build: upgrade Go toolchain to 1.27.1, retain Alpine 3.20 runtime

.github/workflows/deploy.yml

@@ -46,10 +46,10 @@ jobs:
       - name: Clean Go module cache
         run: rm -rf ~/go/pkg/mod 2>/dev/null || true
 
-      - name: Set up Go 1.22
+      - name: Set up Go 1.27.1
         uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version: '1.27.1'
           cache-dependency-path: |
             cmd/server/go.sum
             cmd/ingestor/go.sum
@@ -266,10 +266,10 @@ jobs:
       - name: Clean Go module cache
         run: rm -rf ~/go/pkg/mod 2>/dev/null || true
 
-      - name: Set up Go 1.22
+      - name: Set up Go 1.27.1
         uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version: '1.27.1'
           cache-dependency-path: cmd/server/go.sum
 
       - name: Build Go server
@@ -669,10 +669,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up Go 1.22
+      - name: Set up Go 1.27.1
         uses: actions/setup-go@v6
         with:
-          go-version: '1.22'
+          go-version: '1.27.1'
 
       - name: Build corescope-decrypt (static, linux/amd64)
         run: |

Dockerfile

@@ -3,7 +3,7 @@
 # BUILDPLATFORM is auto-set by buildx; default to linux/amd64 so plain
 # `docker build` (without buildx) doesn't fail on an empty platform string.
 ARG BUILDPLATFORM=linux/amd64
-FROM --platform=$BUILDPLATFORM golang:1.22-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.27.1-alpine3.24@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125 AS builder
 
 ARG APP_VERSION=unknown
 ARG GIT_COMMIT=unknown

Dockerfile.go

@@ -1,4 +1,4 @@
-FROM golang:1.22-alpine AS builder
+FROM golang:1.27.1-alpine3.24@sha256:cf6fca6641884b8433441b2b0652976f975e1d0fdd26d177eaaf8596087f3125 AS builder
 
 RUN apk add --no-cache build-base