Upgrade devcontainer go version to 1.24.6

[jaxtew]

Addresses go version mismatch when using the devcontainer as a result of this commit (bumps Go version from 1.24.5 to 1.24.6)

The current official devcontainer Go image used in this repository (1.24-bookworm) uses 1.24.5 and sets GOTOOLCHAIN to local. This PR overrides it to auto so that build commands automatically update to the correct version.

[silverwind]

Is is really a problem? go should download any newer toolchain version automatically, so if you are on 1.24.5 and go.mod requires 1.24.6, go should download the 1.24.6 toolchain automatically on first invocation.

Also, in any case I find this too much of hack, there should only be one place in the repo where we specify the minimum go version, which is go.mod.

[jaxtew]

@silverwind Only a "problem" for anyone wanting the devcontainer to Just Work. Unless I was doing something wrong, which is entirely possible, the make deps command that automatically runs when the devcontainer finishes building will just exit instead of upgrading itself to use the minimum version. I haven't used Go in a while, maybe I'm missing something simple.

I agree with this being a hack.

[silverwind]

Do have any logs from when it exits?

[silverwind]

I suspect the bug may be in go-check:

gitea/Makefile

Lines 199 to 207 in 6619b1e

	.PHONY: go-check
	go-check:
	$(eval MIN_GO_VERSION_STR := $(shell grep -Eo '^go\s+[0-9]+\.[0-9]+' go.mod | cut -d' ' -f2))
	$(eval MIN_GO_VERSION := $(shell printf "%03d%03d" $(shell echo '$(MIN_GO_VERSION_STR)' | tr '.' ' ')))
	$(eval GO_VERSION := $(shell printf "%03d%03d" $(shell $(GO) version | grep -Eo '[0-9]+\.[0-9]+' | tr '.' ' ');))
	@if [ "$(GO_VERSION)" -lt "$(MIN_GO_VERSION)" ]; then \
	echo "Gitea requires Go $(MIN_GO_VERSION_STR) or greater to build. You can get it at https://go.dev/dl/"; \
	exit 1; \
	fi

It only checks 2-part version syntax but we recently changed to 3-part.

[jaxtew]

I also found that setting GOTOOLCHAIN to auto gets it to upgrade itself. I think the packaged image sets it to local

[jaxtew]

Do have any logs from when it exits?

VS Code output:

[10843 ms] Start: Run in container: /bin/sh -c make deps
go mod download
go: go.mod requires go >= 1.24.6 (running go 1.24.5; GOTOOLCHAIN=local)
make: *** [Makefile:823: deps-backend] Error 1
[11756 ms] postCreateCommand failed with exit code 2. Skipping any further user-provided commands.
Done. Press any key to close the terminal.

[silverwind]

Hmm yeah, GOTOOLCHAIN=local definitely is a problem. It worked before when we specified go 1.24 in go.mod, but with 3-digit syntax in go.mod added in 7bd2ce7, it has become strict. I wonder what the reason for GOTOOLCHAIN=local is in the devcontainer image.

[jaxtew]

Looks like the official Golang image has it set. Image references this issue as the proposal for setting it.

[techknowlogick]

I think we could reasonably set it to auto in our devcontainer, as it makes sense for containers themselves, as it makes things less-deterministic (not that containers always are), but this is for development where it's a benefit for the developer to use the expected version instead of the one that is hardcoded in the image.

[silverwind]

According to devcontainers/images#921 (comment), devcontainer images only publish once a month, so they lag behind in go patch releases.

This is a stopgap solution. Ultimately, I would prefer if we set go.mod to minimum version "1.24.0" and stop updating go.mod on every patch release.

[techknowlogick]

Ultimately, I would prefer if we set go.mod to minimum version "1.24.0" and stop updating go.mod on every patch release.

That's my preference too. Sadly, we cannot, as it flags for several widely used "CVE" scanners, creating a headache as people report false positives.

[silverwind]

Sounds like those scanners misinterpret the go directive. It's a minimum version, not the version being ran (which should be assumed to be latest patch release). Can you link me to said scanners that have this problem?