chore(ci): move to Go 1.27.3 across the repo; bump grpc, x/net, goldmark, lint

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0
   GOVULNCHECK: golang.org/x/vuln/cmd/govulncheck@v1.3.0
   # benchstat lives in golang.org/x/perf, which ships only pseudo-versions.
   # Pinned to the latest published pseudo-version so every run uses the same tool.
@@ -72,7 +72,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
       - name: golangci-lint (state)
         working-directory: state
@@ -178,7 +178,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
       - name: govulncheck (state)
         working-directory: state
@@ -254,7 +254,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
       - name: coverage gate (state)
         working-directory: state
@@ -494,7 +494,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
 
       # Skip the (relatively expensive) bench run on docs-only PRs. The gate only
@@ -567,7 +567,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
       # Regenerate the API reference (gomarkdoc) and Mermaid diagram partials from
       # the Go source before the site build, so the PR docs build validates the

.github/workflows/codeql.yml

@@ -39,7 +39,7 @@ jobs:
       # code seen during build". Starting cold guarantees real compilation.
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache: false
 
       # Go does not support build-mode: none, so extraction is traced through a

.github/workflows/docs-deploy.yml

@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
       # Regenerate derived docs content before the site build so the published
       # API reference (gomarkdoc) and Mermaid diagram partials stay current with

.github/workflows/release.yml

@@ -19,7 +19,7 @@ permissions:
   contents: read
 
 env:
-  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0
   GOVULNCHECK: golang.org/x/vuln/cmd/govulncheck@v1.3.0
 
 # Run every step under bash on all runners, including Windows. Windows runners
@@ -58,7 +58,6 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go: ["1.25.14", "1.26.6"]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     env:
@@ -73,7 +72,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: ${{ matrix.go }}
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
           # Skip the Go cache save on Windows: the tar/zstd cache-save post-step
           # flakes intermittently on windows-latest and fails the job even when
@@ -85,12 +84,7 @@ jobs:
       - name: govulncheck
         working-directory: ${{ env.MODULE }}
         run: go run "$GOVULNCHECK" ./...
-      # Lint runs only on the newest Go leg: golangci-lint is compiled by the
-      # active toolchain, and an older one (go1.25) refuses a module targeting
-      # a newer language version (module toolchain directives), which would
-      # fail the 1.25.x legs spuriously. Test -race still covers those legs.
       - name: golangci-lint
-        if: matrix.go == '1.26.6'
         working-directory: ${{ env.MODULE }}
         run: go run "$GOLANGCI_LINT" run --config "$GITHUB_WORKSPACE/.golangci.yml" ./...
       - name: coverage gate

.github/workflows/sink.yml

@@ -3,7 +3,7 @@ name: sink
 # Reusable sink test suite. Groups every sink-domain check under a single
 # collapsible "sink / …" tree in the checks UI rather than sprawling across the
 # top-level check list:
-#   - unit:              race tests for the in-workspace sink modules (Go × OS).
+#   - unit:              race tests for the in-workspace sink modules (OS).
 #   - sink-destinations: the SDK-backed destinations, built GOWORK=off via their
 #                        own replace directives, with lint/vuln/coverage on Linux.
 #   - integration:       the `integration`-tagged end-to-end leg (GOWORK=off).
@@ -12,21 +12,20 @@ on:
   workflow_call:
 
 env:
-  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0
   GOVULNCHECK: golang.org/x/vuln/cmd/govulncheck@v1.3.0
 
 permissions:
   contents: read
 
 jobs:
   # Race tests for the in-workspace sink modules (sink core + the hermetic,
-  # SDK-free adapters), across the Go × OS matrix. These live in the workspace,
+  # SDK-free adapters), across the OS matrix. These live in the workspace,
   # so they build without GOWORK=off — same as the state-machine unit matrix.
   unit:
     strategy:
       fail-fast: false
       matrix:
-        go: ["1.25.14", "1.26.6"]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     env:
@@ -35,7 +34,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: ${{ matrix.go }}
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
           # Skip the Go cache save on Windows: the tar/zstd cache-save post-step
           # flakes intermittently on windows-latest and fails the job even when
@@ -86,7 +85,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
           # Skip the Go cache save on Windows: the tar/zstd cache-save post-step
           # flakes intermittently on windows-latest and fails the job even when
@@ -153,7 +152,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
           # Skip the Go cache save on Windows: the tar/zstd cache-save post-step
           # flakes intermittently on windows-latest and fails the job even when

.github/workflows/source.yml

@@ -3,7 +3,7 @@ name: source
 # Reusable source test suite. Groups every source-domain check under a single
 # collapsible "source / …" tree in the checks UI rather than sprawling across the
 # top-level check list:
-#   - unit:                race tests for the in-workspace source modules (Go × OS).
+#   - unit:                race tests for the in-workspace source modules (OS).
 #   - source-destinations: the SDK-backed source modules, built GOWORK=off via
 #                          their own replace directives, with lint/vuln/coverage
 #                          on Linux.
@@ -13,22 +13,21 @@ on:
   workflow_call:
 
 env:
-  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+  GOLANGCI_LINT: github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0
   GOVULNCHECK: golang.org/x/vuln/cmd/govulncheck@v1.3.0
 
 permissions:
   contents: read
 
 jobs:
   # Race tests for the in-workspace source modules (source core + the
-  # stdlib-only statemachine adapter), across the Go × OS matrix. These live in
+  # stdlib-only statemachine adapter), across the OS matrix. These live in
   # the workspace, so they build without GOWORK=off — same as the state-machine
   # unit matrix.
   unit:
     strategy:
       fail-fast: false
       matrix:
-        go: ["1.25.14", "1.26.6"]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     env:
@@ -37,7 +36,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: ${{ matrix.go }}
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
           # Skip the Go cache save on Windows: the tar/zstd cache-save post-step
           # flakes intermittently on windows-latest and fails the job even when
@@ -76,7 +75,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
           # Skip the Go cache save on Windows: the tar/zstd cache-save post-step
           # flakes intermittently on windows-latest and fails the job even when
@@ -129,7 +128,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: "1.26.6"
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
           # Skip the Go cache save on Windows: the tar/zstd cache-save post-step
           # flakes intermittently on windows-latest and fails the job even when

.github/workflows/test.yml

@@ -1,9 +1,9 @@
 name: tests
 
 # Reusable race-test matrix for the state-machine modules. Runs `go test -race
-# ./...` for each module across the Go × OS matrix. Called by ci.yml so the legs
+# ./...` for each module across the OS matrix. Called by ci.yml so the legs
 # render as a single collapsible tree in the checks UI (e.g. "state machine tests
-# / test (1.25.14, ubuntu-latest)") instead of cluttering the top-level checks
+# / test (ubuntu-latest)") instead of cluttering the top-level checks
 # list. The sink-domain modules have their own reusable workflow (sink.yml).
 on:
   workflow_call:
@@ -21,7 +21,6 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go: ["1.25.14", "1.26.6"]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     env:
@@ -30,7 +29,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: ${{ matrix.go }}
+          go-version-file: go.work
           cache-dependency-path: "**/go.sum"
           # Skip the Go cache save on Windows: the tar/zstd cache-save post-step
           # flakes intermittently on windows-latest and fails the job even when

CONTRIBUTING.md

@@ -90,7 +90,7 @@ let them bring their own? If it forces, redesign it as a seam with a no-op defau
 - One shared **golangci-lint** config plus **gofumpt**, **staticcheck**, and
   **govulncheck**, all in CI, with **pinned tool versions** so every contributor
   and CI run uses the same toolchain.
-- **Trunk-based development** with a CI matrix over Go versions × OS, and
+- **Trunk-based development** with a CI matrix over OS, and
   **conventional + signed commits**.
 
 ### Supply chain
@@ -104,7 +104,8 @@ let them bring their own? If it forces, redesign it as a seam with a no-op defau
 
 Requirements:
 
-- **Go**: one of the last two minor releases (see [Supported versions](./SECURITY.md)).
+- **Go**: 1.27.3, the version every `go.mod` and `go.work` declares. CI reads it from
+  `go.work`.
 - **[Mage](https://magefile.org)**: the build tool. Install with
   `go install github.com/magefile/mage@latest`, or run targets via
   `go run github.com/magefile/mage <target>`.
@@ -135,7 +136,7 @@ Run `mage -l` to list everything. Each target iterates the suite's modules.
 
 Before you push, **tests, lint, vet, and `govulncheck` must all pass.** The
 quickest way to verify locally is `mage check`. CI runs the same gates across a
-Go-version × OS matrix on every PR.
+OS matrix on every PR.
 
 Docs-only pull requests (changing only `*.md`, `docs/`, `LICENSE`, or `NOTICE`)
 skip the Go matrix automatically and are gated solely by the aggregate `gate`
@@ -223,7 +224,7 @@ is a tag push; the `Release` workflow does the rest.
 
 4. **The workflow takes over.** On the tag push, `Release` re-runs the full
    validation gate (lint, `-race` tests, `govulncheck`, coverage threshold) for
-   the tagged module across the Go × OS matrix, then publishes a GitHub release
+   the tagged module across the OS matrix, then publishes a GitHub release
    with generated notes. A tag never publishes unless the gate is green.
 
 ## Questions & design

SECURITY.md

@@ -2,13 +2,11 @@
 
 ## Supported versions
 
-Crucible follows Go's own support window. Security fixes are provided for:
+Security fixes are provided for the **latest released version** of each module. Its
+`go.mod` states the Go version it requires, which can be newer than Go's oldest
+supported release.
 
-- The **latest released version** of each module, and
-- Versions that build against the **last two minor releases of Go**.
-
-Older versions and versions built against unsupported Go releases do not receive
-security updates.
+Older versions do not receive security updates.
 
 ## Reporting a vulnerability
 

STABILITY.md

@@ -24,6 +24,11 @@ benchmarked, not stubs. The label is about *contract stability*, not quality: pi
 exact version, read the module's `CHANGELOG.md` before upgrading, and expect the API
 to move until the module graduates to v1.
 
+## Go version
+
+Every module declares the same Go version. Raising it is at least a minor release for
+each module, and the module's changelog says so.
+
 ## Graduation to v1
 
 Promoting an experimental module to v1 means committing to a frozen public contract

cluster/CHANGELOG.md

@@ -7,6 +7,10 @@ and this module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+### Changed
+
+- Requires Go 1.27.3.
+
 ### Added
 
 - **`Supervisor.Forget`.** Discards a supervisor's per-actor restart bookkeeping

cluster/go.mod

@@ -1,7 +1,7 @@
 module github.com/stablekernel/crucible/cluster
 
-go 1.25.11
-toolchain go1.26.4
+go 1.27.3
+
 replace github.com/stablekernel/crucible/state => ../state
 
 require github.com/stablekernel/crucible/state v0.0.0-00010101000000-000000000000

cmd/crucible/CHANGELOG.md

@@ -7,6 +7,10 @@ versioned independently of the `state` module.
 
 ## [Unreleased]
 
+### Changed
+
+- Requires Go 1.27.3.
+
 ### Added
 
 - Machine visualizer: `render -format svg` renders the machine directly to a

cmd/crucible/go.mod

@@ -1,6 +1,6 @@
 module github.com/stablekernel/crucible/cmd/crucible
 
-go 1.25.0
+go 1.27.3
 
 require (
 	github.com/stablekernel/crucible/gen v0.1.0
@@ -22,10 +22,10 @@ require (
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mazznoer/csscolorparser v0.1.5 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/yuin/goldmark v1.7.4 // indirect
+	github.com/yuin/goldmark v1.7.17 // indirect
 	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
 	golang.org/x/image v0.21.0 // indirect
-	golang.org/x/net v0.35.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 )