From 426e41b0f4bcd575a1e2a9574b7561ea88787aa4 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 09:23:34 +0300 Subject: [PATCH 1/5] cascade: pass CHANGELOG_SECRET so auto-bumps get LLM changelogs Org-wide CHANGELOG_SECRET was never forwarded to the reusable tag-bump workflow, so its auto-changelog step silently skipped on every cascade bump. Matches trustedagents, the one repo already wired. Co-Authored-By: Claude Fable 5 --- .github/workflows/cascade.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/cascade.yml b/.github/workflows/cascade.yml index 7891ee2..2a6182c 100644 --- a/.github/workflows/cascade.yml +++ b/.github/workflows/cascade.yml @@ -34,3 +34,5 @@ jobs: version: ${{ inputs.version || github.event.client_payload.version }} is_prerelease: ${{ inputs.is_prerelease == true || github.event.client_payload.is_prerelease == true }} stable_only: true + secrets: + CHANGELOG_SECRET: ${{ secrets.CHANGELOG_SECRET }} From da1ab09143f7b1ba7e32f454cd9b7c4d4eb0096d Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 09:42:07 +0300 Subject: [PATCH 2/5] go.mod: bump go directive to 1.25.12 (GO-2026-5856 + web4 v1.12.5 sibling constraint) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck flags GO-2026-5856 (crypto/tls, fixed in go1.25.12), and CI runs GOTOOLCHAIN=local with the sibling web4 checkout now requiring go >= 1.25.12 — same bump web4 shipped in v1.12.5. Co-Authored-By: Claude Fable 5 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 845b8e5..96eb0d4 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/pilot-protocol/rendezvous -go 1.25.11 +go 1.25.12 require github.com/pilot-protocol/common v0.5.7 From a05b6ec5bda94e886d33b0235760d012229fbf42 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 10:10:07 +0300 Subject: [PATCH 3/5] ci: track go toolchain from go.mod instead of pinning 1.25 go-version: '1.25' resolves to the runner's cached 1.25.11 while GOTOOLCHAIN=local forbids auto-upgrade, so the go.mod 1.25.12 bump (GO-2026-5856) fails every job. go-version-file keeps CI in lockstep with the module. Co-Authored-By: Claude Fable 5 --- .github/workflows/security.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 805609f..72b4077 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -30,7 +30,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25.11' + go-version-file: go.mod cache: true - name: Initialize CodeQL @@ -60,7 +60,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25.11' + go-version-file: go.mod cache: true - name: Run gosec @@ -88,7 +88,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25.11' + go-version-file: go.mod cache: true - name: Run govulncheck From aff6e32117f2a6ccf04e55f7d8dc594bb387fefc Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 10:10:23 +0300 Subject: [PATCH 4/5] ci: track go toolchain from go.mod instead of pinning 1.25 Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 94cb613..1427e3c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/setup-go@v6.5.0 with: - go-version: '1.25' + go-version-file: go.mod cache: true cache-dependency-path: rendezvous/go.sum From 82f04b16dca46717595ae7c17c66530abd8b75c1 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 10:14:27 +0300 Subject: [PATCH 5/5] ci: go-version-file must point into the subdir checkout This job checks the repo out at path: rendezvous, so go.mod lives at rendezvous/go.mod, not the workspace root. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1427e3c..e9400fb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/setup-go@v6.5.0 with: - go-version-file: go.mod + go-version-file: rendezvous/go.mod cache: true cache-dependency-path: rendezvous/go.sum