Upgrade to Go 1.27.1 and address the lint findings it surfaces

.github/scripts/offline-upgrade-test.sh

@@ -24,6 +24,15 @@ die() {
   exit 1
 }
 
+go_toolchain_for() {
+  local worktree="$1"
+  local version
+  version="$(awk '$1 == "go" { print $2; exit }' "$worktree/go.mod")"
+  [[ -n "$version" ]] || die "go.mod in $worktree does not declare a Go version"
+  [[ "$version" =~ ^[0-9]+\.[0-9]+$ ]] && version="$version.0"
+  printf 'go%s\n' "$version"
+}
+
 offline_phase_test_path() {
   case "$1" in
     source)
@@ -121,6 +130,7 @@ run_phase() {
   local test_suffix
   local upgrade_list
   local file_phase
+  local go_toolchain
   case "$phase" in
     source)
       test_suffix=Source
@@ -140,14 +150,15 @@ run_phase() {
     *) die "unknown offline upgrade phase $phase" ;;
   esac
   install_phase_tests "$worktree" "$file_phase"
+  go_toolchain="$(go_toolchain_for "$worktree")"
 
-  log "Running $UPGRADE_TAG offline $phase phase against $(git -C "$worktree" rev-parse --short HEAD)"
+  log "Running $UPGRADE_TAG offline $phase phase with $go_toolchain against $(git -C "$worktree" rev-parse --short HEAD)"
   (
     cd "$worktree"
     local tests
     local listing_stdout="$ARTIFACT_ROOT/$phase-list.stdout"
     local listing_stderr="$ARTIFACT_ROOT/$phase-list.stderr"
-    if ! go test \
+    if ! GOTOOLCHAIN="$go_toolchain" go test \
       -tags="$UPGRADE_TAG,offline_upgrade,upgrade_$file_phase" \
       -list "^Test.*OfflineUpgrade${test_suffix}$" \
       ./app >"$listing_stdout" 2>"$listing_stderr"; then
@@ -164,6 +175,7 @@ run_phase() {
     UPGRADE_TEST_PHASE="$phase" \
       UPGRADE_TEST_ARTIFACT="$STATE_ARTIFACT" \
       UPGRADE_VERSION_LIST="$upgrade_list" \
+      GOTOOLCHAIN="$go_toolchain" \
       go test \
         -tags="$UPGRADE_TAG,offline_upgrade,upgrade_$file_phase" \
         -run "^Test.*OfflineUpgrade${test_suffix}$" \

.github/scripts/release-upgrade-test.sh

@@ -31,6 +31,15 @@ die() {
   exit 1
 }
 
+go_toolchain_for() {
+  local worktree="$1"
+  local version
+  version="$(awk '$1 == "go" { print $2; exit }' "$worktree/go.mod")"
+  [[ -n "$version" ]] || die "go.mod in $worktree does not declare a Go version"
+  [[ "$version" =~ ^[0-9]+\.[0-9]+$ ]] && version="$version.0"
+  printf 'go%s\n' "$version"
+}
+
 validate_inputs() {
   [[ "$UPGRADE_LEAD_SECONDS" =~ ^[0-9]+$ ]] ||
     die "upgrade_lead_seconds must be an integer"
@@ -188,10 +197,12 @@ build_binary() {
   local label="$3"
   local source_commit
   local source_version
+  local source_go_toolchain
   local go_mod_cache
   local go_build_cache
   source_commit="$(git -C "$source_dir" rev-parse HEAD)"
   source_version="$(git -C "$source_dir" describe --tags --always)"
+  source_go_toolchain="$(go_toolchain_for "$source_dir")"
   go_mod_cache="$(go env GOMODCACHE)"
   go_build_cache="$(go env GOCACHE)"
   mkdir -p "$go_mod_cache" "$go_build_cache"
@@ -206,6 +217,7 @@ build_binary() {
     -w /sei-protocol/sei-chain \
     -e LEDGER_ENABLED=false \
     -e GOFLAGS=-buildvcs=false \
+    -e "GOTOOLCHAIN=$source_go_toolchain" \
     -e "BUILD_COMMIT=$source_commit" \
     -e "BUILD_VERSION=$source_version" \
     sei-chain/localnode \

