post-code: golangci-lint pre-commit fails when repo go.mod exceeds runner Go toolchain

[Omeramsc]

What happens

When post-code.sh runs authoritative pre-commit on an enrolled repo whose
go.mod targets a Go version newer than the golangci-lint binary pre-commit
installs on the GHA runner, the golangci-lint hooks fail with exit code 3
before analyzing any code. The workflow exits red and no PR is created.

Reproduced on konflux-ci/segment-bridge via
Code run #116
(2026-06-09):

1. User triggered the code agent on an enrolled repo (segment-bridge).

2. Agent completed (Agent completed annotation).

3. post-code.sh ran authoritative pre-commit on changed files.

4. golangci-lint-fmt and golangci-lint-full both failed:

   Error: can't load config: the Go language version (go1.25) used to build
   golangci-lint is lower than the targeted Go version (1.26.0)
   

   Hook log also shows:

   golangci-lint has version 2.0.0-20260506110125-c0d3ddc9cf3f+dirty
   built with go1.25.0
   

5. Post-script blocked with:

   • BLOCKED — pre-commit hooks failed on agent's changes
   • The agent's code does not pass the repo's pre-commit hooks.

6. Workflow conclusion: failure. No PR opened.

Other pre-commit hooks in the same run passed (markdownlint, go-mod-tidy,
gitleaks). Only golangci-lint hooks failed, and the failure is
infrastructure/version mismatch, not a lint finding in agent code.

What should happen

post-code.sh should be able to run golangci-lint pre-commit hooks against
repos whose go.mod declares the current Go release. At minimum, the
authoritative pre-commit gate should use a golangci-lint build whose Go
toolchain is >= the target repo's go directive.

Repo CI is unaffected: segment-bridge's own workflow uses
actions/setup-go with go-version-file: go.mod and the same pre-commit
hooks pass there. Only the fullsend post-code runner environment is broken.

How to reproduce

1. Enroll a repo with go 1.26.0 (or newer) in go.mod.
2. Add golangci-lint hooks to .pre-commit-config.yaml (e.g.
   golangci-lint-fmt, golangci-lint-full from
   https://github.com/golangci/golangci-lint).
3. Trigger /fs-code on an issue in that repo.
4. Let the code agent produce commits on a feature branch.
5. Observe post-code.sh fail at authoritative pre-commit with the
   go1.25 ... lower than ... 1.26.0 error.

Enrolled repo used in repro: konflux-ci/segment-bridge (enabled: true
in konflux-ci/.fullsend config.yaml).

Target repo pre-commit hooks (.pre-commit-config.yaml):
yamllint, shellcheck, gitlint, conventional-pre-commit, actionlint,
markdownlint, go-mod-tidy, golangci-lint-fmt, golangci-lint-full, gitleaks.

Context

This is a runner-side toolchain gap, distinct from the recently fixed sandbox
Go mismatch (#1344,
fixed by
PR #1990). That fix
updated the code agent sandbox image. This failure happens on the GHA
runner during post-code.sh, after the sandbox is destroyed.

As more Konflux repos adopt Go 1.26, any enrolled repo using golangci-lint
pre-commit hooks will hit this block. The agent cannot fix it: the failure is
in the runner's pre-commit environment, not in the code it wrote.

What this is NOT (avoid duplicate closure)

This is not the same issue as:

• #1997 — UX gap:
  no bot comment on the source issue when post-code pre-commit blocks. Same
  repro family, but this report is the root-cause infrastructure failure
  (golangci-lint Go toolchain mismatch), not missing notification.
• #1344 /
  #1990 — sandbox Go
  version mismatch. Fixed for the agent sandbox; does not fix post-code
  runner pre-commit.
• #850 — missing
  binaries (lychee, uvx) on the runner. Here the binary exists but is
  built with an incompatible Go version.
• #1270 — registry
  coverage for precommit-tools.yaml. golangci-lint uses language: golang
  and is auto-managed by pre-commit; the failure is version skew, not a
  missing registry entry.
• #1866 — blocking on
  pre-existing hook failures unrelated to agent changes. Here the hook cannot
  run at all due to toolchain mismatch.
• #1865 — PR created,
  CI failed later. Here pre-commit blocks before any PR.

