Cdult · Premiermoney · May 31, 2026 · May 22, 2026 · May 22, 2026 · May 25, 2026
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -23,16 +23,16 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           working-directory: eng/_util
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           category: /language:go
diff --git a/README.md b/README.md
@@ -28,32 +28,33 @@ The submodule is updated regularly to the latest commit available in both the up
 
 ## Support
 
-This project follows the upstream Go
-[Release Policy](https://go.dev/doc/devel/release#policy).
-This means we support each major release (1.X) until there are two newer major
-releases. A new Go major version is
-[released every six months](https://github.com/golang/go/wiki/Go-Release-Cycle),
-so each Go major version is supported for about one year.
-
-When upstream Go releases a new minor version (1.X.Y), we release a
-corresponding microsoft/go version that may also include fork-specific changes.
+See [SUPPORT.md](SUPPORT.md) for more information about reporting bugs, requesting features, and asking questions.
+
+There are a few additional support resources internal to Microsoft:
+
+* [(Microsoft-internal) Languages at Microsoft: Introduction to Go](https://eng.ms/docs/more/languages-at-microsoft/go/articles/overview).
+* [(Microsoft-internal) Languages at Microsoft: Get Help with Go](https://eng.ms/docs/more/languages-at-microsoft/go/articles/support).
+  * Includes internal Microsoft support channels such as an email contact for our team and a community Teams group.
+
+## Release cycle and policy
+
+This project follows the upstream Go [Release Policy](https://go.dev/doc/devel/release#policy).
+This means we support each major release (1.X) until there are two newer major releases.
+A new Go major version is [released every six months](https://github.com/golang/go/wiki/Go-Release-Cycle), so each Go major version is supported for about one year.
+
+When upstream Go releases a new minor version (1.X.Y), we release a corresponding microsoft/go version that may also include fork-specific changes.
 This normally happens once a month.
 
 At any time, we may release a new revision (1.X.Y-Z) to fix an issue without waiting for the next upstream minor release.
 Revision releases are uncommon.
 
-Each microsoft/go release is announced at the
-[Microsoft for Go Developers](https://devblogs.microsoft.com/go/) blog.
-Check out the upstream [golang-announce mailing list](https://groups.google.com/g/golang-announce)
-for a summary of the changes in each upstream Go version.
+We announce each Microsoft build of Go release through the following channels:
 
-See [SUPPORT.md](SUPPORT.md) for more information about reporting bugs, requesting features, and asking questions.
-
-There are a few additional support resources internal to Microsoft:
+* [Microsoft for Go Developers blog](https://devblogs.microsoft.com/go/).
+* [Microsoft-internal email distribution list 📧 (instant join link)](https://idwebelements.microsoft.com/GroupManagement.aspx?Group=golang-announce&Operation=join).
 
-* [Languages at Microsoft: Go](https://eng.ms/docs/more/languages-at-microsoft/go/articles/overview).
-* [A Microsoft-internal email distribution list 📧 (instant join link)](https://idwebelements.microsoft.com/GroupManagement.aspx?Group=golang-announce&Operation=join)
-  for release announcements.
+The Go team announces upstream releases on the [golang-announce mailing list](https://groups.google.com/g/golang-announce).
+These announcement emails include a carefully written summary of the changes that may not be found elsewhere.
 
 ## Download and install
 
@@ -76,7 +77,7 @@ The [Installation](eng/doc/Installation.md) documentation contains sections desc
 * [Azure Pipelines `GoTool@0` task](eng/doc/Installation.md#azure-pipelines-gotool0-task)
 * [GitHub Actions `setup-go` action](eng/doc/Installation.md#github-actions-setup-go-action)
 * [The `go-install.ps1` script](eng/doc/Installation.md#the-go-installps1-script)
-* [Binary archive](eng/doc/Installation.md#binary-archive)
+* [Binary archive](eng/doc/Installation.md#binary-archive) (`tar.gz` and `zip`)
 * [Build from source](eng/doc/Installation.md#build-from-source)
 
 ## Contributing

diff --git a/SUPPORT.md b/SUPPORT.md
@@ -4,6 +4,9 @@ For help and questions about the Go programming language and tools, visit the of
 
 Take a look at the [Migration Guide](eng/doc/MigrationGuide.md) for more information about migrating from the official build of Go to the Microsoft build of Go, specifically.
 
+> [!TIP]
+> Additional support options internal to Microsoft are listed in the ["Support" section of the README file](README.md#support).
+
 ## How to file issues and get help
 
 This project uses GitHub Issues to track bugs and feature requests. Please search the existing

diff --git a/eng/_util/go.mod b/eng/_util/go.mod
@@ -8,7 +8,7 @@ go 1.25.0
 
 require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/microsoft/go-infra v0.0.13
+	github.com/microsoft/go-infra v0.0.14
 	github.com/microsoft/go-infra/goinstallscript v1.2.0
 	golang.org/x/net v0.55.0
 )

diff --git a/eng/_util/go.sum b/eng/_util/go.sum
@@ -31,8 +31,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5 h1:YH424zrwLTlyHSH/GzLMJeu5zhYVZSx5RQxGKm1h96s=
 github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5/go.mod h1:PoGiBqKSQK1vIfQ+yVaFcGjDySHvym6FM1cNYnwzbrY=
-github.com/microsoft/go-infra v0.0.13 h1:s7ymSsDJagh35CYuJDc8GJdBqtZ5sE696oi7mxRMnvI=
-github.com/microsoft/go-infra v0.0.13/go.mod h1:+NF5K79FJNpFKRPX7J9g9tZ2NFZa9dM751xWPpF3IgY=
+github.com/microsoft/go-infra v0.0.14 h1:JfMAEtUWk2sAKNyYirdph8BoKrjCKlt/vMloBy70rtg=
+github.com/microsoft/go-infra v0.0.14/go.mod h1:+NF5K79FJNpFKRPX7J9g9tZ2NFZa9dM751xWPpF3IgY=
 github.com/microsoft/go-infra/goinstallscript v1.2.0 h1:ArYnZHsmv0jnpeDZdFACBUxSmhmYl+Vof8sfk19aYZI=
 github.com/microsoft/go-infra/goinstallscript v1.2.0/go.mod h1:SFsdKAEHdmGsGoh8FkksVaxoQ3rnnJ/TBqN09Ml/0Cw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=

diff --git a/eng/doc/AdditionalFeatures.md b/eng/doc/AdditionalFeatures.md
@@ -11,7 +11,8 @@ If it's critical to you to understand the exact implementation details of all ch
 
 The Microsoft build of Go collects [opt-out (enabled by default) toolset telemetry](https://devblogs.microsoft.com/go/microsoft-go-telemetry/).
 
-See the [Data Collection policy for the Microsoft build of Go](/README.md#data-collection).
+See the [Telemetry documentation](/eng/doc/Telemetry.md) for details on what is collected and how to opt out.
+See also the [Data Collection policy for the Microsoft build of Go](/README.md#data-collection).
 
 ## System-provided cryptography backend
 

diff --git a/eng/doc/MigrationGuide.md b/eng/doc/MigrationGuide.md
@@ -8,7 +8,8 @@ It's a fork, and some runtime behavior slightly differs, but in most cases it ha
 We expect that most projects don't require any Go code changes to work with the Microsoft build of Go.
 
 Note that the Microsoft build of Go has [toolset telemetry enabled by default](https://devblogs.microsoft.com/go/microsoft-go-telemetry/) (opt-out telemetry).
-See [the Data Collection policy for the Microsoft build of Go](/README.md#data-collection).
+See the [Telemetry documentation](/eng/doc/Telemetry.md) for details on what is collected and how to opt out.
+See also [the Data Collection policy for the Microsoft build of Go](/README.md#data-collection).
 
 ## Quick start
 

diff --git a/eng/doc/README.md b/eng/doc/README.md
@@ -1,9 +1,23 @@
-This directory, `/eng/doc`, contains documents describing the Microsoft
-infrastructure used to build Go, in particular any designs that are not obvious
-by reading the infrastructure code itself.
+# `/eng/doc` - Documentation for the Microsoft build of Go
 
-For cryptography information, see the [CrossPlatformCryptography.md](CrossPlatformCryptography.md) doc.
-For dev scenario documentation, see the [DeveloperGuide.md](DeveloperGuide.md) doc.
+This directory, `/eng/doc`, contains detailed documents describing the Microsoft build of Go.
 
-The [Downloads.md](Downloads.md) doc contains a table of links to the latest assets for each supported Go release branch.
-The [release-branch-links.json](release-branch-links.json) file contains the same data in JSON format suitable for parsing.
+> [!IMPORTANT]
+> These documents are only actively maintained in the `microsoft/main` branch.
+> If you're viewing this file in a release branch, it may be stale.
+> [If you're not sure, click here to go to the maintained version of this document.](https://github.com/microsoft/go/blob/microsoft/main/eng/doc/README.md)
+
+## Setup
+
+* [Migration Guide](MigrationGuide.md)
+* [Installation](Installation.md)
+  * [Downloading a binary release](Downloads.md)
+* [Developer Guide](DeveloperGuide.md) (for new contributors to the Microsoft build of Go)
+
+## Features
+
+* [Additional Features Provided by the Microsoft build of Go](AdditionalFeatures.md)
+* [Cross-Platform Cryptography in the Microsoft build of Go](CrossPlatformCryptography.md)
+* [Microsoft Toolset Identification](MicrosoftToolsetIdentification.md)
+* [No-cgo OpenSSL Backend](NocgoOpenSSL.md)
+* [Telemetry in the Microsoft build of Go](Telemetry.md)
diff --git a/eng/doc/Telemetry.md b/eng/doc/Telemetry.md
@@ -0,0 +1,82 @@
+# Telemetry in the Microsoft build of Go
+
+The Microsoft build of Go collects opt-out (enabled by default) toolset telemetry.
+Telemetry is sent to Microsoft via Azure Application Insights when `go build`, `go install`, or `go run` is executed.
+No telemetry is collected for other `go` subcommands (e.g. `go test`, `go vet`, `go fmt`).
+
+For the blog post announcing this feature, see [Microsoft build of Go Telemetry](https://devblogs.microsoft.com/go/microsoft-go-telemetry/).
+
+## What is collected
+
+Telemetry data consists of **counters** (simple event names that are incremented) and **properties** (key-value custom dimensions attached to a counter event).
+No source code, file paths, module contents, or personally identifiable information is collected.
+Each telemetry session is assigned a random session ID that cannot be linked back to a user.
+
+The counters and properties collected are defined in the [telemetry upload configuration](https://github.com/microsoft/go-infra/blob/main/telemetry/config/config.json) and are listed below.
+
+### Invocation counter
+
+| Counter | Description |
+|---|---|
+| `go/invocations` | Incremented once per `go` command invocation. |
+
+#### Properties on `go/invocations`
+
+| Property | Description |
+|---|---|
+| `msgo/module/hash` | A SHA-256 hash of the Go module path from the nearest `go.mod` file, found using [`modload.FindGoMod`](https://pkg.go.dev/cmd/go/internal/modload#FindGoMod). Only sent when a `go.mod` file is found. |
+
+### Subcommand
+
+| Counter | Description |
+|---|---|
+| `go/subcommand:{build,install,run}` | Which subcommand was used. |
+
+### Target platform
+
+| Counter | Description |
+|---|---|
+| `go/platform/target/port:<GOOS>-<GOARCH>` | The target platform port (e.g. `linux-amd64`, `windows-arm64`). |
+| `go/cgo:{enabled,disabled}` | Whether cgo was enabled for the build. |
+
+### GOEXPERIMENT settings
+
+| Counter | Description |
+|---|---|
+| `go/goexperiment:<name>` | Each active `GOEXPERIMENT` value that differs from the baseline. Only Microsoft-specific experiments are uploaded: `systemcrypto`, `nosystemcrypto`, `opensslcrypto`, `cngcrypto`, `darwincrypto`, `ms_nocgo_opensslcrypto`, and `ms_tls_config_schannel`. |
+
+### CI environment detection
+
+| Counter | Description |
+|---|---|
+| `msgo/ci:<provider>` | Detected CI provider, if any. Values: `azdo`, `github`, `gitlab`, `appveyor`, `travis`, `circleci`, `aws_codebuild`, `jenkins`, `teamcity`, `google_cloud_build`. Detection is based on well-known environment variables set by each CI system. |
+
+### System cryptography
+
+| Counter | Description |
+|---|---|
+| `msgo/systemcrypto:{enabled,disabled}` | Whether the system cryptography backend is enabled on platforms that support it. |
+
+## What is NOT collected
+
+- No source code or file contents.
+- No file paths from the local file system.
+- No textual module names or paths (a one-way SHA-256 hash of the module path is collected).
+- No environment variable values (only the presence of specific CI-related variables is checked).
+- No network or authentication information.
+- No personally identifiable information (PII).
+
+## How to opt out
+
+Set the `MS_GOTOOLCHAIN_TELEMETRY_ENABLED` environment variable to `0`.
+
+This completely disables Microsoft telemetry collection. When disabled, no data is sent to Application Insights.
+
+> [!NOTE]
+> This setting only controls Microsoft-specific telemetry. The upstream Go toolchain has its own [telemetry system](https://go.dev/doc/telemetry) controlled separately via `go telemetry`.
+
+## Privacy
+
+Microsoft's privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704.
+
+See the [Data Collection policy](/README.md#data-collection) in the repository README for more information.
diff --git a/eng/pipeline/stages/builders-to-stages.yml b/eng/pipeline/stages/builders-to-stages.yml
@@ -8,7 +8,7 @@ parameters:
   - name: ctx
     type: object
 
-  # [] of { id, os, arch, hostarch, config, distro?, experiment?, broken? }
+  # [] of { id, os, arch, hostArch, config, distro?, experiment?, nosystemcrypto?, fips?, broken? }
   - name: builders
     type: object
   # If true, include a signing stage+job that depends on all 'buildandpack' builder jobs finishing.