Establish a tested Go support floor and reliable release CI

[MasterOfBinary]

Current outcome

Make compatibility and release checks truthful for applications pinning GoBatch, without bundling unrelated maintenance preferences into the adoption gate.

Replanned on 2026-09-06 against GoBatch master 63ef757 and ShitQuant's recorder, enrichment, paper/replay, and flow workloads. This is an implementation target, not a claim that the behavior already exists.

Required behavior

• Choose and test the supported Go minimum, or raise the module/directives/docs together. Do not assume newer stdlib APIs work under the currently declared Go 1.18 floor.
• Run behavior/race checks on appropriate supported toolchains and formatting/vet/lint once where duplication adds no signal.
• Use explicit minimal workflow permissions and handle coverage upload failures deliberately.
• Remove no-op dependency/cache setup only where the actual dependency graph makes it unnecessary.
• Treat ci: drop dead travis-test branch from push trigger #88's removal of travis-test as already done.
• Diagnose flaky tests/reporting before tuning coverage thresholds. Action SHA pinning, dependency-update bots and new threshold policies are separate optional maintenance choices, not hidden API release blockers.

Verification and completion

Show the supported-floor and current-toolchain runs, scoped workflow checks, actionable failures and consistent public compatibility docs. Do not use coverage percentage as the release oracle.

Follow the repository's formatting, race-test, vet/lint, package documentation, example and changelog requirements for the changed surface. Report the actual supported behavior and migration; do not treat a passing coverage percentage as proof of these outcomes.

Scope and relationships

Real prerequisite for publishing new APIs and selecting newer context facilities. #86 owns targeted test quality. No new CI platform or mandatory dependency bot.

Design history

The earlier report/prototype remains below for provenance; the requirements above supersede conflicting prescriptions. Existing discussion is preserved.

Original issue: CI hardening: permissions block, codecov thresholds, cache no-op, dead trigger, SHA pinning, dependabot, Go-floor matrix

Checklist from a CI/tooling audit of .github/workflows/go.yml (validated @ 58cee73):

• Add permissions: contents: read — the job pipes a remote install script to sh and holds CODECOV_TOKEN, with the default (potentially write) token scope.
• Codecov patch threshold — codecov.yml (added in docs: fix godoc rendering and restore full AGENTS.md mirror #80) sets only a project threshold; the patch status has none, and coverage of ctx-cancellation arms is scheduler-dependent, so patch checks go red on correct PRs (bit PR fix(batch): panic recovery, deadlock-safe error sends, bounded prealloc, Done() race #65). Add a small patch threshold or carry-forward, and consider fail_ci_if_error for the upload step (currently silent).
• setup-go cache is a guaranteed-warn no-op — zero deps, no go.sum: set cache: false and drop the no-op go mod download step.
• Remove the dead travis-test push trigger (branch doesn't exist).
• Run gofmt/lint/codecov once, not per matrix leg — currently duplicated on 1.25.x and 1.26.x (wasted minutes, double upload).
• SHA-pin third-party actions — especially codecov/codecov-action (token-holding, prior supply-chain history).
• Add dependabot.yml for the github-actions ecosystem (ci: update workflow for latest Go versions #61 was exactly this toil, done by hand).
• Decide the Go floor — go.mod says go 1.18 and README/CLAUDE.md promise "Go 1.18 or later", but CI tests only 1.25.x/1.26.x, so the floor is an untested claim (a stdlib API from 1.19+ would pass CI and break documented users). Either add an oldest-supported leg or bump the directive and all docs together.