Conversation
📝 WalkthroughWalkthroughThe pull request updates the Go toolchain version requirement across the project from 1.23 (or 1.22) to 1.26.2. Changes span configuration files, Dockerfiles, go.mod files, documentation, and minor test adjustments, reflecting a comprehensive version upgrade for build and development environments. Changes
Poem
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.11.4)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Comment |
maxim-inj
force-pushed
the
chore/bump-go1.26.2
branch
2 times, most recently
from
1d3e4dd to
23b1edf
Compare
There was a problem hiding this comment.
Pull request overview
Updates the repository’s Go toolchain baseline to Go 1.26.2, aligning CI, Docker build images, and documentation with the new version while addressing a couple of test-related adjustments.
Changes:
- Bump Go version references across modules/workspace, CI env, and Docker-based tooling.
- Update docs/tutorials and README minimum requirements to reflect the new Go version.
- Minor test updates (websocket status formatting and a longer timeout for evidence commit in CI/race runs).
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| test/docker/Dockerfile | Updates the test Docker image to Go 1.26.2. |
| scripts/proto-gen.sh | Updates the Dockerized proto generation environment to Go 1.26 (alpine). |
| rpc/jsonrpc/server/ws_handler_test.go | Adjusts websocket dial response assertion formatting. |
| README.md | Updates stated Go minimum/tested versions for main and v1.x. |
| internal/consensus/byzantine_test.go | Increases evidence commit timeout to reduce CI flakiness. |
| go.work | Updates workspace Go version. |
| go.mod | Updates root module Go version. |
| docs/tutorials/go.md | Updates tutorial example go.mod Go version line. |
| docs/tutorials/go-built-in.md | Updates tutorial example go.mod Go version line. |
| DOCKER/Dockerfile | Updates build arg base image to Go 1.26 (alpine). |
| api/go.mod | Updates API module Go version. |
| .github/workflows/go-version.env | Updates CI Go version to 1.26.2. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| go 1.26.2 | ||
|
|
There was a problem hiding this comment.
The new go directive is set to a patch version (1.26.2). If the goal is to require the Go 1.26 language version while pinning the toolchain to a specific patch release, consider switching to go 1.26 and adding a toolchain go1.26.2 directive instead. This tends to be more compatible with tooling that parses the go directive and makes the patch pin explicit.
| go 1.26.2 | |
| go 1.26 | |
| toolchain go1.26.2 |
| @@ -1,4 +1,4 @@ | |||
| go 1.23.9 | |||
| go 1.26.2 | |||
There was a problem hiding this comment.
go.work also pins the go directive to a patch version (1.26.2). Consider aligning with go 1.26 plus a toolchain go1.26.2 directive (if patch-level pinning is desired) to keep the workspace consistent with typical Go toolchain expectations.
| go 1.26.2 | |
| go 1.26 | |
| toolchain go1.26.2 |
| module github.com/cometbft/cometbft/api | ||
|
|
||
| go 1.23 | ||
| go 1.26.2 |
There was a problem hiding this comment.
The api module’s go directive is set to 1.26.2. Consider using go 1.26 and (optionally) a toolchain go1.26.2 directive to avoid coupling the language version to a patch release and to stay compatible with tools that expect the go directive to be major.minor.
| go 1.26.2 | |
| go 1.26 | |
| toolchain go1.26.2 |
| # Run inside Docker to install the correct versions of the required tools | ||
| # without polluting the local system. | ||
| docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.22-alpine sh <<"EOF" | ||
| docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.26-alpine sh <<"EOF" | ||
| apk add git make | ||
|
|
||
| go install github.com/bufbuild/buf/cmd/buf |
There was a problem hiding this comment.
