[wfxr]

Summary

Issue Number: close #1566

Upgrade master to Go 1.27.3 as part of the TiDB repositories' Go version upgrade.

• Raise the required Go version in go.mod from 1.25.14 to 1.27.3.
• Update the development Docker image to install Go 1.27.3.
• Install Go in the Golang workflow with actions/setup-go@v6, using go.mod as the version source.

Testing

Passed locally with official Go 1.27.3 and GOTOOLCHAIN=local:

• make go with protoc 3.8.0
• go build ./pkg/...
• go test ./...
• go mod tidy -diff
• git diff --check

The complete Docker image build was not run.

Summary by CodeRabbit

• Chores
  • Updated the Go version used for container builds and the project’s language version.
  • Configured automated tests to use the Go version specified by the project, keeping the test environment aligned with the project configuration.

[coderabbitai]

No actionable comments were generated in the recent review.

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: aba16cf8-82ca-423d-9596-cdcf3e773806

📥 Commits

Reviewing files that changed from the base of the PR and between 22d1d51 and ffb1332.

📒 Files selected for processing: 2

• Dockerfile
• go.mod

🚧 Files skipped from review as they are similar to previous changes: 1

• Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

Walkthrough

The Go version in go.mod and the Docker build changes to 1.27.3. The Go test workflow adds a setup step that reads the version from go.mod.

Changes: Go Toolchain Alignment

Layer / File(s)	Summary
Set and use the Go version go.mod, Dockerfile, .github/workflows/golang-test.yaml	go.mod and the Docker build specify Go 1.27.3. The test workflow configures Go from go.mod.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: cfzjywxk

Merge Risk: Minimal · up to ffb13

The Docker build and CI select the Go 1.27.3 required by the module. The reported local checks used 1.27.2, so they do not confirm the final target; no concrete merge-blocking failure is established.

Security architecture risk: Low · up to 22d1d

The change is limited to build and test infrastructure, with no demonstrated permission escalation or application security regression. Effective CI token permissions remain unknown, and the new action’s cache lifecycle could not be fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The added action executes in the existing ubuntu-latest test job for pushes and pull requests targeting master or release branches. The PR does not add a privileged pull_request_target trigger or broaden the configured event scope.

Security Findings and Attack Paths

• observed — The implicit-token-permissions candidate remains deferred, not verified: effective defaults could not be retrieved. The separate pull-request-to-default-branch cache-poisoning candidate was rejected based on documented cache isolation and is not reinstated as a concern.

Trust Boundaries and Controls

• inferred — The new action adds executable code within the CI job’s trust context. Declared authority is unchanged, but the maximum effective token authority and any additional action-specific exposure cannot be established without the effective permissions and action implementation.

Hardening Proposals

• proposed — Declare the workflow’s least-required token permissions explicitly so its authority does not depend on repository or organization defaults. This is hardening of a pre-existing implicit configuration, not remediation of a demonstrated escalation.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: upgrading the project to Go 1.27.3. This matches the updates in go.mod and the Dockerfile.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the version line,
Go 1.27.3 looks fine.
The workflow finds the module’s cue,
The Docker build uses that version too.
Hop, hop, tests are set to run,
The toolchain change is done!}

_{Comment @coderabbitai help to get the list of available commands.}

[wfxr]

/hold

[wfxr]

/unhold

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cfzjywxk, lcwangchao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [cfzjywxk,lcwangchao]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-10-21 08:06:03.306467421 +0000 UTC m=+177575.566554348: ☑️ agreed by cfzjywxk.
• 2026-10-26 07:07:16.457403003 +0000 UTC m=+358773.949115252: ☑️ agreed by lcwangchao.

[wfxr]

/unhold

[wfxr]

/check-issue-triage-complete