Upgrade to Go 1.27.1 and address the lint findings it surfaces

[masih]

Moves the module to Go 1.27.1 and golangci-lint v2.13.2 and fixes what the new linters report.

Toolchain

• go.mod, Dockerfiles and every workflow now target Go 1.27.1; setup-go bumped to v7, golangci-lint-action to v9.
• Go version is read from go.mod everywhere: new scripts/go-toolchain.sh (normalises a patch-less go 1.28 to go1.28.0) is shared by the Makefile, golangci.yml and mockery_generate.sh.
• upgradetest harness pins each worktree's toolchain from its own go.mod. Releases up to release/v6.7 cannot build on Go 1.27 (pinned cockroachdb/swiss); operators building old tags need the same.

Lint

• Frozen precompiles/*/legacy and utils/helpers/legacy trees are excluded in .golangci.yml, not edited. Live sei-cosmos/codec/legacy and x/auth/legacy stay linted.
• precompiles/p256/verifier.go is byte-identical to main; its SA1019 is silenced by a .golangci.yml path rule so bump_version does not mint a new legacy copy.
• goconst disabled (more noise than it is worth); duplicate misspell removed.
• Everything else is mechanical: reflect.Pointer, bytes.Clone, fmt.Fprintf, slices.*, stdlib cmp.Ordered, narrowed line-level //nolint with reasons.

Operator-facing changes (also in CHANGELOG.md)

• Snapshot format 1 → 2. Go 1.27 compress/flate emits different bytes for the same input; that reaches state-sync snapshots via the multistore zlib stream and the gzipped wasm code inside it. Upgraded nodes restore both formats; old binaries answer REJECT_FORMAT to format-2 snapshots, so keep old-binary snapshot providers up until the rollout completes.
• CommitSig.FromProto rejects a block_id_flag outside ABSENT/COMMIT/NIL at decode instead of truncating through uint8 (257 used to wrap to Absent and pass ValidateBasic).

Smaller behavioural effects

• p2p mux errors instead of silently truncating a frame header longer than 255 bytes.
• Tendermint HTTP client dials with the request context, so cancellation aborts a pending dial.
• EVM JSON-RPC error strings for malformed eth_call arguments changed wording (encoding/json v1 is now a shim over v2). Still geth-identical; the rpc integration tests, the exact-bytes gzip test and the JSON-error-text unit test were loosened accordingly.
• The json v2 shim promises identical marshal/unmarshal semantics; amino-JSON sign bytes and wasmvm Env/Info were checked, and the Determinism and geth-parity jobs pass.

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 11, 2026, 11:01 AM

[codecov]

Codecov Report

❌ Patch coverage is 59.81308% with 86 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.13%. Comparing base (9407b6d) to head (e795f73).

Files with missing lines	Patch %	Lines
sei-cosmos/x/auth/client/testutil/helpers.go	0.00%	19 Missing ⚠️
giga/deps/xevm/types/gov.go	12.50%	14 Missing ⚠️
x/evm/types/gov.go	12.50%	14 Missing ⚠️
sei-cosmos/client/rpc/validators.go	0.00%	4 Missing ⚠️
sei-cosmos/x/params/types/proposal/proposal.go	0.00%	4 Missing ⚠️
sei-tendermint/internal/rpc/core/mempool.go	0.00%	4 Missing ⚠️
sei-cosmos/x/distribution/types/proposal.go	0.00%	2 Missing ⚠️
sei-cosmos/x/gov/types/vote.go	0.00%	2 Missing ⚠️
sei-tendermint/cmd/tendermint/commands/debug/io.go	0.00%	2 Missing ⚠️
sei-tendermint/rpc/jsonrpc/server/http_server.go	33.33%	2 Missing ⚠️
... and 18 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4098      +/-   ##
==========================================
+ Coverage   61.58%   62.13%   +0.54%     
==========================================
  Files        2196     2106      -90     
  Lines      193825   182135   -11690     
==========================================
- Hits       119365   113161    -6204     
+ Misses      62888    61728    -1160     
+ Partials    11572     7246    -4326     