The proto generation script now runs in golang:1.26-alpine, which will float to the latest 1.26.x patch over time. If this PR intends to pin to Go 1.26.2, consider using a fully pinned image tag (e.g., 1.26.2-alpine*) or deriving the tag from a single version source to keep generated output reproducible.
| # Use a build arg to ensure that both stages use the same, | ||
| # hopefully current, go version. | ||
| ARG GOLANG_BASE_IMAGE=golang:1.23-alpine | ||
| ARG GOLANG_BASE_IMAGE=golang:1.26-alpine |
There was a problem hiding this comment.
GOLANG_BASE_IMAGE is set to golang:1.26-alpine, which will drift to newer 1.26.x patch versions. If you want deterministic builds aligned with the repo’s Go version pin, consider switching to a patch-pinned tag (1.26.2-alpine*) or documenting why a floating minor tag is preferred.
| ARG GOLANG_BASE_IMAGE=golang:1.26-alpine | |
| ARG GOLANG_BASE_IMAGE=golang:1.26.2-alpine |
| | CometBFT version | Requirement | Version | Tested with | | ||
| |------------------|-------------|----------------|--------------| | ||
| | main | Go version | 1.23 or higher | up to 1.23.6 | | ||
| | v1.x | Go version | 1.23 or higher | up to 1.23.1 | | ||
| | v0.38.x | Go version | 1.22 or higher | up to 1.22 | | ||
| | v0.37.x | Go version | 1.22 or higher | up to 1.22 | | ||
| | v0.34.x | Go version | 1.22 or higher | up to 1.22 | | ||
| | v1.x-inj | Go version | 1.26 or higher | up to 1.26.2 | | ||
|
|
There was a problem hiding this comment.
The minimum Go requirement is now stated as 1.26.2 or higher. If the intent is to require the Go 1.26 language version but simply test/pin CI to 1.26.2, consider changing the requirement to 1.26 or higher and leaving Tested with as up to 1.26.2 to avoid implying a patch-level minimum.
| module kvstore | ||
|
|
||
| go 1.23 | ||
| go 1.26.2 |
There was a problem hiding this comment.
This tutorial’s example go.mod shows go 1.26.2. If you’re aiming for a language version declaration rather than a patch pin, consider using go 1.26 here (and optionally document toolchain pinning separately) so the example matches typical go mod init output and avoids implying patch-level requirements.
| go 1.26.2 | |
| go 1.26 |
| module kvstore | ||
|
|
||
| go 1.23 | ||
| go 1.26.2 |
There was a problem hiding this comment.
This tutorial’s example go.mod shows go 1.26.2. Consider using go 1.26 (and, if needed, a separate toolchain pin) so the example reflects the language version declaration and doesn’t suggest that users must specify a patch in the go directive.
| go 1.26.2 | |
| go 1.26 |
| if got, want := dialResp.StatusCode, http.StatusSwitchingProtocols; got != want { | ||
| t.Errorf("dialResp.StatusCode = %q, want %q", got, want) | ||
| t.Errorf("dialResp.StatusCode = %d, want %d", got, want) | ||
| } |
There was a problem hiding this comment.
The if block is indented one level too deep, which looks like it missed gofmt and may fail formatting/lint checks. Please re-run gofmt (or fix indentation) so this aligns with the surrounding block.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
test/docker/Dockerfile (1)
1-1: Run container as non-root to tighten test image security posture.The Dockerfile currently executes as root; add a dedicated unprivileged user before runtime steps.
Proposed hardening change
FROM golang:1.26.2 +RUN useradd -m -u 10001 cometbft @@ WORKDIR $REPO @@ COPY . $REPO +RUN chown -R cometbft:cometbft $REPO +USER cometbft🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@test/docker/Dockerfile` at line 1, The Dockerfile is running as root; create a dedicated unprivileged user and switch to it before runtime steps to improve security: add steps to create a non-root user/group (e.g., "tester") with a fixed UID/GID, create and chown the WORKDIR to that user, and set USER to that unprivileged account so subsequent build/runtime commands do not run as root; ensure any files or directories required at runtime are owned by that user.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@DOCKER/Dockerfile`:
- Line 3: The Docker Go base image tag is unpinned; update the ARG
GOLANG_BASE_IMAGE definition (ARG GOLANG_BASE_IMAGE=golang:1.26-alpine) to the
immutable patch version golang:1.26.2-alpine to match go.mod and ensure
reproducible builds, and make the same change in scripts/proto-gen.sh (the
golang image reference on line 13) so both Dockerfile ARG and the script use
golang:1.26.2-alpine.
