From 6ff6a62ae6c8e017c724d810ae7081c6acd68528 Mon Sep 17 00:00:00 2001
From: Steven Borrelli <steve@borrelli.org>
Date: Mon, 26 Oct 2026 14:47:20 +0000
Subject: [PATCH] chore(renovate): track Go toolchain version in CI and
 Dockerfile

GO_VERSION in ci.yml floated on '1.26', so the patch level of the Go
toolchain used for release builds was whatever golang:1.26 resolved to
at build time (v0.7.0 shipped with go1.26.6, missing a crypto/x509 CVE
fix). Pin GO_VERSION and the Dockerfile ARG default to 1.26.10 and add
Renovate regex managers using the golang-version datasource so Go
updates arrive as grouped PRs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Steven Borrelli <steve@borrelli.org>
---
 .github/workflows/ci.yml |  2 +-
 Dockerfile               |  4 ++--
 renovate.json            | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a8e429d..775e8fd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ on:
 
 env:
   # Common versions
-  GO_VERSION: '1.26'
+  GO_VERSION: '1.26.10'
   GOLANGCI_VERSION: 'v2.12.2'
   DOCKER_BUILDX_VERSION: 'v0.23.0'
 
diff --git a/Dockerfile b/Dockerfile
index 5a2dad5..1beec41 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
 # syntax=docker/dockerfile:1
 
-# We use the latest Go 1.x version unless asked to use something else.
+# Pinned Go version, kept up to date by Renovate. Keep in sync with ci.yml.
 # The GitHub Actions CI job sets this argument for a consistent Go version.
-ARG GO_VERSION=1
+ARG GO_VERSION=1.26.10
 
 # Setup the base environment. The BUILDPLATFORM is set automatically by Docker.
 # The --platform=${BUILDPLATFORM} flag tells Docker to build the function using
diff --git a/renovate.json b/renovate.json
index 3155496..eaa627d 100644
--- a/renovate.json
+++ b/renovate.json
@@ -24,6 +24,38 @@
       ],
       "pinDigests": true,
       "groupName": "GitHub Actions"
+    },
+    {
+      "matchDatasources": [
+        "golang-version"
+      ],
+      "groupName": "Go"
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Go version used by CI",
+      "managerFilePatterns": [
+        "/^\\.github/workflows/ci\\.yml$/"
+      ],
+      "matchStrings": [
+        "GO_VERSION: '(?<currentValue>[^']+)'"
+      ],
+      "depNameTemplate": "go",
+      "datasourceTemplate": "golang-version"
+    },
+    {
+      "customType": "regex",
+      "description": "Default Go version for Docker builds",
+      "managerFilePatterns": [
+        "/(^|/)Dockerfile$/"
+      ],
+      "matchStrings": [
+        "ARG GO_VERSION=(?<currentValue>\\S+)"
+      ],
+      "depNameTemplate": "go",
+      "datasourceTemplate": "golang-version"
     }
   ]
 }