Flag	Coverage Δ
sei-chain-pr	72.43% <59.81%> (?)
sei-db	74.50% <ø> (+4.70%)	⬆️
sei-db-state-db	?
sei-db-state-db-pr	83.91% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cmd/autobahn-e2e/aws.go	66.56% <100.00%> (+13.55%)	⬆️
cmd/frozen-rpc-router/router.go	77.67% <100.00%> (+12.27%)	⬆️
config/registry/registry.go	99.22% <100.00%> (+0.77%)	⬆️
config/registry/resolve.go	96.75% <100.00%> (+1.38%)	⬆️
evmrpc/block.go	87.50% <ø> (+8.22%)	⬆️
evmrpc/info.go	86.57% <100.00%> (+9.88%)	⬆️
evmrpc/server.go	89.86% <100.00%> (+4.14%)	⬆️
evmrpc/tests/mock_client.go	53.89% <100.00%> (+4.54%)	⬆️
evmrpc/utils.go	81.10% <100.00%> (+8.29%)	⬆️
giga/deps/xevm/types/ethtx/access_list.go	100.00% <100.00%> (ø)
... and 70 more

... and 547 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

PR Summary

High Risk
State-machine breaking snapshot format and CommitSig decode changes affect rolling upgrades and state sync; the Go 1.27 toolchain also touches consensus-adjacent compression and broad CI/build surfaces.

Overview
This PR moves the repo to Go 1.27.1 and golangci-lint v2.13.2, wiring CI/Docker/Makefile/releases through setup-go@v7 and a shared scripts/go-toolchain.sh (also used by offline/release upgrade scripts so each worktree’s go.mod selects GOTOOLCHAIN).

Lint policy shifts with the bump: goconst is dropped, frozen legacy/ trees and a targeted precompiles/p256 SA1019 rule are added to .golangci.yml, plus mechanical fixes (reflect.Pointer, fmt.Fprintf, slices, narrowed nolint comments).

Operator / consensus impact (documented in CHANGELOG):

• Multistore state-sync snapshot format 1 → 2 because Go 1.27’s compress/flate changes zlib bytes; new nodes accept both formats, old binaries reject format 2.
• CommitSig.FromProto now errors on invalid block_id_flag values instead of truncating to uint8 (state-machine breaking).

Smaller follow-ons include loosened EVM eth_call JSON-RPC error substring tests (json v2 shim wording), EVM namespace constants, and protobuf descriptor byte churn from the toolchain.

^{Reviewed by Cursor Bugbot for commit e795f73. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

A large but overwhelmingly mechanical Go 1.27.1 / golangci-lint v2.13.2 upgrade; the behaviour-bearing parts (snapshot format 1→2 with dual-format restore, CommitSig.FromProto validation, the p2p frame-header bound, context-aware HTTP dialling) are documented in CHANGELOG.md and covered by updated tests, and the .pb.go churn is descriptor-bytes/comment reflow only. No blockers; a few maintainability and documentation nits around the new toolchain plumbing.

Findings: 0 blocking | 4 non-blocking | 2 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• [suggestion] integration_test/autobahn/README.md still states "Both targets require Go 1.25.6 and make", while cmd/autobahn-e2e/aws.go — the AWS target that README documents — now installs go1.27.1. Worth updating alongside the other version references.
• [suggestion] sei-tendermint/scripts/mockery_generate.sh also bumps mockery from v2.53.4 to v2.53.7, which is unrelated to the toolchain change and not mentioned in the PR description. No mocks are regenerated in this PR, so if the generator's output changed the committed mocks are now out of step with what the script produces.
• 2 suggestion(s)/nit(s) flagged inline on specific lines.

[seidroid]

[suggestion] Because this is a simple (:=) assignment, $(shell ./scripts/go-toolchain.sh) runs at parse time on every make invocation, not just the lint targets. scripts/build-static.sh runs make build inside golang:1.27.1-alpine, which has no bash (apk add build-base git doesn't pull it), so the script's #!/usr/bin/env bash fails there and every static build now emits env: can't execute 'bash' before proceeding with an empty GOTOOLCHAIN.

Switching to a recursive assignment (GOLANGCI_LINT = GOTOOLCHAIN=$(shell ./scripts/go-toolchain.sh) go run ...) confines the subprocess to the recipes that actually expand $(GOLANGCI_LINT), which is exactly the lint targets.

[seidroid]

[suggestion] This go_toolchain_for helper is copied verbatim into .github/scripts/release-upgrade-test.sh and upgradetest/compile_offline.sh, and it re-implements the same patch-less-version normalisation that the new scripts/go-toolchain.sh already owns — four places that must agree on the rule.

Since all three callers run from the current checkout, they can invoke the shared script instead if it takes the go.mod directory as an optional argument (defaulting to the repo root), e.g. "$REPO_ROOT/scripts/go-toolchain.sh" "$worktree". That puts the normalisation at the single choke point rather than at each caller.