chore(deps): bump go version to v1.26.5

[rohanKanojia]

Summary

• Bump Go toolchain from 1.26.4 to 1.26.5 in go.mod, CI workflows, and OCI Dockerfile
• Update UBI9 go-toolset builder images to 1.26.5-1783931515 with digest sha256:d8698410eb806fedd5c0ddbd08e981436051e0ed2113b8e402736e7ee578f6f4 in build/Dockerfile and project-clone/Dockerfile

Test plan

• CI passes (unit tests, lint, code coverage)
• Container images build successfully with updated go-toolset image

Made with Cursor

Summary by CodeRabbit

• Chores
  • Updated the Go toolchain to version 1.26.5 across development, testing, release, and container build environments.
  • Refreshed the pinned builder image to match the updated Go version.
  • No application behavior or public interfaces changed.

[coderabbitai]

📝 Walkthrough

Walkthrough

The repository’s Go toolchain is updated from 1.26.4 to 1.26.5 in go.mod, Docker build environments, and GitHub Actions workflows. Pinned UBI Go toolset image references and digests are also updated.

Changes

Go toolchain alignment

Layer / File(s)	Summary
Go toolchain declaration go.mod	The module toolchain directive is updated to go1.26.5.
Container and CI toolchain updates .ci/oci.Dockerfile, build/Dockerfile, project-clone/Dockerfile, .github/workflows/*	Docker Go toolsets, installed Go environment variables, and workflow Go versions are updated from 1.26.4 to 1.26.5, with corresponding builder image digests refreshed.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• devfile/devworkspace-operator#1667: Updates the same Go toolchain references from 1.26.3 to 1.26.4.
• devfile/devworkspace-operator#1639: Updates Go versions in the module, Dockerfiles, and GitHub Actions workflows.
• devfile/devworkspace-operator#1611: Updates the same CI workflow and Docker toolchain version locations.

Suggested labels: lgtm, ok-to-test

Suggested reviewers: akurinnoy, dkwon17

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: upgrading Go from 1.26.4 to 1.26.5 across the repo.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
• /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
• /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
• /che-ai-assistant help — Show this help message

[tolusha]

/che-ai-assistant ok-pr-readiness

Task completed.

Task completed.

[tolusha]

PR Readiness Assessment: PR #1671 — chore(deps): bump go version to v1.26.5

Repository: devfile/devworkspace-operator
Linked Issue: None found

---

#	Criterion	Verdict	Notes
1	Problem Statement	PASS	Dependency update - maintaining current Go toolchain with security/bug fixes from upstream
2	Reproduction Steps	PASS	Not applicable for toolchain version bump - no bug to reproduce
3	Expected Behavior After Fix	PASS	CI and builds should continue working with newer Go version
4	Scope of Changes	PASS	Mechanical version bump across go.mod, CI workflows, and Dockerfiles - all changes are consistent and expected
5	Test Evidence	PASS	Test plan explicitly lists CI checks and container image builds as verification
6	Deployment & Verification Notes	WARN	Partial - test plan covers CI but lacks guidance on verifying the deployed operator itself uses the new Go version

Overall: READY

---

Missing Information

• Add a note about how to verify the deployed operator container was built with Go 1.26.5 (e.g., `go version` check within the running container, or image inspection commands)
• Consider mentioning if there are any known fixes or security issues in Go 1.26.5 that motivated this update (helps reviewers understand urgency)

What's Good

• Comprehensive scope: Updated Go version consistently across all locations (go.mod toolchain, all CI workflows, and all Dockerfiles)
• Pinned container images: Updated UBI9 go-toolset images include both version tag and SHA256 digest for security and reproducibility
• Clear test plan: Explicitly lists CI and container build verification steps
• Clean diff: All changes are mechanical version bumps with no logic changes, making review straightforward
• Good commit hygiene: Chore commit type and clear summary make the intent immediately obvious

[tolusha]

PR Readiness Assessment: PR #1671 — chore(deps): bump go version to v1.26.5

Repository: devfile/devworkspace-operator
Linked Issue: None found

---

#	Criterion	Verdict	Notes
1	Problem Statement	PASS	Dependency update — clear maintenance task to bump Go toolchain version
2	Reproduction Steps	PASS	Not applicable — this is a dependency maintenance update, not a bug fix
3	Expected Behavior After Fix	PASS	Expected outcome is clear: builds use Go 1.26.5 instead of 1.26.4 with no behavior change
4	Scope of Changes	PASS	All 7 changed files are clearly explained: go.mod, CI workflows, and Dockerfiles updated consistently
5	Test Evidence	PASS	Test plan clearly states CI must pass (unit tests, lint, coverage) and container images must build
6	Deployment & Verification Notes	PASS	Verification is straightforward: CI passing and successful image builds confirm the update

Overall: READY

---

Missing Information

None — this PR contains appropriate information for a dependency maintenance update.

What's Good

• Clear and complete scope: The PR body explicitly lists both the Go toolchain version bump (1.26.4 → 1.26.5) and the UBI9 go-toolset image updates with specific version and digest
• Consistent changes across all locations: Updated in go.mod toolchain directive, all GitHub Actions workflows (.github/workflows/*.yml), and all Dockerfiles (build, project-clone, oci)
• Reproducible Dockerfile changes: UBI9 images are pinned by both version tag and SHA256 digest, ensuring reproducible builds
• Appropriate test plan: CI validation (unit tests, lint, coverage) and container build verification are exactly what's needed for this type of change
• Well-scoped change: This is a pure dependency update with no behavior changes, making verification straightforward
• Security-conscious: Updates SHA256 digests for container images, maintaining the security practice of pinning by digest

[btjd]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: btjd, ibuziuk, rohanKanojia
Once this PR has been reviewed and has the lgtm label, please assign dkwon17 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

New changes are detected. LGTM label has been removed.

[coderabbitai]

🧹 Nitpick comments (1)

.ci/oci.Dockerfile (1)

18-24: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the duplicated environment block.

GO_VERSION, GOROOT, and PATH are declared twice with identical values. Keep a single block to avoid configuration drift and clarify the Docker build environment.

Proposed cleanup

 ENV GO_VERSION=1.26.5
 ENV GOROOT=/usr/local/go
 ENV PATH=$GOROOT/bin:$PATH
-
-ENV GO_VERSION=1.26.5
-ENV GOROOT=/usr/local/go
-ENV PATH=$GOROOT/bin:$PATH

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.ci/oci.Dockerfile around lines 18 - 24, Remove the duplicated ENV block in
the Dockerfile, keeping one declaration each for GO_VERSION, GOROOT, and PATH
with their existing values.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.ci/oci.Dockerfile:
- Around line 18-24: Remove the duplicated ENV block in the Dockerfile, keeping
one declaration each for GO_VERSION, GOROOT, and PATH with their existing
values.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 072cedf7-f6a2-418c-9f11-37395bfb5d75

📥 Commits

Reviewing files that changed from the base of the PR and between 8481361 and 364cf8d.

📒 Files selected for processing (7)

• .ci/oci.Dockerfile
• .github/workflows/code-coverage.yml
• .github/workflows/pr.yml
• .github/workflows/release.yml
• build/Dockerfile
• go.mod
• project-clone/Dockerfile