From 25a7aaa777edce4f9b7586a7bcd0b90c1b874296 Mon Sep 17 00:00:00 2001
From: silverwind <me@silverwind.io>
Date: Thu, 6 Aug 2026 00:09:31 +0200
Subject: [PATCH] chore: pin the build toolchain in `go.mod`

`setup-go` took its version spec from the `go` directive, and `go 1.26` is a
range, so every job took go1.26.0 out of the runner image while go1.26.5 was
current. The `toolchain` directive names the exact build version, the `go` line
becomes an explicit minimum, and `check-latest` keeps the action from settling
for an older patch.

`go mod tidy` deletes the directive once the `go` line reaches the same
version, so `make tidy` writes it back.

The renovate config drops two presets that the shared default already carries,
`go-deps` fast-tracked the toolchain bump that the weekly group covers too.

Refs: https://github.com/golang/go/issues/75331
Assisted-by: Claude Code:claude-opus-5
---
 .gitea/workflows/release-nightly.yml | 1 +
 .gitea/workflows/release-tag.yml     | 1 +
 .gitea/workflows/test-pr.yml         | 2 ++
 Makefile                             | 5 +++++
 go.mod                               | 4 +++-
 renovate.json5                       | 4 +---
 6 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/release-nightly.yml b/.gitea/workflows/release-nightly.yml
index 4b383240..7aa0a279 100644
--- a/.gitea/workflows/release-nightly.yml
+++ b/.gitea/workflows/release-nightly.yml
@@ -27,6 +27,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: "go.mod"
+          check-latest: true
       - name: import gpg
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
diff --git a/.gitea/workflows/release-tag.yml b/.gitea/workflows/release-tag.yml
index b7a3dafc..67821d19 100644
--- a/.gitea/workflows/release-tag.yml
+++ b/.gitea/workflows/release-tag.yml
@@ -28,6 +28,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: import gpg
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
diff --git a/.gitea/workflows/test-pr.yml b/.gitea/workflows/test-pr.yml
index b1fa1355..b5c81466 100644
--- a/.gitea/workflows/test-pr.yml
+++ b/.gitea/workflows/test-pr.yml
@@ -20,6 +20,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: lint and build
         run: |
           make clean
@@ -45,6 +46,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: wait for the gitea instance to be ready
         run: |
           for i in $(seq 1 30); do
diff --git a/Makefile b/Makefile
index 6eaa2ae2..0376dbdf 100644
--- a/Makefile
+++ b/Makefile
@@ -118,7 +118,12 @@ unit-test-coverage:
 
 .PHONY: tidy
 tidy:
+	$(eval GO_TOOLCHAIN := $(shell grep -Eo '^toolchain\s+go[0-9.]+' go.mod | cut -d' ' -f2))
 	$(GO) mod tidy
+	@# workaround https://github.com/golang/go/issues/75331: restore toolchain if tidy dropped it
+	@if [ -n "$(GO_TOOLCHAIN)" ] && ! grep -qE '^toolchain\s' go.mod; then \
+		$(GO) mod edit -toolchain=$(GO_TOOLCHAIN); \
+	fi
 
 .PHONY: check
 check: test
diff --git a/go.mod b/go.mod
index dcb30bc3..fba7910c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,8 @@
 module gitea.dev/tea
 
-go 1.26
+go 1.26.0
+
+toolchain go1.26.5
 
 require (
 	charm.land/glamour/v2 v2.0.1
diff --git a/renovate.json5 b/renovate.json5
index 72388496..c7e09e46 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -1,8 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>gitea/renovate-config",
-    "local>gitea/renovate-config:security",
-    "local>gitea/renovate-config:go-deps"
+    "local>gitea/renovate-config"
   ]
 }