feat: update Go version to 1.27.1 and add platform-specific error handling for non-Linux environments

.github/scripts/publish-develop.sh

@@ -129,8 +129,7 @@ for platform in linux/amd64 linux/arm64; do
   jq -e --arg platform "$platform" --arg revision "$GITHUB_SHA" '
     .os + "/" + .architecture == $platform and
     .config.Labels["org.opencontainers.image.revision"] == $revision and
-    .config.Labels["org.opencontainers.image.version"] == "develop" and
-    .config.Labels["io.multica.controller-abi"] == "2"
+    .config.Labels["org.opencontainers.image.version"] == "develop"
   ' <<<"$metadata" >/dev/null 2>"$scratch/json-error" || fail 'native image metadata differs from its verified result'
   sources+=("$IMAGE@$digest")
 done

.github/scripts/release.sh

@@ -86,8 +86,7 @@ image_metadata() {
   jq -e --arg platform "$2" --arg revision "$revision" --arg version "$version" '
     .os + "/" + .architecture == $platform and
     .config.Labels["org.opencontainers.image.revision"] == $revision and
-    .config.Labels["org.opencontainers.image.version"] == $version and
-    .config.Labels["io.multica.controller-abi"] == "2"
+    .config.Labels["org.opencontainers.image.version"] == $version
   ' <<<"$metadata" >/dev/null || fail 'native image platform or source/build mismatch'
 }
 

.github/scripts/verify-base.sh

@@ -17,21 +17,21 @@ docker image inspect "$image" | jq -e \
       .Os + "/" + .Architecture == $platform and
       .Config.Labels["org.opencontainers.image.version"] == $version and
       .Config.Labels["org.opencontainers.image.revision"] == $revision and
-      .Config.Labels["io.multica.controller-abi"] == "2" and
-      .Config.User == "65532:65532" and
-      all(.Config.Env[]; startswith("MULTICA_CLI_VERSION=") | not))
+      .Config.User == "65532:65532")
   ' >/dev/null
-docker run --rm --network none --read-only "$image" version
-docker run --rm --network none --read-only \
-  --tmpfs /home/multica/agents:rw,mode=0700,uid=65532,gid=65532 \
-  --tmpfs /tmp:rw,exec,mode=0700,uid=65532,gid=65532 \
-  --entrypoint /bin/sh "$image" -ec '
-    test "$(id -u)" = 65532
-    ! command -v multica
-    test ! -e /opt/multica/controller/multica
-    test ! -e /artifact
-    test -x /usr/local/go/bin/go
-    go version
-    printf "package main\nfunc main() {}\n" > /tmp/hello.go
-    CGO_ENABLED=0 go run /tmp/hello.go
-  '
+docker run --rm -i --network none --read-only --user 65532:65532 \
+  --cap-drop ALL --security-opt no-new-privileges --entrypoint /bin/sh "$image" -eu <<'VERIFY'
+packages=$(dpkg-query -W -f='${binary:Package}\t${db:Status-Status}\n')
+if printf '%s\n' "$packages" | awk '$1 ~ /^tini(-static)?(:[^[:space:]]+)?$/ && $2 != "not-installed" && $2 != "config-files" { found=1 } END { exit !found }' ||
+   command -v tini >/dev/null 2>&1 || command -v tini-static >/dev/null 2>&1; then
+  echo 'Controller base still contains Tini; rebuild the matching controller base.' >&2
+  exit 1
+fi
+for candidate in /usr/bin/tini /usr/bin/tini-static /bin/tini /bin/tini-static; do
+  if [ -e "$candidate" ] || [ -L "$candidate" ]; then
+    echo 'Controller base still contains a Tini executable or link.' >&2
+    exit 1
+  fi
+done
+exec /opt/multica/controller/runtime version
+VERIFY

.github/workflows/create-develop-to-main-pr.yml

@@ -101,14 +101,8 @@ jobs:
           key: pr-go-${{ runner.os }}-${{ runner.arch }}-${{ steps.go.outputs.go-version }}-${{ hashFiles('src/go.mod', 'src/go.sum') }}-${{ hashFiles('src/**', 'Makefile') }}
           restore-keys: |
             pr-go-${{ runner.os }}-${{ runner.arch }}-${{ steps.go.outputs.go-version }}-${{ hashFiles('src/go.mod', 'src/go.sum') }}-
-      - name: Validate scripts, repository and workflows
-        run: make runtime-version-test repository-validate workflow-validate
-      - name: Run Go tests
-        run: make test
-      - name: Run Go race tests
-        run: make test-race
-      - name: Vet Go packages
-        run: make vet
+      - name: Verify source and workflows
+        run: make verify
 
   promote:
     name: create-develop-to-main-pr

.github/workflows/develop-image.yml

@@ -86,7 +86,7 @@ jobs:
           cache-dependency-path: src/go.sum
       - name: Verify controller source and workflows
         if: github.event_name != 'pull_request' && steps.head.outputs.current == 'true'
-        run: make runtime-version-test repository-validate workflow-validate test test-race vet
+        run: make verify
       - name: Resolve image build arguments
         if: steps.head.outputs.current == 'true'
         id: args

.github/workflows/release.yml

@@ -107,8 +107,7 @@ jobs:
           go-version-file: src/go.mod
           cache-dependency-path: src/go.sum
       - name: Verify controller source and workflows
-        run: |
-          make runtime-version-test repository-validate workflow-validate test test-race vet
+        run: make verify
 
   build:
     name: build-${{ matrix.architecture }}