[np5]

Standardises on the go + toolchain split that terraform-provider-zentral already used.

What changes

-go 1.26.9
+go 1.26.0
+toolchain go1.26.9

The two directives mean different things and go 1.26.9 conflated them:

• go is the minimum language version the module requires — a floor, and for consumers of the module, a constraint.
• toolchain is what actually builds it.

Declaring 1.26.9 as the language floor claims the code needs 1.26.9 language features, which it does not.

Nothing about the build changes

setup-go resolves the toolchain directive, so go-version-file: go.mod keeps installing 1.26.9 — verified on terraform-provider-zentral, whose govulncheck run reports Successfully set up Go version 1.26.9 from exactly this shape of go.mod.

Demonstrated the other half too: in a golang:1.25.3 container with GOTOOLCHAIN=auto, the directive makes Go fetch and switch to 1.26.9 on its own (go version go1.26.9). An older local toolchain now upgrades itself rather than silently building with the wrong one.

Verification

Built and vetted in golang:1.26.9; go mod verify clean.

🤖 Generated with Claude Code

[np5]

Closing: the rationale did not hold up under checking.

I framed the go/toolchain split as best practice. The Go documentation supports it specifically for modules that are dependencies of other modules -- a library needing a floor lower than its preferred toolchain (go.dev/doc/toolchain). That is goztl's case, not this one: nothing imports osquery-extension, so the go line constrains no consumer.

Nor is the split common practice. Of six widely-used Go projects checked -- golang/tools, grpc-go, aws-sdk-go-v2, kubernetes, terraform, prometheus -- none carries a toolchain line, and Go's own tooling does not produce one (go get go@1.26.9 writes go 1.26.9 alone). The applications among them (terraform go 1.26.8, prometheus go 1.26.7) pin a specific patch in go, which is exactly what this repo already had.

So go 1.26.9 as it stands on main is the conventional shape for an application, and this PR would have moved it to one no peer uses. No behaviour difference either way -- setup-go installs 1.26.9 from either -- so the change was churn.

The toolchain itself is unaffected: main stays on 1.26.9 with govulncheck required.