Merge pull request #380 from square/mbyczkowski/pin-release-go-version

Pin the Go version for release builds

.github/workflows/compilecheck.yaml

@@ -11,7 +11,9 @@ jobs:
     name: Compile Check
     strategy:
       matrix:
-        version: ['stable']
+        # The Go version release.yaml builds with, so PRs catch problems
+        # before a release is tagged.
+        version: ['1.27.1']
         target:
           - {os: 'darwin', platform: 'macos-latest', arch: 'amd64'}
           - {os: 'linux', platform: 'ubuntu-latest', arch: 'amd64'}
@@ -19,12 +21,13 @@ jobs:
     runs-on: ${{ matrix.target.platform }}
     permissions:
       contents: write
+    env:
+      GOTOOLCHAIN: local
     steps:
       - name: Setup Go environment
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # ratchet:actions/setup-go@v5
         with:
           go-version: ${{ matrix.version }}
-          check-latest: true
         id: go
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4

.github/workflows/release.yaml

@@ -10,7 +10,9 @@ jobs:
     name: Build
     strategy:
       matrix:
-        version: ['stable']
+        # The exact Go version for release binaries. Bump it on purpose, for
+        # example for a Go security release, and keep compilecheck.yaml in sync.
+        version: ['1.27.1']
         target:
           - {os: 'darwin', platform: 'macos-latest', arch: 'amd64'}
           - {os: 'darwin', platform: 'macos-latest', arch: 'arm64'}
@@ -20,12 +22,15 @@ jobs:
     runs-on: ${{ matrix.target.platform }}
     permissions:
       contents: write
+    env:
+      # Build with the Go installed below. Without this, Go downloads a newer
+      # toolchain on its own when go.mod requires one.
+      GOTOOLCHAIN: local
     steps:
       - name: Setup Go environment
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # ratchet:actions/setup-go@v5
         with:
           go-version: ${{ matrix.version }}
-          check-latest: true
         id: go
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4