chore: upgrade Go 1.26 → 1.27.1

[behzad-mir]

Go Minor Version Upgrade: 1.26 → 1.27.1

Current version: 1.26 (preferred toolchain: 1.26.7)
Module compatibility floor: 1.26.0
Target version: 1.27.1 (1.27.1-azurelinux3.0)
MCR image: mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
Image digest: sha256:78388dc19e5cc1d2262ecee3f34dbc0dc0c38547223bcec0ac5a7cd1bfcb7122

Instructions for Copilot Agent

Use the acn-go-version-bump skill (.github/skills/acn-go-version-bump/SKILL.md).

Step 0 (MANDATORY): Analyze MS Go Documentation

Before making ANY code changes, read the pre-cached MS Go docs for version 1.27:

# Read pre-cached docs (fetched by copilot-setup-steps before firewall)
cat .github/ms-go-docs/README.md
cat .github/ms-go-docs/NocgoOpenSSL.md
cat .github/ms-go-docs/MigrationGuide.md
cat .github/ms-go-docs/UserGuide.md
cat .github/ms-go-docs/AdditionalFeatures.md
# Fallback if cache is missing (may fail behind firewall):
# gh api "repos/microsoft/go/contents/docs/go1.27.md?ref=microsoft/main" --jq '.content' | base64 -d

Produce a Requirements Matrix that cross-references the docs against this repo:

• Build environment: GOEXPERIMENT rules per CGO setting, build flags, GOTOOLCHAIN behavior
• Runtime: required system libraries, base image requirements, architecture limits
• Crypto/FIPS: which backend is selected, CGO requirements, API behavior changes
• Compatibility: deprecated APIs, module system changes, dependency support

Include the Requirements Matrix in your PR description.

Step 1: Execute Changes (based on your analysis)

1. Update build/images.mk: GO_IMG → mcr.microsoft.com/oss/go/microsoft/golang:1.27-azurelinux3.0
2. Update the preferred toolchain in every module; raise a module's go compatibility floor only when required by source or dependencies
3. Do NOT run go mod tidy — it times out in the agent environment. Existing go.sum files are valid.
4. Apply FIPS/crypto changes per your doc analysis (do NOT blindly reuse previous version's rules)
5. Update all SHA references (install-go.sh, bpf-prog, npm Dockerfiles)
6. Run make dockerfiles
7. Run go build ./... and go vet ./...

Key dependency check: Verify controller-runtime, client-go, and cilium support Go 1.27

⚠️ FIPS / System Crypto Requirements

Go 1.27+ changes the system crypto story relative to 1.26. Do NOT assume the 1.26 rules still apply.

Determine from the pre-cached MS Go docs (README.md, NocgoOpenSSL.md, MigrationGuide.md) which of the following is true for 1.27, and act accordingly:

• Which crypto backend is selected by default on Linux for CGO_ENABLED=0 and CGO_ENABLED=1
• Whether GOEXPERIMENT=systemcrypto / ms_nocgo_opensslcrypto / nosystemcrypto are still valid values in 1.27, or whether they have been removed (setting a removed experiment is a build error)

Then:

1. If the experiments still exist and are required → set the correct value in ALL Dockerfile templates, pipeline build scripts, and Makefiles per CGO setting
2. If the experiments were removed in 1.27 → remove GOEXPERIMENT=systemcrypto and GOEXPERIMENT=ms_nocgo_opensslcrypto from ALL Dockerfile templates, pipeline build scripts, and Makefiles
3. Handle MS_GO_NOSYSTEMCRYPTO=1 in the npm Dockerfiles consistently with your finding
4. Ensure MARINER_DISTROLESS_IMG in build/images.mk is distroless/base
5. Update bpf-prog/ipv6-hp-bpf/linux.Dockerfile runtime base to azurelinux/distroless/base:3.0

State your conclusion and cite the doc line(s) that support it in the PR description.

Pre-cached resources (from copilot-setup-steps.yml)

The agent firewall blocks proxy.golang.org and mcr.microsoft.com. These are pre-cached for you:

• Go 1.27 toolchain — pre-installed and on PATH
• Module dependencies — pre-downloaded (go build / go vet work offline)
• Target image digests — .github/image-digests/go-next-minor.txt, .github/image-digests/go-next-patch-debian.txt
• MS Go docs — .github/ms-go-docs/

If a command fails due to a network/DNS block, do NOT silently give up and open an empty PR — report the blocker in the PR description.

Before you commit

Audit the working tree for build artifacts. go build can drop ELF binaries into module directories; these must NOT be committed:

git status --short

Known offenders: azure-ip-masq-merger/azure-ip-masq-merger, azure-iptables-monitor/azure-iptables-monitor, cilium-log-collector/cilium-log-collector, tools/azure-npm-to-cilium-validator/azure-npm-to-cilium-validator.

Also verify your branch is non-empty before updating the PR description:

git diff --quiet master...HEAD && echo "ERROR: branch has no changes"

Acceptance Criteria

• Requirements Matrix included in PR description
• All version sources updated consistently (including tools.go.mod)
• Module compatibility floors remain at the minimum supported version
• go build ./... passes
• make dockerfiles output matches committed files
• No new replace directives (unless necessary and explained)
• FIPS/crypto config correct per MS Go docs for THIS specific version, with citation
• No build artifacts / binaries committed
• Backport PR created for release/v1.7

Backport to release/v1.7

After the master PR is complete, create a second PR targeting release/v1.7:

1. Check out release/v1.7
2. Apply the same Go version + SHA changes
3. If release/v1.7 is missing prerequisites (based on your analysis), add those too
4. Run make dockerfiles and go mod tidy on that branch
5. Title: chore(release/v1.7): upgrade Go 1.26 → 1.27.1
6. Verify go build ./... passes on release branch

Note: The release branch may have different dependency versions than master.
Run go mod tidy separately and resolve any conflicts specific to that branch.

---

[behzad-mir]

Moving this to the fork for validation first.

The two previous attempts (#4756, #4833) produced zero files because the agent did all its work in a git worktree outside $GITHUB_WORKSPACE, which is the only tree its commit/push step sees. Root cause and fix are in #4835 — but that isn't merged to master yet, so re-running here would just reproduce the same empty PR.

Validating on behzad-mir/azure-container-networking, whose master now carries the fix. Once the fork produces a correct, complete upgrade PR, the identical change will be raised here.

Closing as superseded — will reopen or file fresh once validated.