In `@docs/tutorials/go-built-in.md`:
- Line 145: Replace the incorrect Go version string in the tutorial example:
change the line currently showing "go 1.26.2" to the actual output produced by
`go mod init` for Go 1.26, i.e., "go 1.25.0", and update any adjacent example
text that references the Go version to keep the doc consistent (search for the
exact token "go 1.26.2" in docs/tutorials/go-built-in.md and replace it with "go
1.25.0").
In `@docs/tutorials/go.md`:
- Line 140: The tutorial's go.mod example lists "go 1.26.2" which conflicts with
the default module directive emitted by Go 1.26.x; update the directive in the
example from "go 1.26.2" to "go 1.25.0" so the shown go directive matches the
output of `go mod init` on Go 1.26.x and avoids confusing readers.
In `@README.md`:
- Line 65: Update the README table entry that currently reads "1.26 or higher"
(the row containing "v1.x-inj | Go version | 1.26 or higher | up to 1.26.2") to
explicitly require "1.26.2 or higher" (or ">= 1.26.2") so it matches the go
version declared in go.mod and api/go.mod; ensure the wording exactly matches
the module requirement to avoid confusion.
In `@scripts/proto-gen.sh`:
- Line 13: The Docker image tag used in the proto-gen script ("docker run ...
golang:1.26-alpine sh") is too loose and may pull different patch versions;
update that image reference to the exact Go patch version used in go.mod
(golang:1.26.2-alpine) so the script is pinned for reproducible builds — replace
the "golang:1.26-alpine" token in the docker run invocation with
"golang:1.26.2-alpine".
---
Nitpick comments:
In `@test/docker/Dockerfile`:
- Line 1: The Dockerfile is running as root; create a dedicated unprivileged
user and switch to it before runtime steps to improve security: add steps to
create a non-root user/group (e.g., "tester") with a fixed UID/GID, create and
chown the WORKDIR to that user, and set USER to that unprivileged account so
subsequent build/runtime commands do not run as root; ensure any files or
directories required at runtime are owned by that user.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 254334c6-7158-4a24-8f77-0639c6d65ee7
⛔ Files ignored due to path filters (1)
go.workis excluded by!**/*.work
📒 Files selected for processing (11)
.github/workflows/go-version.envDOCKER/DockerfileREADME.mdapi/go.moddocs/tutorials/go-built-in.mddocs/tutorials/go.mdgo.modinternal/consensus/byzantine_test.gorpc/jsonrpc/server/ws_handler_test.goscripts/proto-gen.shtest/docker/Dockerfile
| # Use a build arg to ensure that both stages use the same, | ||
| # hopefully current, go version. | ||
| ARG GOLANG_BASE_IMAGE=golang:1.23-alpine | ||
| ARG GOLANG_BASE_IMAGE=golang:1.26-alpine |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check for unpinned 1.26 image tags that may violate go.mod minimum.
rg -n 'golang:1\.26-alpine|golang:1\.26(\D|$)|go 1\.26\.2' DOCKER/Dockerfile scripts/proto-gen.sh go.mod api/go.mod .github/workflows/go-version.envRepository: InjectiveLabs/cometbft
Length of output: 267
🏁 Script executed:
#!/bin/bash
# Verify Docker golang image tagging and check proto-gen.sh context
echo "=== Checking scripts/proto-gen.sh context ==="
cat -n scripts/proto-gen.sh | head -20
echo -e "\n=== Full Dockerfile for context ==="
cat -n DOCKER/Dockerfile
echo -e "\n=== Checking if there are any other golang image references ==="
rg 'golang:' --type dockerfile --type sh --type bashRepository: InjectiveLabs/cometbft
Length of output: 3294
🌐 Web query:
Docker golang:1.26 tag latest patch version resolution
💡 Result:
In the official Docker golang image, the tag golang:1.26 is a shared tag that resolves to the latest patch version of Go 1.26 for the default variant (primarily 1.26.x-trixie across architectures). It follows Docker Official Images policy where minor version tags like 1.26 are aliased to the current latest patch (e.g., currently 1.26.2 as of recent updates, previously 1.26.1). This tag is mutable and updates when maintainers push new images for newer patches in the 1.26 series, allowing users to pull the latest security/patch updates without changing their Dockerfile tag. The latest tag points to the overall newest Go version (currently 1.26.2 shared). Specific full tags like 1.26.2-bookworm are immutable to exact versions.
Citations:
- 1: https://hub.docker.com/r/library/golang/tags/
- 2: https://github.com/docker-library/official-images/blob/master/library/golang
- 3: https://hub.docker.com/_/golang/
- 4: https://pkg.go.dev/github.com/docker-library/official-images
- 5: https://github.com/docker/stackbrew
🏁 Script executed:
#!/bin/bash
# Check git status to see what files are being modified in this PR
echo "=== Git diff to see what changed ==="
git diff --name-only HEAD^ HEAD 2>/dev/null || git status --short 2>/dev/null || echo "Cannot determine git context"
echo -e "\n=== Checking go.mod constraints more carefully ==="
head -5 go.mod
head -5 api/go.mod
echo -e "\n=== Look for any documentation about Go version requirements ==="
rg 'go.*1\.26' --type md -A 2 -B 2Repository: InjectiveLabs/cometbft
Length of output: 764
Pin Docker Go image to 1.26.2 to match go.mod requirement and ensure reproducibility.
The golang:1.26-alpine tag is mutable and resolves to the latest patch in the Go 1.26 series. It will update to future patches (e.g., 1.26.3, 1.26.4), creating drift from the explicitly pinned go 1.26.2 requirement in both go.mod files. This breaks build reproducibility across time.
Additionally, scripts/proto-gen.sh line 13 has the same unpinned tag and should also be updated to golang:1.26.2-alpine for consistency.
🔧 Proposed fixes
-ARG GOLANG_BASE_IMAGE=golang:1.26-alpine
+ARG GOLANG_BASE_IMAGE=golang:1.26.2-alpineIn scripts/proto-gen.sh line 13:
-docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.26-alpine sh <<"EOF"
+docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.26.2-alpine sh <<"EOF"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ARG GOLANG_BASE_IMAGE=golang:1.26-alpine | |
| ARG GOLANG_BASE_IMAGE=golang:1.26.2-alpine |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@DOCKER/Dockerfile` at line 3, The Docker Go base image tag is unpinned;
update the ARG GOLANG_BASE_IMAGE definition (ARG
GOLANG_BASE_IMAGE=golang:1.26-alpine) to the immutable patch version
golang:1.26.2-alpine to match go.mod and ensure reproducible builds, and make
the same change in scripts/proto-gen.sh (the golang image reference on line 13)
so both Dockerfile ARG and the script use golang:1.26.2-alpine.
| module kvstore | ||
|
|
||
| go 1.23 | ||
| go 1.26.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
For Go 1.26.x, what godirective doesgo mod init generate by default in a new go.mod file?
💡 Result:
For Go 1.26.x, go mod init generates a go.mod file with the go directive set to go 1.25.0 by default when using a stable Go 1.26 toolchain. This is a change introduced in Go 1.26: for a stable toolchain version 1.N.X, it defaults to go 1.(N-1).0 (so go 1.25.0 for 1.26.x). Pre-release versions default to two versions earlier.
Citations:
- 1: https://go.dev/doc/go1.26
- 2: http://go.dev/doc/go1.26
- 3: https://medium.com/@shiiyan/go-1-26-new-modules-now-default-to-the-previous-go-version-262081382c56
- 4: cmd/go: change
go mod initdefault go directive back to 1.N golang/go#77653 - 5: https://office.qz.com/go-1-26-changed-go-mod-init-and-nobody-asked-for-it-57ec19d909d1
Update go.mod version to match Go 1.26 default behavior.
When using Go 1.26, go mod init generates go 1.25.0 by default, not go 1.26.2. Update the example to reflect the actual command output.
Proposed fix
-go 1.26.2
+go 1.25.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| go 1.26.2 | |
| go 1.25.0 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docs/tutorials/go-built-in.md` at line 145, Replace the incorrect Go version
string in the tutorial example: change the line currently showing "go 1.26.2" to
the actual output produced by `go mod init` for Go 1.26, i.e., "go 1.25.0", and
update any adjacent example text that references the Go version to keep the doc
consistent (search for the exact token "go 1.26.2" in
docs/tutorials/go-built-in.md and replace it with "go 1.25.0").
| module kvstore | ||
|
|
||
| go 1.23 | ||
| go 1.26.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
In Go 1.26.x, does go mod initdefault the new module directive togo 1.25.0?
💡 Result:
Yes, in Go 1.26.x, go mod init defaults the new module directive to go 1.25.0.
Citations:
- 1: https://tip.golang.org/doc/go1.26
- 2: https://go.dev/doc/go1.26
- 3: http://go.dev/doc/go1.26
- 4: https://medium.com/@shiiyan/go-1-26-new-modules-now-default-to-the-previous-go-version-262081382c56
- 5: https://pub.huizhou92.com/go-1-26-changed-go-mod-init-and-nobody-asked-for-it-57ec19d909d1
- 6: https://medium.com/@moksh.9/go-1-26-tooling-improvements-easier-upgrades-for-long-lived-codebases-8fc02318c175
- 7: https://go.dev/doc/devel/release.html
- 8: cmd/go: change
go mod initdefault go directive back to 1.N [1.26 backport] golang/go#77860
Update go.mod directive to match Go 1.26 defaults.
The example shows go 1.26.2, but go mod init in Go 1.26.x defaults the module directive to go 1.25.0 (the previous version). Update to avoid user confusion.
Proposed fix
-go 1.26.2
+go 1.25.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| go 1.26.2 | |
| go 1.25.0 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docs/tutorials/go.md` at line 140, The tutorial's go.mod example lists "go
1.26.2" which conflicts with the default module directive emitted by Go 1.26.x;
update the directive in the example from "go 1.26.2" to "go 1.25.0" so the shown
go directive matches the output of `go mod init` on Go 1.26.x and avoids
confusing readers.
| | v0.38.x | Go version | 1.22 or higher | up to 1.22 | | ||
| | v0.37.x | Go version | 1.22 or higher | up to 1.22 | | ||
| | v0.34.x | Go version | 1.22 or higher | up to 1.22 | | ||
| | v1.x-inj | Go version | 1.26 or higher | up to 1.26.2 | |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify declared minimum Go versions across docs and modules.
rg -n '^go [0-9]+\.[0-9]+(\.[0-9]+)?' go.mod api/go.mod
rg -n 'Go version|1\.26' README.mdRepository: InjectiveLabs/cometbft
Length of output: 213
Align README minimum Go version with module requirement.
The README states 1.26 or higher on line 65, but both go.mod and api/go.mod explicitly require go 1.26.2. This mismatch can mislead users into attempting to use unsupported Go 1.26.0 or 1.26.1.
Suggested fix
-| v1.x-inj | Go version | 1.26 or higher | up to 1.26.2 |
+| v1.x-inj | Go version | 1.26.2 or higher | 1.26.2 |📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | v1.x-inj | Go version | 1.26 or higher | up to 1.26.2 | | |
| | v1.x-inj | Go version | 1.26.2 or higher | 1.26.2 | |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@README.md` at line 65, Update the README table entry that currently reads
"1.26 or higher" (the row containing "v1.x-inj | Go version | 1.26 or higher |
up to 1.26.2") to explicitly require "1.26.2 or higher" (or ">= 1.26.2") so it
matches the go version declared in go.mod and api/go.mod; ensure the wording
exactly matches the module requirement to avoid confusion.
| # Run inside Docker to install the correct versions of the required tools | ||
| # without polluting the local system. | ||
| docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.22-alpine sh <<"EOF" | ||
| docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.26-alpine sh <<"EOF" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all referenced Go Docker images are pinned consistently.
rg -n 'golang:[0-9]+\.[0-9]+(\.[0-9]+)?-alpine' DOCKER/Dockerfile scripts/proto-gen.sh test/docker/DockerfileRepository: InjectiveLabs/cometbft
Length of output: 225
🏁 Script executed:
# Check go.mod for Go version directive
fd -type f 'go.mod' -exec head -20 {} \;Repository: InjectiveLabs/cometbft
Length of output: 236
🏁 Script executed:
# Look for .go-version or other version files
fd -type f '\.go-version|\.tool-versions|go\.work' -x cat {}Repository: InjectiveLabs/cometbft
Length of output: 236
🏁 Script executed:
# Search for any references to 1.26.2 in the repo
rg '1\.26\.2' --type go --type sh --type yaml --type tomlRepository: InjectiveLabs/cometbft
Length of output: 48
🏁 Script executed:
# Check full Dockerfile content
cat DOCKER/DockerfileRepository: InjectiveLabs/cometbft
Length of output: 1958
🏁 Script executed:
# Find go.mod file
find . -name "go.mod" -type fRepository: InjectiveLabs/cometbft
Length of output: 87
🏁 Script executed:
# Search for version configuration files
find . -name ".go-version" -o -name ".tool-versions" -o -name "go.work" -o -name "Makefile" | head -20Repository: InjectiveLabs/cometbft
Length of output: 233
🏁 Script executed:
# Check go.mod content if it exists
cat go.mod 2>/dev/null | head -30Repository: InjectiveLabs/cometbft
Length of output: 1132
🏁 Script executed:
# List all Dockerfiles in the repo
find . -name "Dockerfile" -o -name "Dockerfile.*"Repository: InjectiveLabs/cometbft
Length of output: 303
🏁 Script executed:
# Check for any other golang image references
rg 'golang:' --type-list | head -20
rg -i 'golang:' -A 2 -B 2Repository: InjectiveLabs/cometbft
Length of output: 1317
Pin proto-gen script to Go 1.26.2-alpine for reproducibility.
Line 13 needs to match the exact Go version enforced in go.mod (1.26.2). Currently it uses golang:1.26-alpine which can pull any patch version and cause non-reproducible builds.
Proposed fix
-docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.26-alpine sh <<"EOF"
+docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.26.2-alpine sh <<"EOF"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.26-alpine sh <<"EOF" | |
| docker run --rm -i -v "$PWD":/w --workdir=/w golang:1.26.2-alpine sh <<"EOF" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/proto-gen.sh` at line 13, The Docker image tag used in the proto-gen
script ("docker run ... golang:1.26-alpine sh") is too loose and may pull
different patch versions; update that image reference to the exact Go patch
version used in go.mod (golang:1.26.2-alpine) so the script is pinned for
reproducible builds — replace the "golang:1.26-alpine" token in the docker run
invocation with "golang:1.26.2-alpine".
Summary by CodeRabbit
Chores
Tests