Acceptance criteria

• post-code.sh runs golangci-lint pre-commit hooks successfully on a
  repo with go 1.26.0 in go.mod and golangci-lint hooks in
  .pre-commit-config.yaml.
• A code agent run on konflux-ci/segment-bridge completes post-code
  pre-commit without the go1.25 ... lower than ... 1.26.0 error.
• No regression for repos still on Go 1.25 or earlier.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:59 AM UTC · Completed 9:03 AM UTC
Commit: ba204cb · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: High · Category: Bug

Problem

post-code.sh runs authoritative pre-commit hooks on the GHA runner, but the runner's Go toolchain (1.25) is older than the target repo's go.mod directive (1.26). golangci-lint, built with the runner's Go via pre-commit's language: golang, refuses to analyze code targeting a newer Go version — exiting with code 3 before analyzing any code. The workflow fails and no PR is created.

Root Cause Hypothesis

post-code.sh does not set up a Go toolchain matching the target repo's go.mod before running pre-commit. The runner inherits whatever Go version is pre-installed on ubuntu-latest. Target repo CI works fine because it uses actions/setup-go with go-version-file: go.mod.

Recommended Fix

Before the authoritative pre-commit check in post-code.sh, extract the Go version from the target repo's go.mod and ensure the runner has a matching (or newer) Go toolchain installed. Options:

1. Add an actions/setup-go step with go-version-file: go.mod in the reusable workflow before post-code.sh runs
2. Have post-code.sh itself detect and install the required Go version when the runner's version is too old

Option 1 is simpler and mirrors what CI workflows already do.

Proposed Test Case

Scenario: post-code pre-commit with newer Go target
  Given a repo with go.mod declaring Go 1.26+
  And .pre-commit-config.yaml includes golangci-lint hooks
  When post-code.sh runs the authoritative pre-commit check
  Then golangci-lint hooks pass without version mismatch error

Scenario: no regression for older Go targets  
  Given a repo with go.mod declaring Go <= runner default
  When post-code.sh runs the authoritative pre-commit check
  Then golangci-lint hooks pass as before

Related Issues (not duplicates)

• post-code: notify issue when pre-commit block prevents PR creation #1997 — Missing bot notification when pre-commit blocks (UX gap, not root cause)
• Add pre-flight tool availability checks to post-code/post-fix scripts #850 — Pre-flight tool availability checks (different: binary missing vs version mismatch)
• Post-code should not block on pre-existing hook failures unrelated to agent changes #1866 — Pre-existing hook failures unrelated to agent changes (different failure mode)
• Extract shared tool installation logic from post-code.sh and post-fix.sh #836 — Extract shared tool installation logic from post scripts (potential implementation vehicle)

---

Labels: Post-code runner infrastructure bug affecting code agent workflows, high priority as it blocks PR creation for Go 1.26+ repos.

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 9:05 AM UTC · Completed 9:11 AM UTC
Commit: ba204cb · View workflow run →

[fullsend-ai-prioritize]

RICE Priority Score: 5.4

Score breakdown

Dimension	Score	Reasoning
Reach	1.5	Currently affects konflux-ci/segment-bridge and will affect any enrolled Go repo that adopts Go 1.26+. As the Go ecosystem moves forward, all enrolled repos with golangci-lint pre-commit hooks will hit this. Scored 1.5 for multiple customers/orgs affected over time.
Impact	2	When triggered, this completely blocks PR creation — the workflow exits red and no PR is opened. The agent's work is wasted. This is a blocking failure (exit code 3) with no workaround short of downgrading the repo's Go version. Scored 2 for severely degrading a core workflow.
Confidence	0.9	Very high confidence. The issue includes exact logs, a specific reproduction run, clear root cause analysis, and distinguishes itself from six related-but-different issues. The fix path is well-understood from the triage summary.
Effort	0.5	The fix is straightforward: add an actions/setup-go step with go-version-file before post-code.sh runs, mirroring what target repo CIs already do. The triage confirms this is a simple, well-scoped change. Scored 0.5 for a small change.

Formula: (1.5 x 2 x 0.9) / 0.5 = 5.4

[rh-hemartin]

So to give more information this is because the ubuntu-latest runner we run with (currently 2404 https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md) has Golang 1.25.10, so the golangci-lint binary gets compiled with that version, not downloaded from their latest releases (this is pre-commit fault). I think that a best solution than the one proposed is to download the go version after cloning the repo, using the standard golang action.

References: golangci/golangci-lint#6272

[rh-hemartin]

/fs-code