chore: build the Go images on 1.27 so downstream modules can target it

keploy-ci-go-build/Dockerfile

@@ -1,6 +1,6 @@
 # keploy-ci-go-build: Go + MinGW cross-compilers + MinIO client
 # Used by: go-test.yml download-and-build, prepare-and-run.yml build-and-upload-keploy
-FROM public.ecr.aws/docker/library/golang:1.26-bookworm
+FROM public.ecr.aws/docker/library/golang:1.27-bookworm
 
 RUN set -eux; \
     apt-get update; \

keploy-ci-golint/Dockerfile

@@ -1,11 +1,40 @@
 # keploy-ci-golint: Go + golangci-lint pre-installed
 # Used by: golangci-lint.yml
-FROM public.ecr.aws/docker/library/golang:1.26-bookworm
+FROM public.ecr.aws/docker/library/golang:1.27-bookworm
 
-ARG GOLANGCI_LINT_VERSION=v2.9.0
+ARG GOLANGCI_LINT_VERSION=v2.13.2
 
+# golangci-lint is installed by hand rather than by piping upstream's
+# install.sh, which cannot install any version we are able to use here.
+#
+# From v2.13.0 the release publishes an SBOM alongside each archive, named
+# "<tarball>.sbom.json", so the checksums file carries two lines whose names
+# both CONTAIN the tarball name. install.sh looks the checksum up with an
+# unanchored grep:
+#
+#     want=$(grep "${BASENAME}" "${checksums}" | tr '\t' ' ' | cut -d ' ' -f 1)
+#
+# which matches both lines, leaves $want holding two hashes, and fails the
+# verify every time with a correctly downloaded archive:
+#
+#     err hash_sha256_verify checksum for '...-linux-amd64.tar.gz' did not verify
+#
+# v2.13.0 is also the first release built with Go 1.27, and golangci-lint
+# refuses to run when its build Go is older than the module's target, so every
+# version new enough for a `go 1.27.0` module hits that bug. Matching the
+# checksum line on the EXACT filename avoids it and keeps verification intact.
 RUN set -eux; \
     apt-get update && apt-get install -y --no-install-recommends jq && rm -rf /var/lib/apt/lists/*; \
-    curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh \
-      | sh -s -- -b /usr/local/bin "${GOLANGCI_LINT_VERSION}"; \
+    version="${GOLANGCI_LINT_VERSION#v}"; \
+    arch="$(dpkg --print-architecture)"; \
+    name="golangci-lint-${version}-linux-${arch}"; \
+    url="https://github.com/golangci/golangci-lint/releases/download/${GOLANGCI_LINT_VERSION}"; \
+    curl -sSfL "${url}/${name}.tar.gz" -o /tmp/golangci-lint.tar.gz; \
+    curl -sSfL "${url}/golangci-lint-${version}-checksums.txt" -o /tmp/golangci-lint-checksums.txt; \
+    want="$(awk -v f="${name}.tar.gz" '$2 == f { print $1 }' /tmp/golangci-lint-checksums.txt)"; \
+    test -n "${want}"; \
+    echo "${want}  /tmp/golangci-lint.tar.gz" | sha256sum -c -; \
+    tar -xzf /tmp/golangci-lint.tar.gz -C /tmp; \
+    install "/tmp/${name}/golangci-lint" /usr/local/bin/golangci-lint; \
+    rm -rf /tmp/golangci-lint.tar.gz /tmp/golangci-lint-checksums.txt "/tmp/${name}"; \
     golangci-lint --version

keploy-ci/Dockerfile

@@ -6,7 +6,7 @@
 # Linux binaries with CGO_ENABLED=0.
 FROM public.ecr.aws/docker/library/debian:trixie-slim
 
-ARG GO_VERSION=1.26.0
+ARG GO_VERSION=1.27.0
 # Keep Docker "major.minor" aligned with the latest stable release.
 ARG DOCKER_MAJOR_MINOR=29.1
 # Provided automatically by BuildKit/buildx; fallback to dpkg when unset.