build(deps): use patched Go toolchain and verify release dry runs

.github/workflows/ci.yml

@@ -50,7 +50,7 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9.3.0
         with:
-          version: v2.13.2
+          version: v2.15.0
           args: ./...
 
   minimum-go:

.github/workflows/release-legacy.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.26.x"
+          go-version-file: go.mod
           cache: true
 
       - name: Stash GoReleaser config

.github/workflows/release-unified.yml

@@ -7,6 +7,11 @@ on:
         description: "Version to release (for example, 0.3.5)"
         required: true
         type: string
+      dry_run:
+        description: "Build and verify without publishing a release or creating tags"
+        required: false
+        default: false
+        type: boolean
 
 permissions: {}
 
@@ -21,6 +26,7 @@ jobs:
     uses: openclaw/release-workflows/.github/workflows/release-go-cli.yml@v1
     with:
       version: ${{ inputs.version }}
+      dry-run: ${{ inputs.dry_run }}
       repository-type: personal
       homebrew-tap: steipete/homebrew-tap
       homebrew-formula: sonoscli

CHANGELOG.md

@@ -9,7 +9,8 @@
 - Label initial `watch` notifications with the correct service even when they arrive before subscription setup finishes.
 
 ### Changed
-- Prefer Go 1.26.8 for source, CI, and Docker builds while retaining Go 1.26 compatibility; refresh lint tooling, the Dockerfile frontend, and pinned documentation workflow actions.
+- Prefer Go 1.27.3 for source, CI, Docker, and release builds to fix reachable standard-library vulnerabilities while retaining Go 1.26 compatibility; refresh lint tooling, the Dockerfile frontend, and pinned documentation workflow actions.
+- Allow release workflow dry runs to build and verify the current version without creating tags or publishing a release.
 
 ## [0.3.4] - 2026-07-17
 

Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.27.0
 
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.27.3
 
 FROM golang:${GO_VERSION}-bookworm AS build
 WORKDIR /src

docs/testing.md

@@ -28,7 +28,8 @@ Expected:
 - All commands exit `0`
 - CI should match `.github/workflows/ci.yml` (`gofmt`, coverage, `golangci-lint`, race tests, `go vet`)
 - CI enforces a minimum total coverage of `75%` (statement coverage across `./...`) and a focused `85%` floor for the stream proxy package.
-- The main CI job uses the preferred Go 1.26.8 toolchain from `go.mod`; a separate job tests the Go 1.26.0 source minimum with automatic toolchain switching disabled.
+- The main CI job uses the preferred Go 1.27.3 toolchain from `go.mod`; a separate job tests the Go 1.26.0 source minimum with automatic toolchain switching disabled. Docker and release builds use the same patched toolchain.
+- To verify release builds without publishing or creating tags, dispatch `release-unified.yml` on `main` with the current version and `dry_run: true`.
 
 ## Live network test plan (manual)
 

go.mod

@@ -2,7 +2,7 @@ module github.com/steipete/sonoscli
 
 go 1.26
 
-toolchain go1.26.8
+toolchain go1.27.3
 
 require github.com/spf13/cobra v1.10.2
 

internal/streamproxy/server_test.go

@@ -424,7 +424,10 @@ func TestServeHandlesStreamOverHTTP(t *testing.T) {
 
 	cancel()
 	select {
-	case <-errCh:
+	case err := <-errCh:
+		if err != nil {
+			t.Fatalf("serve returned error: %v", err)
+		}
 	case <-time.After(2 * time.Second):
 		t.Fatalf("server did not stop")
 	}
@@ -478,7 +481,10 @@ func TestServeHandlesMultipleTracks(t *testing.T) {
 
 	cancel()
 	select {
-	case <-errCh:
+	case err := <-errCh:
+		if err != nil {
+			t.Fatalf("serve returned error: %v", err)
+		}
 	case <-time.After(2 * time.Second):
 		t.Fatalf("server did not stop")
 	}