title: phpboyscout/cicd v0.11.3 — goreleaser gotoolchain defaults to auto description: The goreleaser component defaults GOTOOLCHAIN=local, so it builds with the goreleaser image's bundled Go (currently 1.26.3, even on the latest goreleaser v2.16.0). A project pinning toolchain go1.26.4 in go.mod then fails at release on the default config. Default gotoolchain: auto so goreleaser resolves and downloads the toolchain go.mod requires. status: approved date: 2026-06-21 authors: [Matt Cockayne] tags: [spec, cicd, components, goreleaser, go, toolchain]

Spec: phpboyscout/cicd v0.11.3 — goreleaser gotoolchain: auto¶

• Repository: gitlab.com/phpboyscout/cicd
• Released as: v0.11.3 (patch — a fix: the default no longer releases the wrong Go toolchain).
• Driver: the v0.11.2 follow-up (spec D2). v0.11.2 fixed the MR-time gates (go-test/go-security) to Go 1.26.4, but goreleaser resolves Go from its own image + GOTOOLCHAIN. The latest upstream goreleaser/goreleaser image (v2.16.0) still bundles Go 1.26.3, so with the default gotoolchain: local a toolchain go1.26.4 project fails at tag/release time — there is no newer upstream image to bump to.

Decision¶

D1 — Default gotoolchain local → auto¶

With GOTOOLCHAIN=auto, the bundled Go honours go.mod's toolchain directive and downloads the required version (e.g. 1.26.4) for the release build. This is precisely what go-tool-base / keyrx already set explicitly (gotoolchain: go1.26.4); making auto the default fixes consumers that rely on the component default (e.g. haileys-app), and is more future-proof than pinning a specific version — it tracks whatever each consumer's go.mod requires.

auto (not a pinned go1.26.4) is chosen so the default adapts per consumer rather than forcing one Go version on everyone.

D2 — Reversing the original local rationale, knowingly¶

The previous local default existed to avoid a mid-release toolchain download — a transient IPv6 route to the Go toolchain/sum.golang.org host once bit a go-tool-base release. That was transient infrastructure, not a reason to ship the wrong Go version by default. auto only downloads when go.mod actually requires a newer toolchain than the image bundles; the component's existing retry_max (default 2, on transient classes) covers a one-off network blip. Consumers who must avoid any download can still set gotoolchain: local (and accept the bundled Go) or pin a specific version.

D3 — Not switching to an in-house goreleaser image (for now)¶

Building a phpboyscout goreleaser image pinning Go 1.26.4 was considered and rejected for this fix: it adds a new image + publish pipeline to maintain, where auto already gives the correct toolchain with no new infrastructure. Revisit only if upstream goreleaser's Go lag becomes a recurring blocker.

D4 — Versioning¶

Non-breaking default change (image-overriding / gotoolchain-overriding consumers unaffected) → v0.11.3 (patch). Consumers on the preset pick it up via Renovate; go-tool-base / keyrx can later drop their explicit gotoolchain: go1.26.4 overrides.