From a078b954e45dc33586cbdaba1637091856881d87 Mon Sep 17 00:00:00 2001
From: Mat Byczkowski <mbyczkowski@squareup.com>
Date: Mon, 28 Sep 2026 13:02:05 -0700
Subject: [PATCH] Pin the Go version for release builds

---
 .github/workflows/compilecheck.yaml | 7 +++++--
 .github/workflows/release.yaml      | 9 +++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/compilecheck.yaml b/.github/workflows/compilecheck.yaml
index 125a279..67b1f01 100644
--- a/.github/workflows/compilecheck.yaml
+++ b/.github/workflows/compilecheck.yaml
@@ -11,7 +11,9 @@ jobs:
     name: Compile Check
     strategy:
       matrix:
-        version: ['stable']
+        # The Go version release.yaml builds with, so PRs catch problems
+        # before a release is tagged.
+        version: ['1.27.1']
         target:
           - {os: 'darwin', platform: 'macos-latest', arch: 'amd64'}
           - {os: 'linux', platform: 'ubuntu-latest', arch: 'amd64'}
@@ -19,12 +21,13 @@ jobs:
     runs-on: ${{ matrix.target.platform }}
     permissions:
       contents: write
+    env:
+      GOTOOLCHAIN: local
     steps:
       - name: Setup Go environment
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # ratchet:actions/setup-go@v5
         with:
           go-version: ${{ matrix.version }}
-          check-latest: true
         id: go
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ad40ae7..fb6348e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,7 +10,9 @@ jobs:
     name: Build
     strategy:
       matrix:
-        version: ['stable']
+        # The exact Go version for release binaries. Bump it on purpose, for
+        # example for a Go security release, and keep compilecheck.yaml in sync.
+        version: ['1.27.1']
         target:
           - {os: 'darwin', platform: 'macos-latest', arch: 'amd64'}
           - {os: 'darwin', platform: 'macos-latest', arch: 'arm64'}
@@ -20,12 +22,15 @@ jobs:
     runs-on: ${{ matrix.target.platform }}
     permissions:
       contents: write
+    env:
+      # Build with the Go installed below. Without this, Go downloads a newer
+      # toolchain on its own when go.mod requires one.
+      GOTOOLCHAIN: local
     steps:
       - name: Setup Go environment
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # ratchet:actions/setup-go@v5
         with:
           go-version: ${{ matrix.version }}
-          check-latest: true
         id: go
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4