chore: bump go.work toolchain to go1.25.14 by dmihalcik-virtru · Pull Request #3930 · opentdf/platform

dmihalcik-virtru · 2026-09-01T02:57:05Z

Part 01 of 20 in the DSPX-2604 re-cut. Base branch: main.

This stack replaces #3782 / #3865 / #3921, which stay open and untouched
until it lands. Nothing here is a rebase of those branches — the work was
re-cut from the ticket so each PR stands on its own.

Proposed Changes

Two unrelated one-line cleanups peeled out of the DSPX-2604 stack so they
stop inflating a feature diff.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

make build && make test

The full DSPX-2604 stack — 20 PRs

#	PR	Based on
01	#3930 chore: bump go.work toolchain to go1.25.12 and simplify an rt_test condition	`main`
02	#3931 feat(sdk): make the zipstream clock injectable for deterministic ZIP output	`main`
03	#3932 fix(sdk): reject a zipstream write set that omits segment 0	#3931
04	#3933 fix(sdk): map ReadAt plaintext offsets from cumulative segment sizes	`main`
05	#3934 chore(sdk): extract integrityAlgorithmString, createPolicyBinding, signAssertions	`main`
06	#3935 chore(sdk): add direct tests for createKeyAccess, encryptMetadata and tdfSalt	`main`
07	#3936 fix(sdk): fill each segment with io.ReadFull and size the buffer to the input	`main`
08	#3937 chore(cli): move streaming IO helpers into pkg	`main`
09	#3938 fix(cli): stream encrypt instead of buffering the whole payload	#3937
10	#3939 fix(cli): stream decrypt and inspect instead of buffering	#3938
11	#3940 feat(sdk): add a chunked segment writer (experimental)	`dspx-2604-base-11` = #3932 + #3934 + #3935
12	#3941 fix(sdk): stop GetManifest from splitting the key under the lock	#3940
13	#3942 fix(sdk): reject a chunked split naming a KAS with no resolved public key	#3941
14	#3943 chore(sdk): alias experimental/tdf manifest and assertion types	#3942
15	#3944 fix(sdk): emit spec-compliant key access in experimental/tdf and delegate Writer	#3943
16	#3945 feat(sdk): accept io.Reader in CreateTDF and drop the 64 GB payload cap	#3936
17	#3946 chore(sdk): rewrite CreateTDF on top of the chunked writer	`dspx-2604-base-17` = #3944 + #3945
18	#3947 chore(sdk): drop dead TDFConfig fields and deprecate the TDFFormat enum	#3946
19	#3948 fix(cli): drop the encrypt-side stdin spool	`dspx-2604-base-19` = #3947 + #3939
20	#3949 feat(sdk): graduate the chunked writer to stable API	#3948

Reviewable in parallel right now, since they sit directly on main and depend on
nothing else: 01, 02, 04, 05, 06, 07, 08.

Why three PRs have a dspx-2604-base-* base. A GitHub PR takes one base branch,
but 11, 17 and 19 each build on more than one parent. The base-* branches are empty
merge commits that exist only to join those parents so the PR diff shows exactly its
own change and nothing else. They contain no code, have no PR of their own, and go
away once their parents land — retarget the child onto main at that point.

Wants a cross-SDK xtest run before merge: 15, 17 (and therefore 20). They touch
the KAS wire format.

Red checks you may see are network flakes, not this stack. Four distinct ones hit
this batch and all clear on re-run: golangci-lint config verify timing out on
https://golangci-lint.run/.../golangci.v2.8.jsonschema.json (fails the whole go (<module>) job and fail-fast cancels its siblings), the bats installer getting a 403,
Docker Hub timing out on keycloak/keycloak:26.4, and buf reporting "the server
hosted at that remote is unavailable" while the Java SDK generates sources. The
govulncheck step also emits ##[error] annotations against the go1.25.11 stdlib, but
it is continue-on-error: true and never fails a job — 01 bumps the toolchain and
clears those annotations.

coderabbitai · 2026-09-01T02:58:17Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Team

Run ID: ccee14bc-0960-4143-a577-c29464d8592a

📥 Commits

Reviewing files that changed from the base of the PR and between ed6500d and 4e09d99.

