NO-JIRA: chore: update github actions runner image to go 1.26.4

[BraeTroutman]

this is necessary to enable linting support for an PR upgrading hypershift images to golang 1.26.

What this PR does / why we need it:

bumps the go minor version of the github actions image to make use of 1.26.4

this is a necessary prerequisite to upgrading the project go version to 1.26.4, as golangci lint built in the actions image must be built using a greater or equal golang version.

Which issue(s) this PR fixes:

Fixes #8823

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Chores
  • Updated the GitHub Actions runner image to use a newer Go toolchain by default.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

📝 Walkthrough

Walkthrough

This change updates the default value of the GO_VERSION build argument in Dockerfile.github-actions-runner from 1.25.7 to 1.26.4, affecting the Go toolchain version downloaded and installed during the image build unless overridden by the build caller.

Compact metadata:

• Files changed: 1
• Lines changed: +1/-1
• Estimated review effort: Low

Related issues:

• #8823: PSHP-316: update golang and base image for Hypershift Operator CVE remediation

Suggested labels: dependencies, ci

Suggested reviewers: N/A

Poem:
A rabbit hops with builds in tow,
Bumping Go from old to new glow,
One line changed, a version anew,
1.26.4 now in view,
CVEs patched, onward we go! 🐇

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR only updates the runner Go version and does not implement the linked CVE remediation changes to ubi-minimal, Go mod, or build images.	Update the operator/base image tags and Go mod/build image versions from #8823, or separate this prerequisite runner bump from that issue.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Out of Scope Changes check	✅ Passed	The change set is narrowly scoped to the intended GitHub Actions runner Go version bump.
Stable And Deterministic Test Names	✅ Passed	No changed *_test.go files in the PR commit, so no Ginkgo titles were added or modified.
Test Structure And Quality	✅ Passed	PR only bumps GO_VERSION in Dockerfile.github-actions-runner; no Ginkgo test code was changed, so this test-quality check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR only bumps GO_VERSION in Dockerfile.github-actions-runner; it does not add or modify manifests, controllers, or scheduling logic.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR only updates Dockerfile.github-actions-runner's GO_VERSION; no Ginkgo e2e tests or network-sensitive test code is added/modified.
No-Weak-Crypto	✅ Passed	Diff only updates GO_VERSION; no added MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or unsafe secret comparisons were found.
Container-Privileges	✅ Passed	PASS: The commit only bumps GO_VERSION in Dockerfile.github-actions-runner; no privileged/hostNetwork/hostPID/hostIPC/SYS_ADMIN/allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	PR only bumps GO_VERSION in Dockerfile.github-actions-runner; no new logging of secrets, PII, or internal data appears in the changed file.
Title check	✅ Passed	The title accurately summarizes the main change: updating the GitHub Actions runner image to Go 1.26.4.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.28%. Comparing base (ce9dd2c) to head (529ad40).
⚠️ Report is 46 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8888   +/-   ##
=======================================
  Coverage   43.28%   43.28%           
=======================================
  Files         771      771           
  Lines       95503    95503           
=======================================
  Hits        41335    41335           
  Misses      51284    51284           
  Partials     2884     2884           

Flag	Coverage Δ
cmd-support	36.67% <ø> (ø)
cpo-hostedcontrolplane	45.31% <ø> (ø)
cpo-other	45.10% <ø> (ø)
hypershift-operator	53.59% <ø> (ø)
other	31.69% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cblecker]

/lgtm
/area ci-tooling
/verified later @BraeTroutman

@bryan-cox @csrwng Any concerns with upgrading this go version?

[openshift-ci-robot]

@cblecker: This PR has been marked to be verified later by @BraeTroutman.

Details

In response to this:

/lgtm
/area ci-tooling
/verified later @BraeTroutman

@bryan-cox @csrwng Any concerns with upgrading this go version?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-v2-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws
/test e2e-v2-gke

[cwbotbot]

Test Results

e2e-aws

• Status: ❌ FAIL
• Started: 2026-07-03T21:23:03Z
• View Job
• View Job History

Failed Tests

Total failed tests: 4

• TestKarpenter
• TestKarpenter/Main
• TestKarpenter/Main/Parallel_provisioning_tests
• TestKarpenter/Main/Parallel_provisioning_tests/OpenshiftEC2NodeClass_Kubelet_propagation

e2e-aks

• Status: ✅ PASS
• Started: 2026-07-03T21:23:03Z
• View Job
• View Job History

[hypershift-jira-solve-ci]

