fix: land the stranded dependency-update branch (MAPCO-11478)

[NivGreenstein]

Closes MAPCO-11478.

What this does

Lands the single real commit from the stranded chore/ci-security-updates branch, by cherry-pick, not merge.

That branch read as four commits ahead, but the content of the three older ones was already on master (verified: tms/errors.go is byte-identical between master and 5eb6988b). Only 87144cdf was new. A plain merge would have replayed the other three.

Commit	What
fix: make pull request workflow pass	The cherry-pick. Dependency bumps + vendor/, the Coveralls empty-token guard, the CITE port, go: true on both lambda jobs, and brittle MVT byte-size assertions replaced with decoded-tile assertions.
fix(devcontainer): track the go.mod toolchain and the shigola rename	Required by the cherry-pick: the image pinned Go 1.26.2 and go.mod moves to 1.26.6.
fix(devcontainer): resolve compose paths from the project directory	The devcontainer has been unbuildable since the rebrand.
ci: make the CITE port genuinely overridable	SHIGOLA_PORT was referenced but never defined.
docs: record why the coverage guard and the compose file order exist	Both are load-bearing and neither is self-evident.
fix(build): track the go.mod toolchain in the image and lambda builds	Two more hardcoded Go pins; one broke docker build, the other would have broken the next release.

2055 files, but 2048 are vendor/ — the mechanical go mod vendor result of the go.mod bump. The seven non-vendor files in that commit are the whole of the human change. go.mod, go.sum and vendor/ must move as one unit or every -mod vendor build breaks.

Acceptance criteria

Criterion	Status
Single real commit applied by cherry-pick, not merge; already-merged commits do not reappear	✅
The test job passes on master	✅ green on CI
The vulnerability job passes on master	✅ green on CI
The coverage upload skips cleanly when no token is available	✅ verified under act — logs Skipping Coveralls upload: no GitHub token is available, job succeeds
The conformance workflow still passes	✅ green on CI
The stranded branch is deleted once its content is on master	⏳ after merge

Three fixes beyond the cherry-pick

The CITE port override never worked. 87144cdf passes TEGOLA_PORT: ${{ env.SHIGOLA_PORT }} to two steps, but SHIGOLA_PORT is defined nowhere in the repo. As a GitHub expression it renders to the empty string, so the override was unreachable — it only behaved because run.sh reads ${TEGOLA_PORT:-8081}, and :- treats empty as unset.

Worth recording the fix that doesn't work, since review caught it: a workflow-level env: SHIGOLA_PORT: '8081' default. Workflow-level env takes precedence over the runner's process environment, so SHIGOLA_PORT=9081 act … still gets the literal — it moves the hardcode rather than removing it. What landed instead: both consumers resolve the variable from the environment with the same shell expansion, and the two per-step rename blocks are gone. run.sh now reads SHIGOLA_PORT falling back to the pre-rename TEGOLA_PORT — the SHIGOLA_*-over-TEGOLA_* precedence internal/env.Getenv already uses. Verified: unset → 8081, SHIGOLA_PORT=9081 → 9081, TEGOLA_PORT=7081 → 7081, both → 9081.

Three files hardcoded the Go version. go.mod sets no toolchain directive, so a lower Go fails with go.mod requires go >= 1.26.6 rather than fetching one, and the build image sets GOTOOLCHAIN=local:

• .devcontainer/Dockerfile — golang:1.26.2-bookworm
• Dockerfile:30 — golang:1.26.2-alpine3.23, which broke docker build
• .github/actions/amazon-linux-build-action/Dockerfile — GOLANG_VERSION=1.26.2, which had not fired yet but feeds both lambda jobs in on_release_publish.yml and would have broken the next release

That last one verifies a pinned checksum, so the hash moved with it: 708effb7…feef89, taken from the go.dev release feed and confirmed against the downloaded tarball.

Nothing ties these three to go.mod, so the next Go bump breaks them again. A toolchain directive would make them self-healing but changes module semantics for consumers — its own ticket.

The devcontainer was unbuildable. Beyond the Go pin: context: .. and ..:/workspace/shigola resolved one level above the repo — the build died with lstat .../shigola/.devcontainer: no such file or directory, and the mount put both repos at /workspace/shigola, so go.mod was not found. Relative paths resolve against the compose project directory (the first -f file's directory), which is the repo root in every invocation including devcontainer.json's own ordering. Also workspaceFolder: /workspace/shigola vs working_dir: /workspace/tegola, a rebrand leftover.

The rename half overlaps MAPCO-11504. Happy to drop it if you would rather keep that ticket whole.

Review findings deferred, not fixed

A two-axis review flagged these. All are inherited from 87144cdf or pre-existing:

• assertMVTForLayers is byte-identical in provider/hana/hana_test.go and provider/postgis/postgis_internal_test.go. Different packages, so it cannot be shared locally — internal/ttools is the natural home. It also asserts layer order, which MVT does not guarantee.
• on_release_publish.yml's go: false → go: true (both lambda jobs) is real — the unconditional Set shigola version step runs go run, so those jobs died with go: command not found — but it is uncommented and unmentioned in the cherry-picked commit body.
• govulncheck@latest is unpinned, so that job can flip without a commit. MAPCO-11499.
• f7955b0d bundles five unrelated changes. Inherited; it is precisely why the follow-up commits are separate.

Verification

CI is green on all workflows. Locally, in the devcontainer (Go 1.26.6, PostGIS + Redis as compose siblings), both CGO modes:

• gofmt -s clean, go build -mod vendor ./... OK, go vet clean on cache/ and tms/
• docker build completes and the binary runs with cgo and all providers linked in
• Coveralls guard exercised under act with an empty token, since secrets.GITHUB_TOKEN is always injected on GitHub-hosted runners and the guard can never fire there

One note for anyone developing on Apple Silicon: TestValidateTileInGrid/a_zoom_beyond_the_scheme's_matrices and TestTile/a_matrix_the_scheme_does_not_have fail on arm64 while passing on CI's amd64 runners. They fail identically on master and on the stranded branch tip, and both date from the initial commit cd2f2488, so this is pre-existing and unrelated to this PR — but it is worth a look, since a local go test ./... on a Mac is red before you change anything. TestPGXOnNotice also fails in a devcontainer because it hardcodes 127.0.0.1:5432; that one is a sandbox artifact and passes when postgis shares the network namespace.

🤖 Generated with Claude Code

[github-actions]

Coverage Report for CI Build 9918

Warning

No base build found for commit 66b602b on master.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 47.662%

Details

• Patch coverage: Could not be determined — this PR's diff is too large for GitHub to return (406 error at GitHub).

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	20163
Covered Lines:	9610
Line Coverage:	47.66%
Coverage Strength:	205.92 hits per line

---

💛 - Coveralls