.github/workflows/cross-arch-build.yml

@@ -25,9 +25,9 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
 
       - name: Install system dependencies
         run: |
@@ -65,9 +65,9 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
 
       - name: Install system dependencies
         run: |
@@ -248,9 +248,9 @@ jobs:
           submodules: true
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
 
       - name: Install system dependencies
         run: |

.github/workflows/eth_blocktests.yml

@@ -53,9 +53,9 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
 
       - name: Clone ETH Blocktests
         run: |

.github/workflows/execution-specs.yml

@@ -27,9 +27,9 @@ jobs:
     steps:
       # See: https://github.com/actions/checkout/releases/tag/v7.0.0
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
           cache-dependency-path: go.sum
       - name: Restore ethereum/tests fixtures
         uses: actions/cache@v4
@@ -114,9 +114,9 @@ jobs:
           labels: sei-chain.ci-run-id=${{ github.run_id }}
           cache-from: type=registry,ref=${{ env.GHCR_RPCNODE }}:cache
           cache-to: type=registry,ref=${{ env.GHCR_RPCNODE }}:cache,mode=max
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
       - name: Build seid in localnode image
         env:
           DOCKER_PLATFORM: linux/amd64

.github/workflows/go-test.yml

@@ -13,7 +13,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
 
 env:
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.27.1'
   GO_TEST_TIMEOUT: 30m
   # state_db tests run in their own workflow (sei-db-tests.yml); exclude
   # that subtree everywhere in this workflow to avoid double-running them.
@@ -33,7 +33,7 @@ jobs:
           # branches, so checkout must include their remote refs.
           fetch-depth: 0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: false
@@ -90,7 +90,7 @@ jobs:
           # Depth 0 for PRs so merge-base diff against the base branch works.
           fetch-depth: ${{ github.event_name == 'pull_request' && '0' || '1' }}
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         if: github.event_name != 'merge_group'
         with:
           go-version: ${{ env.GO_VERSION }}

.github/workflows/golangci.yml

@@ -22,18 +22,18 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v6
-        with:
-          go-version: '1.25.6'
       # See: https://github.com/actions/checkout/releases/tag/v7.0.0
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.8.0
+          version: v2.13.2
           args: --timeout 10m0s
       # Separate from the step above because that one honours run.tests, which is false,
       # so its gofmt/goimports formatters never see a _test.go file. `fmt` ignores
-      # run.tests and so covers them. Keep the version in step with the Makefile.
+      # run.tests and so covers them. Keep the golangci-lint version in step with the Makefile.
       - name: gofmt/goimports (including tests)
-        run: go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.8.0 fmt --diff
+        run: GOTOOLCHAIN="$(./scripts/go-toolchain.sh)" go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2 fmt --diff

.github/workflows/goreleaser-release.yml

@@ -20,5 +20,5 @@ jobs:
     uses: sei-protocol/uci/.github/workflows/goreleaser-release.yml@v0.0.11
     with:
       ref: ${{ inputs.tag }}
-      go-version: '1.25.6'
+      go-version: '1.27.1'
       submodules: 'false'

.github/workflows/integration-test.yml

@@ -149,9 +149,9 @@ jobs:
           labels: sei-chain.ci-run-id=${{ github.run_id }}
           cache-from: type=registry,ref=${{ env.GHCR_LOCALNODE }}:cache
           cache-to: ${{ github.event_name == 'push' && format('type=registry,ref={0}:cache,mode=max', env.GHCR_LOCALNODE) || '' }}
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
       - name: Build seid and frozen RPC router binaries in localnode container
         env:
           DOCKER_PLATFORM: linux/amd64
@@ -277,9 +277,9 @@ jobs:
         run: command -v jq >/dev/null || sudo apt-get install -y jq
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
       - name: Login to GitHub Container Registry
         # See: https://github.com/docker/login-action/releases/tag/v4.2.0
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
@@ -441,9 +441,9 @@ jobs:
         run: bash .github/scripts/ci-relocate-docker-data-root.sh
       - name: Relocate Go caches to /mnt
         run: bash .github/scripts/ci-relocate-go-cache.sh
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
       - name: Install jq
         run: command -v jq >/dev/null || sudo apt-get install -y jq
       - name: Login to Docker Hub

