fix(authbridge): Raise the workspace Go directive to 1.26.5

[huang195]

Problem

Any dependency update that raises a module's minimum Go version fails
Go CI (authlib), and reports it as four broken modules rather than one. From
#771 (bifrost/core 1.7.0 → 1.7.13):

go: module . listed in go.work file requires go >= 1.26.5, but go.work lists go 1.26.4
go: module ../cmd/abctl listed in go.work file requires go >= 1.26.5, ...
go: module ../cmd/authbridge-envoy listed in go.work file requires go >= 1.26.5, ...
go: module ../cmd/authbridge-proxy listed in go.work file requires go >= 1.26.5, ...

go-ci-authlib is the only Go job that reads go.work — the cmd/* matrix
(ci.yaml:86) and dependabot-tidy (dependabot-tidy.yml:33) both set
GOWORK: "off" — which is why one dependency bump surfaces as a single check
failing about four modules.

Dependabot only edits the directory it is updating, and authbridge/go.work sits
outside every configured gomod directory, so no Dependabot PR can fix it. Left
alone this recurs on every toolchain-raising bump.

Why go.work alone is not enough

The first attempt here bumped only go.work, and CI rejected it:

go: ../go.work requires go >= 1.26.5 (running go 1.26.4; GOTOOLCHAIN=local)

actions/setup-go exports GOTOOLCHAIN=local itself — it is absent from
ci.yaml, which makes it easy to assume the default auto — and installs the
version named by go-version-file: authbridge/authlib/go.mod. A toolchain pinned
at 1.26.4 and forbidden from upgrading can never satisfy a go.work asking for
1.26.5.

So the module directives must move with go.work: authlib/go.mod is what
selects the CI toolchain, and no module that replaces authlib may declare an
older Go than authlib.

Change

go 1.26.4 → go 1.26.5, one line each, across go.work and all seven
workspace modules. No toolchain directives exist in any of them, and no
go.sum is affected.

This is not speculative: #771 already raises four of the seven, so the floor is
moving regardless. Doing it deliberately keeps GOTOOLCHAIN=local hermetic and
turns #771's rebase into a no-op on these lines.

Collateral checked

Consumer	Effect
Go CI (authlib)	installs 1.26.5 from authlib/go.mod; go.work satisfied
Go CI (authbridge proxy/envoy)	installs 1.26.5 from its own go.mod; GOWORK: "off"
dependabot-tidy	reads the same authlib/go.mod, so GOTOOLCHAIN: local stays satisfied
cmd/* Dockerfiles	golang:1.26-alpine; 1.26.7 is released
abctl, cpex, praxis, storage/redis	no CI job, but they replace authlib so they move with it

Demo modules are untouched — they are standalone (golang:1.24-alpine) and do not
replace authlib.

Unblocks

• chore: bump github.com/maximhq/bifrost/core from 1.7.0 to 1.7.13 in /authbridge/authlib #771 — bifrost/core 1.7.0 → 1.7.13 (rebase after this merges)
• Any future bump that raises a module's Go floor

Assisted-By: Claude Code

Summary by CodeRabbit

• Chores
  • Updated the required Go version to 1.26.5 across AuthBridge components.
  • No user-facing functionality or API behavior changed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 21dffebd-2e63-48da-8feb-b028bb07fa94

📥 Commits

Reviewing files that changed from the base of the PR and between 9f593b0 and 934843e.

⛔ Files ignored due to path filters (1)

• authbridge/go.work is excluded by !**/*.work

📒 Files selected for processing (7)

• authbridge/authlib/go.mod
• authbridge/cmd/abctl/go.mod
• authbridge/cmd/authbridge-cpex/go.mod
• authbridge/cmd/authbridge-envoy/go.mod
• authbridge/cmd/authbridge-praxis/go.mod
• authbridge/cmd/authbridge-proxy/go.mod
• authbridge/storage/redis/go.mod

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates the declared Go version from 1.26.4 to 1.26.5 in seven modules. No dependencies, replace directives, or exported declarations change.

Changes

Go module version alignment

Layer / File(s)	Summary
Update module version directives authbridge/*/go.mod, authbridge/cmd/*/go.mod	Seven module files now declare Go version 1.26.5 instead of 1.26.4.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 93484

This is a localized Go version alignment change with no actionable merge-blocking risk remaining beyond normal checks and review.

Suggested reviewers: ibrahim2595, araujof

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: raising the Authbridge workspace Go directive to 1.26.5.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (7 skipped: 7 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/go-work-go-1.26.5

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.12.2)

level=error msg="Running error: context loading failed: no go files to analyze: running go mod tidy may solve the problem"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}