fix(ci): Prefer go.work for toolchain info

[dmihalcik-virtru]

Proposed Changes

• We have been setting toolchain explicitly to satisfy govulncheck
• Setting it in the go.work file lets us keep everything up to date while only editing one file
• Updates toolchain to latest on current minor branch: 1.25.9

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

• Chores
  • Removed explicit per-module toolchain pins in favor of the workspace-specified toolchain.
  • CI workflows now derive the Go toolchain from the workspace file instead of hardcoded versions.
  • Workspace regeneration preserves and conditionally restores the original toolchain when present, and skips unnecessary work for leaf modules to avoid unintended changes.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines how Go toolchain versions are managed within the CI pipeline. By centralizing the toolchain definition in the workspace file and ensuring it is preserved during automated workspace regeneration, the changes ensure consistent Go version usage across various CI tasks.

Highlights

• CI Script Update: Updated .github/scripts/work-init.sh to capture and restore the toolchain directive from go.work during workspace regeneration.
• Go Module Cleanup: Removed redundant toolchain directives from multiple go.mod files across the repository to centralize toolchain management in go.work.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

• Ignored by pattern: .github/workflows/** (2)
  • .github/workflows/checks.yaml
  • .github/workflows/sonarcloud.yml
• Ignored by pattern: protocol/**/* (1)
  • protocol/go/go.mod

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

The workspace shifts and changes form, / To keep the build safe from the storm. / The toolchain stays, a steady guide, / With versions locked, side by side.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Preserve and restore the Go toolchain directive when regenerating go.work; skip workspace rebuild for designated leaf packages; remove explicit toolchain go1.25.8 lines from multiple go.mod files; update CI to source Go version from go.work rather than hardcoded versions.

Changes

Cohort / File(s)	Summary
Work-init script .github/scripts/work-init.sh	Read and store original toolchain from go.work into ORIG_TOOLCHAIN, skip rebuild for leaf packages (exit 0), regenerate go.work/go.work.sum, and conditionally restore toolchain via go work edit -toolchain="$ORIG_TOOLCHAIN" when non-empty.
CI workflows .github/workflows/checks.yaml, .github/workflows/sonarcloud.yml	Change Go setup to derive toolchain from go.work (go-version-input: "" / go-version-file: go.work) instead of using pinned go-version fields.
Module manifests (toolchain removal) examples/go.mod, lib/fixtures/go.mod, lib/flattening/go.mod, lib/identifier/go.mod, lib/ocrypto/go.mod, protocol/go/go.mod, sdk/go.mod, service/go.mod, test/integration/go.mod, tests-bdd/go.mod	Removed toolchain go1.25.8 directives from multiple go.mod files; go directive and dependency blocks remain unchanged.

Sequence Diagram(s)

sequenceDiagram
    participant Script as Work-init.sh
    participant File as go.work
    participant GoCLI as go CLI

    Script->>File: read toolchain directive (if present)
    Script->>Script: store ORIG_TOOLCHAIN
    Script->>File: delete/regenerate go.work and go.work.sum
    Script->>GoCLI: run workspace init/rebuild commands (unless leaf package -> exit)
    alt ORIG_TOOLCHAIN non-empty
        Script->>GoCLI: run `go work edit -toolchain="$ORIG_TOOLCHAIN"`
        GoCLI-->>File: write toolchain entry
    end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix(ci): Dont fail on govulncheck #3257: Modifies the same govulncheck step in .github/workflows/checks.yaml (changes to Go version sourcing).
• fix(deps): bump moby/buildkit to v0.28.1 for govulncheck #3225: Related edits to Go toolchain directives and tests-bdd toolchain configuration.

Suggested reviewers

• pflynn-virtru
• jentfoo
• c-r33d

Poem

"I’m a rabbit in a modular dell,
I nudged the toolchains, gave them smell,
Saved the old value, skipped the leaf race,
Restored the tune, left workspace in place. 🐇"

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: shifting toolchain configuration from explicit Go version pinning to using go.work as the single source of truth.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-2565-golang-toolchain-simplify

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

X-Test Failure Report

opentdfplatformV4175V.dockerbuild
govulncheck-failure-2

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	173.001469ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	81.860681ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	386.966061ms
Throughput	258.42 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.818983904s
Average Latency	406.289476ms
Throughput	122.49 requests/second

[gemini-code-assist]

Code Review

This pull request removes the 'toolchain' directive from various 'go.mod' files and updates the '.github/scripts/work-init.sh' script to preserve and restore the toolchain directive during workspace regeneration. I have suggested an improvement to the toolchain extraction logic using a more efficient 'awk' command and noted that the restoration logic should be scoped to avoid redundant operations on leaf packages.

