build: bump Nix toolchain to Go 1.26

[Quentin-David-24]

Problem

main is red, and has been since #207. Every PR branched off it inherits the failure.

#207 pulled in golang.org/x/crypto v0.56.0 as a security update. That module declares go 1.26.0 in its own go.mod, which forced this module's go directive from go 1.25.10 to go 1.26.0. Nothing bumped the Nix toolchain to match, and both CI jobs run inside the dev shell:

Job	Failure
Dirty	can't load config: the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.0) — just lint exits 3
Tests	compile: version "go1.26.0" does not match go tool version "go1.25.2" building ./cmd under -race — exits 1

Reverting the go directive would mean dropping the security patch, so the toolchain has to move instead.

Fix

• flake.nix: goVersion = 25 → 26.
• flake.lock: the nixpkgs input had to move with it — the locked revision (b3d51a0, Nov 2025) has no go_1_26 attribute at all. Now on 8ce4ef6 (Sep 2026), which provides Go 1.26.7.
• .golangci.yml: new file, one exclusion — see below.

Why the lint exclusion

The nixpkgs update also carries golangci-lint 2.6.0 → 2.13.2, whose staticcheck reports SA1019 for the Temporal SDK's deprecated SearchAttributes on five pre-existing call sites (internal/triggers/listener.go, internal/triggers/workflow_trigger.go ×2, internal/workflow/manager.go, internal/workflow/run.go).

Migrating to TypedSearchAttributes changes how search attributes are registered and queried — a behavioural change that deserves its own PR and its own testing, not a silent rider on a toolchain bump. So this adds a narrowly-scoped exclusion for that one diagnostic (matched on the message, not blanket-disabling staticcheck) with the reasoning inline, to be removed by the migration PR.

Happy to fold the migration in here instead if reviewers would rather not carry the exclusion.

Verification

Run in the dev shell on this branch:

• just pre-commit (what Dirty runs) — 0 issues, and leaves the tree clean apart from the three files in this PR.
• just tests (what Tests runs) — every package passes, ./cmd included.
• go version in the shell reports go1.26.7; golangci-lint --version reports 2.13.2 built with go1.27.1.

One local gotcha worth knowing, not a repo issue: if you have GOROOT exported in your shell (direnv or profile) pointing at a downloaded golang.org/toolchain@... module, the dev shell inherits it and you get a confusing compile: version ... does not match even after this change. unset GOROOT before entering.

[NumaryBot]

✅ Approve — automated review

The toolchain and lockfile updates are consistent with Go 1.26, and the lint exclusion is narrowly scoped to the described pre-existing deprecation diagnostics. No actionable regressions were found.

No findings.

[shipfox-ai]

This PR bumps the Nix toolchain from Go 1.25 to 1.26 (flake.nix), re-pins the nixpkgs input accordingly (flake.lock), and adds a new .golangci.yml with a single message-scoped SA1019 exclusion for the Temporal SDK's deprecated SearchAttributes field. I verified every claim in both independent reviews against the diff and the checkout: goVersion = 26 resolves to go_1_26 via the existing overlay and matches go.mod's go 1.26.0; the lock file's rev/narHash/revCount/URL all moved together with no stale transitive pins (nur and flake-parts follow nixpkgs); exactly five deprecated call sites exist as described (internal/triggers/listener.go:153, internal/triggers/workflow_trigger.go:56 and :87, internal/workflow/manager.go:102, internal/workflow/run.go:57 — the temporal.SearchAttributes use in cmd/root.go:87 is the formance go-libs struct, not the deprecated SDK field); and the diff touches only the three stated files with no scope creep. No missing, partial, or incorrect implementations were found. Recommendation: approve, with one low-severity Standards comment below.

Standards

Low — repo-global lint suppression without path scoping or a tracking reference
​.golangci.yml:9 — the rule - linters: [staticcheck] / text: "SA1019: .*SearchAttributes is deprecated" is message-matched (good: staticcheck stays enabled), but it applies repo-wide and has no paths: narrowing to the five affected files, and the inline comment says the migration is "tracked separately" without linking any issue or PR. Impact: any future SA1019 diagnostic whose message mentions SearchAttributes is deprecated — anywhere in the repo — will be silently suppressed, and nothing mechanical guarantees the exclusion is removed when the TypedSearchAttributes migration lands. Mitigating: it is not a blanket staticcheck disable, and per-file //nolint comments at five sites would be worse. Suggested follow-up: add a paths: scope for the four affected files, or link the migration PR/issue in the comment.

No other confirmed material finding: no documented coding standards exist that this diff can breach, and the config-only change gives other baseline smells nothing to attach to.

Spec

The Spec axis has no confirmed material finding. Verified against the PR description:

• All fix items present and exact: flake.nix goVersion 25 → 26; flake.lock nixpkgs re-pinned from b3d51a0 (revCount 888552) to 8ce4ef6 (revCount 1070770) with all lock fields updated coherently; new .golangci.yml with exactly one exclusion.
• Exclusion delivered as specified: matched on the message, not a blanket staticcheck disable — staticcheck remains enabled and only SA1019 messages naming SearchAttributes are suppressed.
• "Five pre-existing call sites" verified at HEAD in exactly the files and counts claimed; no migration was snuck in (all five sites still use the deprecated field, matching the stated intent to defer TypedSearchAttributes to a dedicated PR).
• No scope creep: the diff contains only flake.nix, flake.lock, and .golangci.yml; no go.mod/go.sum or Go source changes.
• The CI failure diagnosis (golangci-lint version mismatch in Dirty, go1.26.0/go1.25.2 compile mismatch in Tests) is consistent with .github/workflows/main.yml routing both jobs to shared go-dirty/go-test workflows and the Justfile recipes they invoke; the runtime verification claims (just pre-commit, just tests, tool versions) are not mechanically reproducible here, but nothing in the diff contradicts them.

Reviewed independently by GLM (glm-5.3-flash) and DeepSeek (deepseek-v4-pro-0813) via Shipfox; verified and synthesized by GLM.