⛔ Files ignored due to path filters (1)

go.work is excluded by !**/*.work

📒 Files selected for processing (1)

service/rttests/rt_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The change removes redundant parentheses from the decrypt error condition after io.Copy. The behavior remains unchanged.

Changes

Decrypt Error Handling

Layer / File(s)	Summary
Simplify decrypt error condition `service/rttests/rt_test.go`	The condition preserves EOF handling while using simplified syntax.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 4e09d

This PR updates the workspace Go toolchain and makes a behavior-preserving test cleanup. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: alkalescent

Poem

A rabbit checks the decrypting stream

Parentheses vanish, neat and clean
EOF still hops along
The logic stays strong
One tiny change keeps code serene

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	⚠️ Warning	The title identifies the Go toolchain update, which is part of the stated objective. However, it specifies Go 1.25.14 while the objective states that the change updates the toolchain to Go 1.25.12.	Correct the title to use the implemented version, for example: "chore: bump go.work toolchain to go1.25.12".

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dspx-2604-01-chore-toolchain

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-01T03:02:59Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	246.305523ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	143.002593ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	455.495988ms
Throughput	219.54 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.706227965s
Average Latency	426.36431ms
Throughput	117.08 requests/second

github-actions · 2026-09-01T03:11:36Z

Copilot

Pull request overview

Maintenance-only cleanup to keep the DSPX-2604 stack’s feature diffs smaller: updates the workspace toolchain patch level and simplifies a minor condition in an RTT test helper.

Changes:

Bump go.work toolchain from go1.25.11 to go1.25.12.
Simplify a boolean condition in service/rttests/rt_test.go when checking io.Copy’s error.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
go.work	Updates the workspace toolchain version to `go1.25.12`.
service/rttests/rt_test.go	Removes redundant parentheses in an `errors.Is(err, io.EOF)` condition after `io.Copy`.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…ndition Picks up the go1.25.13 security release (net/http h2c ReadHeaderTimeout, crypto/tls post-handshake message limit, encoding/asn1 and encoding/xml recursion guards, html/template regexp context tracking, x/net/idna Punycode, x/mod/sumdb tlog verification) plus go1.25.14.

github-actions · 2026-09-01T13:55:58Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	218.185883ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	121.053021ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	451.170497ms
Throughput	221.65 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	58.361928538s
Average Latency	581.844884ms
Throughput	85.67 requests/second

github-actions · 2026-09-01T13:56:59Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
tests-bdd

See the workflow run for details.

github-actions · 2026-09-01T14:04:27Z

X-Test Results

✅ go@pull-3930-pull-3930
✅ go@main-pull-3930
✅ go@pull-3930-main
✅ go@main-v0.9.0
✅ java@main-pull-3930
✅ go@main-main
✅ java@main-main
✅ js@main-pull-3930
cukes-report
✅ go@pull-3930-v0.9.0
✅ js@main-main
✅ js@main-v0.9.0
✅ java@main-v0.9.0
opentdf~~platform~~R8DGDI.dockerbuild
govulncheck-failure-8
govulncheck-failure-1

dmihalcik-virtru requested a review from a team as a code owner September 1, 2026 02:57

github-actions Bot added the size/xs label Sep 1, 2026

dmihalcik-virtru requested a lite review from Copilot September 1, 2026 13:39

Copilot started reviewing on behalf of dmihalcik-virtru September 1, 2026 13:39 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

dmihalcik-virtru force-pushed the dspx-2604-01-chore-toolchain branch from 4e09d99 to d88d2dd Compare September 1, 2026 13:49

dmihalcik-virtru changed the title ~~chore: bump go.work toolchain to go1.25.12 and simplify an rt_test condition~~ chore: bump go.work toolchain to go1.25.14 Sep 1, 2026

pflynn-virtru approved these changes Sep 1, 2026

View reviewed changes

dmihalcik-virtru added this pull request to the merge queue Sep 1, 2026

Merged via the queue into main with commit 36eeab8 Sep 1, 2026
46 checks passed

dmihalcik-virtru deleted the dspx-2604-01-chore-toolchain branch September 1, 2026 18:46

Uh oh!

Conversation

dmihalcik-virtru commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (2 warnings)

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Sep 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Sep 1, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions Bot commented Sep 1, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dmihalcik-virtru commented Sep 1, 2026 •

edited

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading