BUILD/MINOR: ci: build and check everything with Go 1.27

The format job runs `go fix`, whose rewrites differ between Go releases,
so an image floating on the latest release could fail a tree that was
formatted locally. Instead of pinning only that job, move the whole
project to one toolchain: go.mod requires 1.27, every GitLab job uses
the 1.27 image through a single GO_VERSION variable (the e2e job no
longer overrides it), and every GitHub job reads the version from go.mod.
Print the diff when the tidy and format checks fail so the cause is
visible in the log, and apply the rewrite the 1.27 toolchain produces.

Author: oktalz

.github/workflows/ci.yml

@@ -40,7 +40,12 @@ jobs:
       - name: tidy
         run: go mod tidy
       - name: changes
-        run: test -z "$(git diff 2> /dev/null)" || exit "Go modules not tidied, issue \`go mod tidy\` and commit the result"
+        run: |
+          if ! git diff --quiet; then
+            echo "Go modules not tidied, issue \`go mod tidy\` and commit the result" >&2
+            git diff
+            exit 1
+          fi
   format:
     name: gofumpt
     runs-on: ubuntu-latest
@@ -51,6 +56,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: Allow Go toolchain downloads
         run: echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
       - name: Install Task
@@ -61,7 +67,12 @@ jobs:
       - name: format
         run: task format
       - name: changes
-        run: test -z "$(git diff 2> /dev/null)" || exit "Go code not formatted, issue \`task format\` and commit the result"
+        run: |
+          if ! git diff --quiet; then
+            echo "Go code not formatted, issue \`task format\` and commit the result" >&2
+            git diff
+            exit 1
+          fi
   lint:
     name: lint
     needs: ["tidy", "format"]

.gitlab-ci.yml

@@ -17,6 +17,8 @@ stages:
   - build
 variables:
   HAPROXY_REGISTRY_GO: "registry.haproxy.com/gophers"
+  # One toolchain for every job, matching go.mod: `go fix` output differs between releases.
+  GO_VERSION: "1.27"
   JUNIT_FILE: "junit-report.xml"
   GOTESTSUM_JUNITFILE: "junit-report.xml"
 

.gitlab/build.yml

@@ -3,7 +3,7 @@ build:
   needs: []
   extends: .all-pipelines
   image:
-    name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
+    name: $HAPROXY_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go

.gitlab/lint.yml

@@ -3,15 +3,19 @@ tidy:
   needs: []
   extends: .all-pipelines
   image:
-    name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
+    name: $HAPROXY_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go
   before_script:
     - go version
   script:
     - go mod tidy
-    - test -z "$(git diff 2> /dev/null)" || exit 'Go modules not tidied, issue \`go mod tidy\` and commit the result'
+    - |
+      if ! git diff --quiet; then
+        echo 'Go modules not tidied, issue `go mod tidy` and commit the result' >&2
+        exit 1
+      fi
   after_script:
     - |
       if [ "$CI_JOB_STATUS" == "success" ]; then
@@ -30,15 +34,19 @@ format:
   needs: []
   extends: .all-pipelines
   image:
-    name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
+    name: $HAPROXY_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go
   before_script:
     - go version
   script:
     - task format
-    - test -z "$(git diff 2> /dev/null)" || exit 'Go code not formatted, issue \`task format\` and commit the result'
+    - |
+      if ! git diff --quiet; then
+        echo 'Go code not formatted, issue `task format` and commit the result' >&2
+        exit 1
+      fi
   after_script:
     - |
       if [ "$CI_JOB_STATUS" == "success" ]; then
@@ -58,7 +66,7 @@ lint:
   needs: []
   extends: .all-pipelines
   image:
-    name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
+    name: $HAPROXY_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go

.gitlab/security.yml

@@ -3,7 +3,7 @@ license:
   needs: ["tidy"]
   extends: .all-pipelines
   image:
-    name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
+    name: $HAPROXY_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go
@@ -27,7 +27,7 @@ govulncheck:
   needs: []
   extends: .all-pipelines
   image:
-    name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
+    name: $HAPROXY_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go

.gitlab/test.yml

@@ -16,7 +16,6 @@ test-e2e:
   variables:
     DOCKER_HOST: tcp://docker:2375
     DOCKER_DRIVER: overlay2
-    GO_VERSION: "1.26"
     DOCKER_VERSION: "29.1"
     # dind resolves `docker run -v` paths on its own filesystem; only /builds
     # is shared with the job container, so bind-mounted test dirs must live
@@ -40,7 +39,7 @@ test:
   needs: []
   extends: .all-pipelines
   image:
-    name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
+    name: $HAPROXY_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go

go.mod

@@ -1,3 +1,3 @@
 module github.com/haproxytech/gopherd
 
-go 1.26
+go 1.27

service/user_test.go

@@ -316,7 +316,7 @@ func TestStrictGroupsNeedsAnExplicitGroup(t *testing.T) {
 	}
 	// Append atomically: write the new content to a sibling and rename over.
 	updated := append(append([]byte{}, original...),
-		[]byte(fmt.Sprintf("%s:x:%d:root\n", extraName, extraGID))...)
+		fmt.Appendf(nil, "%s:x:%d:root\n", extraName, extraGID)...)
 	tmp := groupFile + ".gopherd-test"
 	if err := os.WriteFile(tmp, updated, 0o644); err != nil {
 		t.Skipf("cannot stage %s: %v", tmp, err)