build(go): update toolchain to Go 1.27

.github/workflows/codeql.yml

@@ -0,0 +1,54 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "31 3 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: go
+            build-mode: manual
+          - language: javascript-typescript
+            build-mode: none
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-and-quality
+
+      - name: Build Go application
+        if: matrix.language == 'go'
+        run: go build ./...
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4

.github/workflows/release.yml

@@ -155,7 +155,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: 1.26.6
+          go-version: 1.27.0
           cache: true
 
       - name: Run GoReleaser

.github/workflows/test.yml

@@ -12,7 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GO_VERSION: "1.26.6"
+  GO_VERSION: "1.27.0"
 
 # Restrict token permissions to minimum required
 permissions:
@@ -31,10 +31,8 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          # v2.12+ ships a staticcheck that understands Go 1.26 control flow.
-          # v2.10's staticcheck mis-analyzed `if x == nil { t.Fatal() }` guards
-          # under GO_VERSION 1.26.4 and emitted false-positive SA5011 warnings.
-          version: v2.12
+          # v2.13+ supports Go 1.27 and bundles a compatible staticcheck.
+          version: v2.13.1
           # The shared analysis cache went bad on 2026-08-25: staticcheck lost
           # t.Fatal no-return facts and every run flagged a different set of
           # SA5011 false positives in untouched files, on PR branches and main

Dockerfile

@@ -1,5 +1,5 @@
 # Build stage — run on the build host's native arch for speed, cross-compile for target
-FROM --platform=$BUILDPLATFORM golang:1.26.6-alpine3.23 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27.0-alpine3.24 AS builder
 
 ARG TARGETOS
 ARG TARGETARCH

Makefile

@@ -13,14 +13,21 @@ SWAGGER_ENABLED ?= true
 # Build tags covering every file the linter and fixers must see. Without these,
 # tag-gated files (tests/e2e, tests/integration, tests/contract) are skipped.
 BUILD_TAGS ?= swagger,e2e,integration,contract
+GOLANGCI_LINT_VERSION := 2.13.1
+GOLANGCI_LINT ?= $(shell go env GOPATH)/bin/golangci-lint
 
 # Linker flags to inject version info
 LDFLAGS := -X "github.com/enterpilot/gomodel/internal/version.Version=$(VERSION)" \
            -X "github.com/enterpilot/gomodel/internal/version.Commit=$(COMMIT)" \
            -X "github.com/enterpilot/gomodel/internal/version.Date=$(DATE)"
 
 install-tools:
-	@command -v golangci-lint > /dev/null 2>&1 || (echo "Installing golangci-lint..." && go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.10)
+	@installed_version="$$($(GOLANGCI_LINT) version 2>/dev/null || true)"; \
+	case "$$installed_version" in \
+		*"version $(GOLANGCI_LINT_VERSION) "*) ;; \
+		*) echo "Installing golangci-lint v$(GOLANGCI_LINT_VERSION)..."; \
+			GOBIN="$(dir $(GOLANGCI_LINT))" go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v$(GOLANGCI_LINT_VERSION) ;; \
+	esac
 	@command -v pre-commit > /dev/null 2>&1 || (echo "Installing pre-commit..." && pip install pre-commit==4.5.1)
 	@echo "All tools are ready"
 
@@ -142,12 +149,12 @@ docs-openapi:
 
 # Run linter
 lint:
-	golangci-lint run --build-tags=$(BUILD_TAGS) ./cmd/... ./config/... ./ext/... ./internal/... ./run/... ./tests/...
+	$(GOLANGCI_LINT) run --build-tags=$(BUILD_TAGS) ./cmd/... ./config/... ./ext/... ./internal/... ./run/... ./tests/...
 
 # Run linter with auto-fix. Mirrors `lint`: same tags, same packages, so the
 # autofix pass cannot silently skip the tag-gated files under tests/.
 lint-fix:
-	golangci-lint run --fix --build-tags=$(BUILD_TAGS) ./cmd/... ./config/... ./ext/... ./internal/... ./run/... ./tests/...
+	$(GOLANGCI_LINT) run --fix --build-tags=$(BUILD_TAGS) ./cmd/... ./config/... ./ext/... ./internal/... ./run/... ./tests/...
 
 # Report modernizations go fix would apply, without touching the tree.
 # Exits non-zero when the tree has drifted; run `make fix` to apply.

docs/.mintignore

@@ -1,6 +1,5 @@
 # Internal engineering material is kept in the repository but is not part of
 # the public product documentation, search index, or AI context.
-2026-03-23_benchmark_scripts/
 2026-04-09_CODEBASE_SNAPSHOT.md
 2026-07-21_bifrost_reproducible_benchmark/
 DEVELOPMENT.md