[Copilot]

Pull request overview

This PR centralizes Go toolchain/version selection in go.work (instead of repeating toolchain directives across module go.mod files) and updates CI to read the version from go.work, keeping patch-level toolchain configuration in one place.

Changes:

• Remove toolchain go1.25.8 directives from module go.mod files.
• Update CI workflows to use go-version-file: go.work for Go setup / govulncheck execution.
• Update .github/scripts/work-init.sh to preserve and restore the toolchain directive when regenerating go.work in release-branch validation flows.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests-bdd/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
test/integration/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
service/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
sdk/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
protocol/go/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
lib/ocrypto/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
lib/identifier/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
lib/flattening/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
lib/fixtures/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
examples/go.mod	Removes per-module toolchain directive to rely on workspace toolchain configuration.
.github/workflows/sonarcloud.yml	Switches Go setup to read version from go.work.
.github/workflows/checks.yaml	Switches govulncheck to read Go version from go.work.
.github/scripts/work-init.sh	Preserves/restores toolchain in regenerated go.work to keep CI version selection stable.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	188.52227ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	95.266195ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	389.37154ms
Throughput	256.82 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.234011666s
Average Latency	401.055646ms
Throughput	124.27 requests/second

[github-actions]

X-Test Failure Report

✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatform6J16JM.dockerbuild

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	195.031346ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	97.552842ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	395.129718ms
Throughput	253.08 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.783972669s
Average Latency	396.330397ms
Throughput	125.68 requests/second

[github-actions]

X-Test Results

✅ go-pull-3285
✅ go-v0.9.0
✅ java-pull-3285
✅ js-pull-3285
✅ java-v0.9.0
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformW6V6B8.dockerbuild
govulncheck-failure-2
govulncheck-failure-7

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/scripts/work-init.sh:
- Around line 75-76: The script currently runs go work edit
-toolchain="$ORIG_TOOLCHAIN" and immediately echoes a success message; update
the block that invokes go work edit to check the command exit status (or use set
-e around it) and only echo "[INFO] Restored toolchain ${ORIG_TOOLCHAIN} in
go.work" when go work edit succeeds; if it fails, emit an error like "[ERROR]
Failed to restore toolchain ${ORIG_TOOLCHAIN}: <error>" and exit with a non-zero
status so CI fails instead of continuing with a wrong Go version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a9916964-10dc-4d38-923a-1a7526e6596a

📥 Commits

Reviewing files that changed from the base of the PR and between a08a36c and 8e60ad4.

📒 Files selected for processing (1)

• .github/scripts/work-init.sh

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	188.329205ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	89.884735ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	411.526229ms
Throughput	243.00 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.609398125s
Average Latency	414.235318ms
Throughput	120.17 requests/second

[github-actions]

X-Test Results

✅ go-pull-3285
✅ java-pull-3285
✅ go-v0.9.0
✅ js-pull-3285
✅ java-v0.9.0
test-cases-mapping-report
bats-test-results
✅ js-v0.9.0
cukes-report
opentdfplatform1LNGHN.dockerbuild
govulncheck-failure-2
govulncheck-failure-7

[dmihalcik-virtru]

We can try it, however this will likely make dependabot updates require more manual effort if they need a go version update (not clear if the tool will update the go.work)

AFAIK dependabot only updates the toolchain as a side effect of dep updates, so it isn't predictable already. It will continue to add toolchain directives to the go.mod files if a dep adds a toolchain dep greater than the one in the go.work, but it will disappear with mod tidy when the go.work is updated past it.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	166.70838ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	89.380112ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	421.009659ms
Throughput	237.52 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.720791471s
Average Latency	415.638401ms
Throughput	119.84 requests/second

[github-actions]

X-Test Results

✅ go-pull-3285
✅ java-pull-3285
✅ js-pull-3285
✅ go-v0.9.0
✅ java-v0.9.0
test-cases-mapping-report
bats-test-results
✅ js-v0.9.0
cukes-report
opentdfplatformQC8IXC.dockerbuild
govulncheck-failure-7

[dmihalcik-virtru]

I've added a commit to include the new otdfctl go.mod, as well as consolidate the setup-go actions on go.work

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	157.28164ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	77.289309ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	346.780433ms
Throughput	288.37 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	35.628972405s
Average Latency	355.354526ms
Throughput	140.34 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• examples
• otdfctl
• sdk
• service
• lib/fixtures
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-pull-3285
✅ go@main-v0.9.0
✅ java@main-pull-3285
✅ java@main-v0.9.0
✅ js@main-pull-3285
✅ js@main-v0.9.0
cukes-report
opentdfplatform71CIIH.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-1
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-5