.github/workflows/mock_balances_build.yml

@@ -25,9 +25,9 @@ jobs:
     steps:
       # See: https://github.com/actions/checkout/releases/tag/v7.0.0
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
 
       - name: Build with Mock Balances
         run: make install-mock-balances

.github/workflows/offline-upgrade-test.yml

@@ -40,10 +40,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      # See: https://github.com/actions/setup-go/releases/tag/v6
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
+      # See: https://github.com/actions/setup-go/releases/tag/v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
           cache: false
 
       - name: Run persisted cross-branch Go test

.github/workflows/release-upgrade-test.yml

@@ -76,10 +76,10 @@ jobs:
       - name: Relocate Go caches to /mnt
         run: bash .github/scripts/ci-relocate-go-cache.sh
 
-      # See: https://github.com/actions/setup-go/releases/tag/v6
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
+      # See: https://github.com/actions/setup-go/releases/tag/v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
 
       - name: Run coordinated release upgrade
         run: bash .github/scripts/release-upgrade-test.sh

.github/workflows/rocksdb-unit_tests.yml

@@ -18,9 +18,9 @@ jobs:
     name: RocksDB Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
-          go-version: '1.25.6'
+          go-version: '1.27.1'
       # See: https://github.com/actions/checkout/releases/tag/v7.0.0
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 

.github/workflows/seed-reachability.yml

@@ -34,7 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/sei-db-tests.yml

@@ -13,7 +13,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event_name == 'push' && github.sha || github.ref }}
 
 env:
-  GO_VERSION: '1.25.6'
+  GO_VERSION: '1.27.1'
   GO_TEST_TIMEOUT: 30m
   STATE_DB_PKG_PREFIX: github.com/sei-protocol/sei-chain/sei-db/state_db
 
@@ -29,7 +29,7 @@ jobs:
         with:
           fetch-depth: 1
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: false
@@ -88,7 +88,7 @@ jobs:
           # Depth 0 for PRs so merge-base diff against the base branch works.
           fetch-depth: ${{ github.event_name == 'pull_request' && '0' || '1' }}
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@v7
         if: github.event_name != 'merge_group'
         with:
           go-version: ${{ env.GO_VERSION }}

.github/workflows/uci-go-lint.yml

@@ -22,4 +22,4 @@ jobs:
     name: Go
     uses: sei-protocol/uci/.github/workflows/go-lint.yml@v0.0.9
     with:
-      go-version: '1.25.6'
+      go-version: '1.27.1'

.github/workflows/uci-release-publish.yml

@@ -40,7 +40,7 @@ jobs:
     uses: sei-protocol/uci/.github/workflows/goreleaser-release.yml@v0.0.11
     with:
       ref: ${{ github.ref_type == 'tag' && github.ref_name || needs.publish.outputs.version }}
-      go-version: '1.25.6'
+      go-version: '1.27.1'
       # Repo submodules are Solidity test libs (forge-std/openzeppelin/solmate); the
       # seid binary build doesn't use them, so skip the fetch.
       submodules: 'false'

.golangci.yml

@@ -11,22 +11,29 @@ linters:
     - bodyclose
     - dogsled
     - errcheck
-    - goconst
+    # goconst is deliberately not enabled: it is more noise than it is worth.
     - gosec
     - govet
     - ineffassign
     - misspell
     - prealloc
     - staticcheck
     - unconvert
-    - misspell
   exclusions:
     paths:
       - ".*\\.pb\\.go$"
+      # Frozen, versioned copies of consensus-critical code are never edited for lint.
+      - "^(precompiles/[^/]+|utils/helpers)/legacy/"
     rules:
       - linters:
           - gosec
         text: "Use of weak random number generator"
+      # Any edit to precompiles/p256/ makes scripts/bump_version archive a new legacy copy,
+      # so the deprecated elliptic/ecdsa coordinate use is silenced here rather than in source.
+      - linters:
+          - staticcheck
+        path: "^precompiles/p256/verifier\\.go$"
+        text: "SA1019"
 
 formatters:
   enable: