From 47f295d864e866f5e9725ea55aa2fbdd7208ab015b56cd613f5d3ccabe9958b8 Mon Sep 17 00:00:00 2001
From: "CTO (Paperclip)" <cto@basicstack.de>
Date: Sun, 25 Oct 2026 19:59:05 +0000
Subject: [PATCH] ci: bump Go image to 1.26-alpine for signing-service dep

signing-service depends on github.com/open-policy-agent/opa v1.21.4,
which requires Go >= 1.26.0. The CI Go image and the signing-service
Dockerfile were still pinned to golang:1.23-alpine3.21, so the
"Go (vet + test)" job and the signing-service image build both
failed on main as soon as [DEV-609](/DEV/issues/DEV-609) landed:

    go: module ../signing-service requires go >= 1.26.0
         (running go 1.23.12; GOTOOLCHAIN=local)

Fix: pin both to golang:1.26-alpine3.23 (oldest alpine tag that
exists for the 1.26 line). All other modules declare go 1.23 which
1.26 still accepts, so no downstream churn.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .forgejo/workflows/validate.yml     | 4 +++-
 services/signing-service/Dockerfile | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
index 3bbc850..b12e563 100644
--- a/.forgejo/workflows/validate.yml
+++ b/.forgejo/workflows/validate.yml
@@ -119,7 +119,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       # Alpine image: git 2.45+, speaks sha256 wire protocol; small footprint.
-      image: golang:1.23-alpine3.21
+      # Pinned to 1.26 because signing-service depends on
+      # github.com/open-policy-agent/opa v1.21.4 which requires Go >= 1.26.0.
+      image: golang:1.26-alpine3.23
     steps:
       - name: Install git + bash in container
         run: |
diff --git a/services/signing-service/Dockerfile b/services/signing-service/Dockerfile
index 47d79d8..70b1b77 100644
--- a/services/signing-service/Dockerfile
+++ b/services/signing-service/Dockerfile
@@ -1,7 +1,9 @@
 # syntax=docker/dockerfile:1.7
 
 # ---------- build ----------
-FROM golang:1.23-alpine3.21 AS build
+# Pinned to 1.26 because this module depends on
+# github.com/open-policy-agent/opa v1.21.4 which requires Go >= 1.26.0.
+FROM golang:1.26-alpine3.23 AS build
 
 ENV CGO_ENABLED=0 \
     GOOS=linux \