1, local Go 1.27.1, GoReleaser v2.18.3 via go install)

No goreleaser on PATH: make build stops at check-toolchain, prints found none / required v2.18.3 / the go install fix, rc 2, tree clean.
GORELEASER_VERSION=v2.18.2: stops, found v2.18.3 / required v2.18.2, tree clean.
GOTOOLCHAIN=local (Go 1.27.1): stops, found go1.27.1 / required go1.27.2, tree clean.
go.mod toolchain edited to go1.27.3, and separately go edited to 1.27.1: both caught as "pins changed since the last commit" with the git checkout -- go.mod fix.
Right toolchain: make build twice in a row, both rc 0, GoReleaser build succeeds, bin/jiggablend --help runs, git status clean after each.
sh scripts/check-toolchain.sh without GORELEASER_VERSION (the CI path): rc 0. make help lists the new target. go vet ./... ok. Workflow YAML parses.
go test -race -shuffle=on ./...: 189 pass, 4 skip, 1 fail, TestIntegration_Encode_EXR_H264, because the jumpbox has no ffmpeg. The same test fails the same way on develop; CI installs ffmpeg.

Written by OpenCode gemma-26b-censored. I hand-fixed its broken YAML indentation, moved the README paragraph under Building, rewrote the commit message, fixed the go.mod formatting and the script's version parse. Base is develop per CONTRIBUTING.

Closes #17

**What** - `make build` now depends on a `check-toolchain` target (`GORELEASER_VERSION ?= v2.18.3`) that runs `scripts/check-toolchain.sh` (forge standard copy) before anything else. - go.mod pins `toolchain go1.27.2` (written in `go mod tidy` format, since the GoReleaser before-hook runs tidy and would otherwise rewrite it on every build). - CI (`test-pr.yaml`) and release (`release-tag.yaml`) run the preflight right after setup-go. Release moves to `setup-go@v5` and `goreleaser-action@v6` with `version: v2.18.3`. - README build section says what's checked and how to fix a mismatch. - One fix to the standard script: it built the GoReleaser version as `"v" GitVersion`, which reads `vv2.18.3` for a `go install`-ed GoReleaser (the exact fix it prints), so the check could never pass. It now strips a leading `v` first. forge-standards' copy needs the same one-line change. **Why** `make build` ran whatever `goreleaser` was on PATH and the release job used `goreleaser-action@master` / `version: latest` / `setup-go@main`, so a release could come from a different GoReleaser than any local build. Forge rule (2026-10-10): one-at-a-time toolchains get a preflight. **Test** (jumpbox, GNU Make 4.4.1, local Go 1.27.1, GoReleaser v2.18.3 via `go install`) - No goreleaser on PATH: `make build` stops at check-toolchain, prints found none / required v2.18.3 / the `go install` fix, rc 2, tree clean. - `GORELEASER_VERSION=v2.18.2`: stops, found v2.18.3 / required v2.18.2, tree clean. - `GOTOOLCHAIN=local` (Go 1.27.1): stops, found go1.27.1 / required go1.27.2, tree clean. - go.mod `toolchain` edited to go1.27.3, and separately `go` edited to 1.27.1: both caught as "pins changed since the last commit" with the `git checkout -- go.mod` fix. - Right toolchain: `make build` twice in a row, both rc 0, GoReleaser build succeeds, `bin/jiggablend --help` runs, `git status` clean after each. - `sh scripts/check-toolchain.sh` without GORELEASER_VERSION (the CI path): rc 0. `make help` lists the new target. `go vet ./...` ok. Workflow YAML parses. - `go test -race -shuffle=on ./...`: 189 pass, 4 skip, 1 fail, `TestIntegration_Encode_EXR_H264`, because the jumpbox has no ffmpeg. The same test fails the same way on develop; CI installs ffmpeg. Written by OpenCode gemma-26b-censored. I hand-fixed its broken YAML indentation, moved the README paragraph under Building, rewrote the commit message, fixed the go.mod formatting and the script's version parse. Base is develop per CONTRIBUTING. Closes #17

ash added 1 commit

2026-10-17 18:56:09 +00:00

build: Pin GoReleaser and stop on a toolchain mismatch

CI / check-and-test (pull_request) Successful in 1m33s

Details

8aa852d752

`make build` ran whatever goreleaser was on PATH, and the release job
used goreleaser-action@master with version latest and setup-go@main, so
a release could come out of a different GoReleaser than any local build
and an upstream change could break a tag with nothing changed here.

Add the forge-standard scripts/check-toolchain.sh and make build depend
on a check-toolchain target that pins GoReleaser v2.18.3 and checks Go
against go.mod before any work. Pin toolchain go1.27.2, run the
preflight in CI and release right after setup-go, move release to
setup-go@v5 and goreleaser-action@v6 with version v2.18.3, and document
the check in the README.

The standard script read `goreleaser --version` as "v" plus GitVersion,
which gives "vv2.18.3" for a go-installed GoReleaser (the fix it prints),
so strip a leading v before comparing.

Closes #17

ash requested review from eva

2026-10-17 18:56:10 +00:00

eva approved these changes

2026-10-17 18:57:23 +00:00

eva left a comment

GO from me on 8aa852d, once CI is green.

It covers all of #17. make build now runs the preflight first and stops with found, required and the fix. go.mod gets toolchain go1.27.2. The release job is off @master, @main and latest and onto setup-go v5, goreleaser-action v6 and v2.18.3. CI runs the check, and the README tells you what to do on a mismatch. Your mismatch proofs cover all three toolchains and the go.mod rewrite case, and the tree stays clean each time.

Good catch on the vv2.18.3 parse. forge-standards still has the old line in both check-toolchain.sh and forge-toolchain.md, so I'll get that fixed there separately. It doesn't block this PR.

This touches CI and release config, so it goes the normal way and Linus lands it after the check-and-test run passes. If it causes trouble, revert the merge. Nothing else needs undoing.

GO from me on 8aa852d, once CI is green. It covers all of #17. `make build` now runs the preflight first and stops with found, required and the fix. go.mod gets `toolchain go1.27.2`. The release job is off `@master`, `@main` and `latest` and onto setup-go v5, goreleaser-action v6 and v2.18.3. CI runs the check, and the README tells you what to do on a mismatch. Your mismatch proofs cover all three toolchains and the go.mod rewrite case, and the tree stays clean each time. Good catch on the `vv2.18.3` parse. forge-standards still has the old line in both `check-toolchain.sh` and `forge-toolchain.md`, so I'll get that fixed there separately. It doesn't block this PR. This touches CI and release config, so it goes the normal way and Linus lands it after the check-and-test run passes. If it causes trouble, revert the merge. Nothing else needs undoing.

ash was assigned by eva

2026-10-17 18:58:18 +00:00