build: pin toolchain and neutralize stale host GOROOT

.github/workflows/ci.yml

@@ -7,7 +7,7 @@ on:
     branches: [main]
 
 env:
-  GO_VERSION: "1.25"
+  GO_VERSION: "1.26"
 
 jobs:
   lint:

.github/workflows/nightly-e2e-cilium-heavy.yml

@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  GO_VERSION: "1.25"
+  GO_VERSION: "1.26"
 
 jobs:
   e2e-kind-cilium-heavy:

.github/workflows/nightly-e2e.yml

@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  GO_VERSION: "1.25"
+  GO_VERSION: "1.26"
 
 jobs:
   e2e-kind-smoke:

.github/workflows/release.yml

@@ -11,7 +11,7 @@ on:
         type: string
 
 env:
-  GO_VERSION: "1.25"
+  GO_VERSION: "1.26"
   REGISTRY: ghcr.io
   IMAGE_BASE: ghcr.io/syscode-labs
 

.mise.toml

@@ -1,3 +1,11 @@
 [tools]
-go = "1.25.8"
+go = "1.26.4"
 kind = "0.20.0"
+
+# Unset any GOROOT exported by the host shell so mise's managed Go toolchain is
+# always used, independent of the host's Go install. A host GOROOT pointing at a
+# different Go version than the pinned toolchain causes "compile: version
+# mismatch" errors. The Makefile also does `unexport GOROOT` for make-driven
+# builds that don't go through mise activation.
+[env]
+GOROOT = false

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.25 AS builder
+FROM golang:1.26 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 

Dockerfile.agent

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-FROM golang:1.25-alpine AS agent-builder
+FROM golang:1.26-alpine AS agent-builder
 WORKDIR /workspace
 COPY go.mod go.sum ./
 RUN --mount=type=cache,id=agent-gomod,target=/root/go/pkg/mod go mod download
@@ -12,7 +12,7 @@ RUN --mount=type=cache,id=agent-gomod,target=/root/go/pkg/mod \
     --mount=type=cache,id=agent-gobuild,target=/root/.cache/go-build \
     CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -o agent ./cmd/agent
 
-FROM golang:1.25-alpine AS guest-agent-builder
+FROM golang:1.26-alpine AS guest-agent-builder
 WORKDIR /workspace
 COPY go.mod go.sum ./
 RUN --mount=type=cache,id=guest-gomod,target=/root/go/pkg/mod go mod download

Dockerfile.operator

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 WORKDIR /workspace
 
 COPY go.mod go.sum ./

Makefile

@@ -19,6 +19,13 @@ CONTAINER_TOOL ?= docker
 SHELL = /usr/bin/env bash -o pipefail
 .SHELLFLAGS = -ec
 
+# A stale GOROOT inherited from the host shell (e.g. a Homebrew Go install
+# pointing at a different version than the `go` binary on PATH) causes
+# "compile: version X does not match go tool version Y". Strip it so every
+# recipe uses the go binary's own GOROOT. The toolchain version is pinned
+# reproducibly via .mise.toml and go.mod, independent of the host's Go.
+unexport GOROOT
+
 .PHONY: all
 all: build
 

go.mod

@@ -1,6 +1,8 @@
 module github.com/syscode-labs/imp
 
-go 1.25.6
+go 1.26.0
+
+toolchain go1.26.4
 
 require (
 	github.com/firecracker-microvm/firecracker-go-sdk v1.0.0
@@ -24,6 +26,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.42.0
 	go.opentelemetry.io/otel/sdk v1.42.0
 	go.opentelemetry.io/otel/sdk/metric v1.42.0
+	go.opentelemetry.io/otel/trace v1.42.0
 	golang.org/x/oauth2 v0.35.0
 	google.golang.org/grpc v1.79.2
 	google.golang.org/protobuf v1.36.11
@@ -104,7 +107,6 @@ require (
 	go.mongodb.org/mongo-driver v1.8.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
-	go.opentelemetry.io/otel/trace v1.42.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect