scripts/vercel-build.sh pins Go 1.22.4, older than go.mod's `go 1.24.0` directive, so the pinned toolchain cannot build this module without an undocumented network fallback

[Jagadeeshftw]

Description

scripts/vercel-build.sh is the build entrypoint used to deploy this backend on Vercel (per its own comment, "Install Go on Vercel (not present in default 'Other' build image)"):

#!/usr/bin/env bash
set -e
# Install Go on Vercel (not present in default "Other" build image)
GO_VERSION=1.22.4
GO_TAR="go${GO_VERSION}.linux-amd64.tar.gz"
curl -sL "https://go.dev/dl/${GO_TAR}" -o "/tmp/${GO_TAR}"
tar -C /tmp -xzf "/tmp/${GO_TAR}"
export PATH="/tmp/go/bin:${PATH}"
go version
go mod download
go build -o api ./cmd/api

It hardcodes GO_VERSION=1.22.4 and downloads/extracts that exact toolchain, then immediately runs go build. But go.mod's directive is:

module github.com/jagadeesh/grainlify/backend

go 1.24.0

Go's module toolchain enforcement (in effect since Go 1.21) requires the running go binary to satisfy the module's declared go directive. Invoking Go 1.22.4 against a module declaring go 1.24.0 triggers Go's automatic toolchain-switching machinery, which attempts to download and use a matching go1.24.x toolchain over the network at build time (governed by GOTOOLCHAIN, default auto) — a step this script neither performs explicitly nor accounts for, and which silently depends on outbound network access being available and unrestricted inside the Vercel build sandbox. If that automatic fallback is ever blocked (restricted egress, GOTOOLCHAIN=local inherited from the environment, or a future Go release tightening this behavior), the build fails outright with a go.mod requires go >= 1.24.0 error, using the exact toolchain this script deliberately installs.

Requirements

• scripts/vercel-build.sh's pinned GO_VERSION must satisfy (be greater than or equal to) go.mod's declared go directive at all times.
• The script should not rely on undocumented, implicit toolchain auto-download behavior to compensate for an intentionally-pinned older version.

Suggested execution

1. Bump GO_VERSION in scripts/vercel-build.sh to a version >= 1.24.0 (matching or newer than go.mod's directive), e.g. the latest 1.24.x patch release.
2. Add a CI check (or a simple grep/awk step in the script itself) that fails fast if GO_VERSION in this script is older than the go directive parsed from go.mod, so the two can't silently drift apart again after a future go.mod bump.
3. Verify a clean build (bash scripts/vercel-build.sh in a container with no pre-existing Go toolchain and GOTOOLCHAIN=local) succeeds without any network fallback.

Acceptance criteria

• scripts/vercel-build.sh installs a Go toolchain version >= go.mod's declared go directive.
• The build succeeds with GOTOOLCHAIN=local set, proving no implicit toolchain download is required.
• A guard prevents the pinned version and go.mod's directive from silently drifting apart in the future.

Security notes

Pulling an unplanned toolchain over the network mid-build (if the implicit fallback is what's currently keeping this working) is also a minor supply-chain concern: the build's actual compiler version is not the one explicitly pinned and reviewed in this script.

Guidelines

• Minimum 95% test coverage
• Timeframe: 96 hours

[1nonlypiece]

Hi Maintainers 👋,

I’d like to apply for this issue.

I have hands-on experience with Next.js frontend development as well as Stellar smart contracts using Rust (Soroban). I’m comfortable working with Figma designs, integrating APIs/wallets on the frontend, and implementing, testing, and optimizing smart contracts on Stellar.

I can follow the project guidelines, communicate progress clearly, and deliver clean, well-tested code within the expected timeline.

Looking forward to contributing to the project 🚀
Thanks!

[grantfox-oss]

🦊 GrantFox — @1nonlypiece has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #399)
2. Your PR will be reviewed by the Grainlify maintainers

Good luck! Track your progress on GrantFox.

[Jagadeeshftw]

Assigned @1nonlypiece! Go ahead and open a PR referencing this issue (Closes #399) when ready. t.me/+vTbe0hOUKrFhNTJl