clawbot
1e7b0c3b5a
check / check (pull_request) Failing after 1s
The release workflow installed Go via actions/setup-go, which pins the action but not the toolchain tarball it downloads at runtime -- the compiler that produces the published binaries was the last external input in the release path verified against nothing in the repo, against REPO_POLICIES.md's hash-pin rule. New script/install-go, modelled on script/install-goreleaser, downloads the exact go.dev archive for go.mod's `go` directive and refuses it unless its sha256 matches a value committed in the script. release.yml calls it instead of setup-go and sets GOTOOLCHAIN=local so that exact compiler builds the release. The version is not duplicated: go.mod owns it and install-go fails when its committed GO_VERSION disagrees, so bumping Go edits go.mod, the checksum, and the Dockerfile golang digest together. Model: opus-4-8