From 56800a22cbdfd6f692a8fdbb82377af382e8c6da Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 09:22:46 +0300 Subject: [PATCH 1/4] cascade: pass CHANGELOG_SECRET so auto-bumps get LLM changelogs Org-wide CHANGELOG_SECRET was never forwarded to the reusable tag-bump workflow, so its auto-changelog step silently skipped on every cascade bump. Matches trustedagents, the one repo already wired. Co-Authored-By: Claude Fable 5 --- .github/workflows/cascade.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/cascade.yml b/.github/workflows/cascade.yml index 7891ee2..2a6182c 100644 --- a/.github/workflows/cascade.yml +++ b/.github/workflows/cascade.yml @@ -34,3 +34,5 @@ jobs: version: ${{ inputs.version || github.event.client_payload.version }} is_prerelease: ${{ inputs.is_prerelease == true || github.event.client_payload.is_prerelease == true }} stable_only: true + secrets: + CHANGELOG_SECRET: ${{ secrets.CHANGELOG_SECRET }} From f22cff5d4ef15a816731e9e3b8a21193f4dda1e7 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 09:42:02 +0300 Subject: [PATCH 2/4] go.mod: bump go directive to 1.25.12 (GO-2026-5856 + web4 v1.12.5 sibling constraint) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck flags GO-2026-5856 (crypto/tls, fixed in go1.25.12), and CI runs GOTOOLCHAIN=local with the sibling web4 checkout now requiring go >= 1.25.12 — same bump web4 shipped in v1.12.5. Co-Authored-By: Claude Fable 5 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 954e2fc..475b0ee 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/pilot-protocol/handshake -go 1.25.10 +go 1.25.12 require ( github.com/pilot-protocol/pilotprotocol v0.0.0 From 71a83e7027ade059bff2908399125473a7e7502e Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 10:09:31 +0300 Subject: [PATCH 3/4] ci: track go toolchain from go.mod instead of pinning 1.25 go-version: '1.25' resolves to the runner's cached 1.25.11 while GOTOOLCHAIN=local forbids auto-upgrade, so the go.mod 1.25.12 bump (GO-2026-5856) fails every job. go-version-file keeps CI in lockstep with the module. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2618c5a..6530f05 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -116,7 +116,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.25' + go-version-file: go.mod cache: true cache-dependency-path: handshake/go.sum From 8a701f192de2f217e6dd643c87ae3e29165a4ce6 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 10:14:18 +0300 Subject: [PATCH 4/4] ci: go-version-file must point into the subdir checkout This job checks the repo out at path: handshake, so go.mod lives at handshake/go.mod, not the workspace root. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6530f05..924eca3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -116,7 +116,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version-file: go.mod + go-version-file: handshake/go.mod cache: true cache-dependency-path: handshake/go.sum