Now I have all the evidence. Here is the final analysis:

Test Failure Analysis Complete

Job Information

• Prow Jobs: pull-ci-openshift-hypershift-main-e2e-v2-gke, pull-ci-openshift-hypershift-main-e2e-aws, pull-ci-openshift-hypershift-main-e2e-kubevirt-aws-ovn-reduced
• Build IDs: 2073155545811914752, 2073155545631559680, 2073155545740611584
• PR: NO-JIRA: chore: update github actions runner image to go 1.26.4 #8888 — chore: update github actions runner image to go 1.26.4 by @BraeTroutman
• Targets: e2e-v2-gke, e2e-aws, e2e-kubevirt-aws-ovn-reduced

Test Failure Analysis

Error

Job 1 (e2e-v2-gke): Post-phase destroy step timed out after 40m with "Unauthorized" errors
  → "Failed to get hosted cluster" ... "error":"Unauthorized" (repeated for 36 minutes)
  → "HostedCluster deletion failed" ... "error":"context deadline exceeded"

Job 2 (e2e-aws): TestKarpenter/Main/Parallel_provisioning_tests/OpenshiftEC2NodeClass_Kubelet_propagation
  → Get "https://10.0.138.74:10250/containerLogs/kube-system/kubelet-config-checker/checker": remote error: tls: internal error

Job 3 (e2e-kubevirt-aws-ovn-reduced): TestAutoscaling/EnsureHostedCluster — 3 sub-test failures on pod importer-prime-5bea50ef:
  → EnsureReadOnlyRootFilesystem: readOnlyRootFilesystem is nil (expected true)
  → EnsureReadOnlyRootFilesystemTmpDirMount: /tmp not mounted
  → EnsureSATokenNotMountedUnlessNecessary: kube-api-access-m8ktc volume mounted

Summary

All three failures are unrelated to PR #8888 (which only updates the GitHub Actions runner image to Go 1.26.4 — a CI-only change with no product code modifications). The e2e-v2-gke failure is purely a post-phase teardown issue where API credentials expired before the cluster could be destroyed. The e2e-aws failure is a Karpenter-specific kubelet TLS error during the kubelet config propagation test. The e2e-kubevirt failures are pre-existing compliance test failures against CDI's importer-prime pod (an external component) that doesn't meet HyperShift's security hardening requirements (readOnlyRootFilesystem, /tmp mount, SA token restrictions).

Root Cause

e2e-v2-gke — Infrastructure/credential issue (post-phase only):
The test phase (e2e-v2-gke-tests) completed successfully in 2m46s. All pre-phase steps also passed. The failure occurred exclusively in the post-phase destroy step (e2e-v2-gke-destroy), which ran for 40m8s before timing out. Starting at 22:43:10Z (about 4 minutes into the destroy), every API call to check the HostedCluster deletion status returned "error":"Unauthorized". This repeated every second for ~36 minutes until the 40-minute context deadline was exceeded. The root cause is that the GKE management cluster credentials (used by the hypershift destroy cluster gcp command) expired or were revoked during the teardown window. This is a known infrastructure issue with short-lived credentials in CI, not a product bug.

e2e-aws — Karpenter kubelet TLS error:
The OpenshiftEC2NodeClass_Kubelet_propagation test successfully created an OpenshiftEC2NodeClass with kubelet config, waited for the KubeletConfig ConfigMap, confirmed the ignition token annotation, verified the NodeClass was Ready, created a NodePool, waited for the Karpenter node to become ready (4m51s), and created a kubelet-config-checker pod. However, when trying to retrieve container logs from the kubelet via the API (GET https://10.0.138.74:10250/containerLogs/...), the request failed with tls: internal error. This is a TLS handshake failure between the API server and the kubelet on the Karpenter-provisioned node, suggesting the node's kubelet certificate may not have been properly issued or the kubelet serving cert was not ready within the 120s timeout. This is a known flaky area in Karpenter node provisioning.

e2e-kubevirt-aws-ovn-reduced — CDI importer-prime pod compliance failures:
Three security compliance tests failed on the same pod: importer-prime-5bea50ef-566c-4f2e-8c28-5b35049f89ee. This pod belongs to CDI (Containerized Data Importer), an external component. The importer container does not set readOnlyRootFilesystem: true, does not mount /tmp, and has kube-api-access-* volumes mounted. These are pre-existing issues with the CDI component not meeting HyperShift's pod security hardening expectations — not caused by any change in this PR.

Recommendations

1. Retest / merge: Since none of these failures are related to PR NO-JIRA: chore: update github actions runner image to go 1.26.4 #8888 (Go runner image update), the PR can be safely retested with /retest or merged. The failures are pre-existing infrastructure flakes and external component compliance gaps.

2. e2e-v2-gke: The credential expiry in the destroy step is a known CI infrastructure issue. No action needed from this PR. If this recurs frequently, the CI team should investigate extending credential TTL for GKE teardown steps or adding credential refresh logic to the destroy workflow.

3. e2e-aws (Karpenter kubelet TLS): This is a known flaky area. The Karpenter team should investigate whether Karpenter-provisioned nodes need additional time for kubelet serving certificates to be issued, or whether the test's 120s timeout for log retrieval is insufficient.

4. e2e-kubevirt (CDI importer-prime): The CDI team should be notified that the importer-prime pods do not comply with HyperShift's pod security hardening requirements (readOnlyRootFilesystem, /tmp mount, SA token restrictions). Alternatively, these pods could be added to the exclusion list in the test if CDI is not expected to comply.

Evidence

Evidence	Detail
PR scope	chore: update github actions runner image to go 1.26.4 — CI-only change, no product code
e2e-v2-gke test phase	✅ Passed — e2e-v2-gke-tests succeeded after 2m46s
e2e-v2-gke failure step	e2e-v2-gke-destroy (post phase) failed after 40m8s
e2e-v2-gke failure cause	"error":"Unauthorized" repeated from 22:43:10Z to 23:19:28Z, then context deadline exceeded
e2e-aws failed test	TestKarpenter/Main/Parallel_provisioning_tests/OpenshiftEC2NodeClass_Kubelet_propagation (426.10s)
e2e-aws failure cause	Get "https://10.0.138.74:10250/containerLogs/kube-system/kubelet-config-checker/checker": remote error: tls: internal error
e2e-aws test stats	623 tests, 30 skipped, 4 failures (all 4 from same TestKarpenter parent)
e2e-kubevirt failed tests	EnsureReadOnlyRootFilesystem, EnsureReadOnlyRootFilesystemTmpDirMount, EnsureSATokenNotMountedUnlessNecessary
e2e-kubevirt failing pod	importer-prime-5bea50ef-566c-4f2e-8c28-5b35049f89ee (CDI component, external)
e2e-kubevirt test stats	76 tests, 10 skipped, 5 failures (all from TestAutoscaling/EnsureHostedCluster)
Build images	All 4 images (src, hypershift-operator, hypershift, hypershift-tests, hypershift-cli) built successfully
Shared namespace	All 3 jobs ran in ci-op-lx99yk2c — same image build, different test targets

---

[bryan-cox]

/retitle NO-JIRA: chore: update github actions runner image to go 1.26.4

[openshift-ci-robot]

@BraeTroutman: This pull request explicitly references no jira issue.

Details

In response to this:

this is necessary to enable linting support for an PR upgrading hypershift images to golang 1.26.

What this PR does / why we need it:

bumps the go minor version of the github actions image to make use of 1.26.4

this is a necessary prerequisite to upgrading the project go version to 1.26.4, as golangci lint built in the actions image must be built using a greater or equal golang version.

Which issue(s) this PR fixes:

Fixes #8823

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Chores
• Updated the GitHub Actions runner image to use a newer Go toolchain by default.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[bryan-cox]

/override ci/prow/e2e-aws

[openshift-ci]

@bryan-cox: Overrode contexts on behalf of bryan-cox: ci/prow/e2e-aws

Details

In response to this:

/override ci/prow/e2e-aws

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[bryan-cox]

/override ci/prow/e2e-kubevirt-aws-ovn-reduced
/override ci/prow/e2e-v2-gke

[openshift-ci]

@bryan-cox: Overrode contexts on behalf of bryan-cox: ci/prow/e2e-kubevirt-aws-ovn-reduced, ci/prow/e2e-v2-gke

Details

In response to this:

/override ci/prow/e2e-kubevirt-aws-ovn-reduced
/override ci/prow/e2e-v2-gke

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[bryan-cox]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BraeTroutman, bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@BraeTroutman: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.