From f6aeb56ed42d57520954b500f6ab7bd329792832 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 09:22:52 +0300 Subject: [PATCH 1/4] cascade: pass CHANGELOG_SECRET so auto-bumps get LLM changelogs Org-wide CHANGELOG_SECRET was never forwarded to the reusable tag-bump workflow, so its auto-changelog step silently skipped on every cascade bump. Matches trustedagents, the one repo already wired. Co-Authored-By: Claude Fable 5 --- .github/workflows/cascade.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/cascade.yml b/.github/workflows/cascade.yml index 7891ee2..2a6182c 100644 --- a/.github/workflows/cascade.yml +++ b/.github/workflows/cascade.yml @@ -34,3 +34,5 @@ jobs: version: ${{ inputs.version || github.event.client_payload.version }} is_prerelease: ${{ inputs.is_prerelease == true || github.event.client_payload.is_prerelease == true }} stable_only: true + secrets: + CHANGELOG_SECRET: ${{ secrets.CHANGELOG_SECRET }} From cb4a2bba389db00aaac476ae72548f15e4d38059 Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 09:42:04 +0300 Subject: [PATCH 2/4] go.mod: bump go directive to 1.25.12 (GO-2026-5856 + web4 v1.12.5 sibling constraint) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck flags GO-2026-5856 (crypto/tls, fixed in go1.25.12), and CI runs GOTOOLCHAIN=local with the sibling web4 checkout now requiring go >= 1.25.12 — same bump web4 shipped in v1.12.5. Co-Authored-By: Claude Fable 5 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index f1d51fc..173200a 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/pilot-protocol/libpilot -go 1.25.11 +go 1.25.12 require ( github.com/pilot-protocol/common v0.5.5 From 33eb0d076295ed91695d9843fa68413844b4d74e Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 10:09:43 +0300 Subject: [PATCH 3/4] ci: track go toolchain from go.mod instead of pinning 1.25 go-version: '1.25' resolves to the runner's cached 1.25.11 while GOTOOLCHAIN=local forbids auto-upgrade, so the go.mod 1.25.12 bump (GO-2026-5856) fails every job. go-version-file keeps CI in lockstep with the module. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4bfef31..9fe0dfd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -116,7 +116,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.25' + go-version-file: go.mod cache: true cache-dependency-path: libpilot/go.sum From 8dd9849534d3e3b367750eaea70c2ee5eb2e7e3c Mon Sep 17 00:00:00 2001 From: Calin Teodor Date: Mon, 13 Jul 2026 10:14:24 +0300 Subject: [PATCH 4/4] ci: go-version-file must point into the subdir checkout This job checks the repo out at path: libpilot, so go.mod lives at libpilot/go.mod, not the workspace root. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9fe0dfd..aaff0e5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -116,7 +116,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version-file: go.mod + go-version-file: libpilot/go.mod cache: true cache-dependency-path: libpilot/go.sum