Bump cli-owned-build agent repos to core v0.3.8 (Go 1.27 + golangci-lint CI fix)

[antoinetoussaint-byte]

Status — 2026-08-23

main-branch bumps are essentially done; the release/tag step is the outstanding work.

• ✅ On core v0.3.8 + Go 1.27 on main (12 repos): clickhouse, dynamodb, envoy, generic, go, go-grpc, neo4j, nextjs, postgres, python-fastapi, redis, vault.
• 🗄️ Archived → out of scope: service-minio, service-s3 (both archived on GitHub; do not bump or release).
• ➖ N/A: service-unleash — README only, no go.mod.
• ⛔ Release step outstanding (all 12): no repo has been tagged/released with core v0.3.8 yet. Every latest tag predates the bump and still resolves to old core (v0.3.0–v0.3.5) / old Go (1.25–1.26), so go get on the latest tag returns pre-bump code. This is the remaining deliverable.

---

Summary

Core v0.3.8 is published (latest; adds the builder output-directory path fix, core#339, on top of the Go 1.27 toolchain bump core#338 and the build-recipe runners core#336). The CLI is pinned to it in #451.

The cli-owned-build agent (service) repos are still on core v0.3.6. Bump each of them to core v0.3.8 so the whole fleet is aligned on the same core contract.

⚠️ This is not a one-line go.mod bump

core v0.3.8 requires Go 1.27. That pulls two extra changes into each repo, both already solved in #451 — use it as the template:

1. Go toolchain → 1.27 in the repo's go.mod (go 1.27.0) if not already there.
2. golangci-lint CI fix (the lint job fails otherwise, in two stages):
   • The prebuilt linter binary is built with Go 1.26 and refuses a 1.27 module (the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.0)). → Add install-mode: goinstall to the golangci/golangci-lint-action@v8 step so it builds from source under the job's 1.27 toolchain.
   • golangci-lint v2.12.2 bundles staticcheck (honnef.co/go/tools v0.7.0), which panics analyzing Go 1.27 stdlib (buildir: unexpected expr: *ast.KeyValueExpr on internal/poll, exit code 3). → Bump the pinned version to v2.13.1 (bundles staticcheck v0.8.0, first with Go 1.27 support) in both .github/workflows/go.yml and the Makefile (GOLANGCI_LINT_VERSION, kept in sync).

Per-repo checklist

For each repo below: bump main (done for all listed), then tag + release with core v0.3.8.

• codefly-dev/service-clickhouse — main on v0.3.8; ⛔ needs release
• codefly-dev/service-dynamodb — main on v0.3.8; ⛔ needs release
• codefly-dev/service-envoy — main on v0.3.8; ⛔ needs release
• codefly-dev/service-generic — main on v0.3.8; ⛔ needs release
• codefly-dev/service-go — main on v0.3.8; ⛔ needs release
• codefly-dev/service-go-grpc — main on v0.3.8; ⛔ needs release
• codefly-dev/service-neo4j — main on v0.3.8; ⛔ needs release
• codefly-dev/service-nextjs — main on v0.3.8; ⛔ needs release
• codefly-dev/service-postgres — main on v0.3.8; ⛔ needs release
• codefly-dev/service-python-fastapi — main on v0.3.8; ⛔ needs release
• codefly-dev/service-redis — main on v0.3.8; ⛔ needs release
• codefly-dev/service-vault — main on v0.3.8; ⛔ needs release
• codefly-dev/service-unleash — N/A (README only, no go.mod)

Explicitly out of scope (per triage)

• service-minio — archived on GitHub. Do not bump or release; ignore in fleet tooling.
• service-s3 — archived on GitHub. Do not bump or release; ignore in fleet tooling.
• service-rust — working tree dirty; bump once it's committed.
• service-temporal — on an unrelated branch (fix/auto-setup-env-conformance-9, core v0.3.4).
• service-object-storage, service-signoz — no core dependency yet.
• service-python (core v0.3.4) and service-swift (core v0.3.0) — on epic branches but lagging on older core; fold in if desired, but they need the same Go 1.27 uplift.

Reference

Template PR: #451 (core→v0.3.8 pin + the exact golangci-lint CI fix).