fix(security): build with Go 1.26.10 for eMudhra intermediate distrust

.github/actions/publish/action.yml

@@ -63,6 +63,7 @@ runs:
       run: docker exec
         --env GITHUB_TOKEN
         --env HOMEBREW_DEPLOY_KEY
+        --env GOTOOLCHAIN=auto
         --workdir "$PWD"
         --tty
         "$CONTAINER_ID"

.golangci.yml

@@ -0,0 +1,30 @@
+# golangci-lint v2 config reproducing the v1 defaults this repo linted with
+# before the Go 1.26 bump (golangci-lint v1 cannot read Go 1.26 export data).
+# Generated with `golangci-lint migrate` from an empty v1 config.
+version: "2"
+linters:
+  settings:
+    staticcheck:
+      # v1 ran staticcheck (SA) and gosimple (S1) by default; v2 merges
+      # stylecheck (ST) and quickfix (QF) into staticcheck. Keep the v1 set.
+      checks:
+        - "SA*"
+        - "S1*"
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.goreleaser.yaml

@@ -58,6 +58,12 @@ builds:
       # The real values are defined by the CC_<OS>_<ARCH> env vars defined at the top `env` attribute.
       - 'CC={{ index .Env (print "CC_" .Os "_" .Arch) }}'
       - 'CXX={{ index .Env (print "CXX_" .Os "_" .Arch) }}'
+    hooks:
+      post:
+        # Refuse to ship a binary built with an older Go than go.mod's toolchain
+        # directive (INC-289: Go 1.26.10 distrusts compromised eMudhra CAs).
+        - cmd: ./scripts/check-go-toolchain.sh "{{ .Path }}"
+          output: true
 
 dockers:
   # AMD64

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
-# Cache bust: force rebuild for Go 1.26.0 compatibility
+# Cache bust: golangci-lint v2.9.0 for Go 1.26.10
 repos:
   - repo: https://github.com/golangci/golangci-lint
-    rev: v1.63.4
+    rev: v2.9.0
     hooks:
       - id: golangci-lint
         entry: golangci-lint run

AGENTS.md

@@ -132,5 +132,5 @@ Installed via `make install-hooks`. Checks:
 
 ## Linting
 
-- Go: `golangci-lint` (v1.63.4) via pre-commit
+- Go: `golangci-lint` (v2.9.0) via pre-commit
 - Frontend: ESLint + Prettier

go.mod

@@ -2,6 +2,8 @@ module github.com/launchdarkly/ldcli
 
 go 1.25.0
 
+toolchain go1.26.10
+
 require (
 	github.com/adrg/frontmatter v0.2.0
 	github.com/adrg/xdg v0.5.3

scripts/check-go-toolchain.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Fails the build if a binary was not compiled with the toolchain pinned in
+# go.mod. Run by goreleaser as a post-build hook, so a release built with an
+# older Go (e.g. one missing crypto/x509 security fixes) never gets published.
+set -euo pipefail
+
+binary="$1"
+want="$(awk '$1 == "toolchain" { print $2 }' go.mod)"
+got="$(go version "$binary" | awk '{ print $NF }')"
+
+if [ -z "$want" ]; then
+  echo "check-go-toolchain: no toolchain directive in go.mod" >&2
+  exit 1
+fi
+
+if [ "$got" != "$want" ]; then
+  echo "check-go-toolchain: $binary was built with $got, go.mod pins $want" >&2
+  exit 1
+fi
+
+echo "check-go-toolchain: $binary built with $got"