chore: bump Go to 1.26.2 (Squashed #977 needed signing) (#981)

Squashes commits from
#977

commit fa478bf Author: James Kong
<james.kong@smartcontract.com> Date: Fri May 15 17:00:25 2026 +0800

    ci: address review issues

commit 826c52a Author: James Kong
<james.kong@smartcontract.com> Date: Fri May 15 16:38:55 2026 +0800

    ci: fix operations-gen linting

commit 52d673a Author: James Kong
<james.kong@smartcontract.com> Date: Fri May 15 16:34:31 2026 +0800

    ci: fix goconst linter errors

commit 5c25692 Author: James Kong
<james.kong@smartcontract.com> Date: Fri May 15 14:52:32 2026 +0800

    ci: fix gosec linter errors

commit d73f68d Author: James Kong
<james.kong@smartcontract.com> Date: Fri May 15 14:42:04 2026 +0800

    ci: fix staticcheck linter errors

commit 053f182 Author: James Kong
<james.kong@smartcontract.com> Date: Fri May 15 14:39:18 2026 +0800

    ci: fix govet linter errors

commit bc55c2f Author: James Kong
<james.kong@smartcontract.com> Date: Fri May 15 14:33:34 2026 +0800

    ci: fix prealloc linter errors

commit 160a354 Author: James Kong
<james.kong@smartcontract.com> Date: Fri May 15 14:14:49 2026 +0800

    ci: update linter

commit f3b2374 Author: James Kong
<james.kong@smartcontract.com> Date: Thu May 14 17:41:58 2026 +0800

    chore: bump Go to 1.26.2

    Bumps the Go version to 1.26.2 and updates dependencies

Author: patricios-space

.changeset/slimy-icons-divide.md

@@ -0,0 +1,5 @@
+---
+"chainlink-deployments-framework": minor
+---
+
+Bump to Go 1.26.2, update several dependencies, and migrate from `pgx/v4` to `pgx/v5`.

.github/workflows/pull-request-main.yml

@@ -36,7 +36,7 @@ jobs:
         uses: smartcontractkit/.github/actions/ci-lint-go@ci-lint-go/v2 # ci-lint-go@2.0.0
         with:
           only-new-issues: "false"
-          golangci-lint-version: v2.8.0
+          golangci-lint-version: v2.12.2
 
   ci-lint-operations-gen:
     name: Lint operations-gen
@@ -52,7 +52,7 @@ jobs:
         uses: smartcontractkit/.github/actions/ci-lint-go@ci-lint-go/v2 # ci-lint-go@2.0.0
         with:
           only-new-issues: "false"
-          golangci-lint-version: v2.8.0
+          golangci-lint-version: v2.12.2
           go-directory: tools/operations-gen
 
   ci-lint-misc:

.github/workflows/schedule-main.yml

@@ -19,7 +19,7 @@ jobs:
         uses: smartcontractkit/.github/actions/ci-lint-go@ci-lint-go/v2 # ci-lint-go@2.0.0
         with:
           only-new-issues: "false"
-          golangci-lint-version: v2.8.0
+          golangci-lint-version: v2.12.2
 
   ci-lint-misc:
     name: Lint GH Actions and scripts

.golangci.yml

@@ -85,6 +85,8 @@ linters:
               desc: We want to avoid importing this package as it creates import cycles
     goconst:
       min-len: 5
+      min-occurrences: 5
+      ignore-tests: true
     govet:
       enable:
         - shadow
@@ -134,13 +136,17 @@ linters:
       - legacy
       - std-error-handling
     rules:
-      - linters:
-          - goconst
-        path: (.+)_test\.go
       - linters:
           - staticcheck
         text: "SA1019:.*aws-sdk-go.*is deprecated"
         path: (.+)\.go
+      # The aws-sdk-go v1 KMS signer paths depend on ecdsa.PublicKey.X/Y, which were
+      # deprecated in Go 1.26. We are not upgrading the AWS SDK at the moment, so allow these here.
+      # Once we switch over to using the chainlink keystore, this can be removed.
+      - linters:
+          - staticcheck
+        text: "SA1019:.*(has been deprecated since Go 1\\.26).*ParseUncompressedPublicKey"
+        path: chain/(evm|tron)/provider/kms_signer(_test)?\.go
     paths:
       - third_party$
       - builtin$

.tool-versions

@@ -1,5 +1,5 @@
-golang        1.25.5
-golangci-lint 2.8.0
+golang        1.26.2
+golangci-lint 2.12.2
 mockery       3.6.3
 nodejs        20.16.0
 pnpm          10.6.5

chain/blockchain.go

@@ -250,7 +250,7 @@ func getChainsByType[VT any, PT any](b BlockChains) map[uint64]VT {
 			chains[sel] = c
 		case PT:
 			val := reflect.ValueOf(c)
-			if val.Kind() == reflect.Ptr && !val.IsNil() {
+			if val.Kind() == reflect.Pointer && !val.IsNil() {
 				elem := val.Elem()
 				if elem.CanInterface() {
 					if v, ok := elem.Interface().(VT); ok {

chain/evm/operations/contract/deploy.go

@@ -231,7 +231,7 @@ func deployZkContractImpl(
 // arrayify converts a struct or pointer to struct into a slice of its field values.
 func arrayify[ARGS any](args ARGS) ([]any, error) {
 	v := reflect.ValueOf(args)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		if v.IsNil() {
 			return nil, errors.New("expected non-nil pointer to struct, got nil")
 		}

chain/evm/operations2/contract/deploy.go

@@ -225,7 +225,7 @@ func deployZkContractImpl(
 // arrayify converts a struct or pointer to struct into a slice of its field values.
 func arrayify[ARGS any](args ARGS) ([]any, error) {
 	v := reflect.ValueOf(args)
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		if v.IsNil() {
 			return nil, errors.New("expected non-nil pointer to struct, got nil")
 		}

chain/evm/provider/kms_signer.go

@@ -250,14 +250,15 @@ func recoverEVMSignature(expectedPublicKey, txHash, r, s []byte) ([]byte, error)
 	return evmSig, nil
 }
 
-// padTo32Bytes pads the given byte slice to 32 bytes by trimming leading zeros and prepending
-// zeros.
+// padTo32Bytes pads the given byte slice to 32 bytes by trimming leading zeros and left-padding
+// with zeros.
 func padTo32Bytes(buffer []byte) []byte {
 	buffer = bytes.TrimLeft(buffer, "\x00")
-	for len(buffer) < 32 {
-		zeroBuf := []byte{0}
-		buffer = append(zeroBuf, buffer...)
+	if len(buffer) >= 32 {
+		return buffer
 	}
+	out := make([]byte, 32)
+	copy(out[32-len(buffer):], buffer)
 
-	return buffer
+	return out
 }

chain/evm/provider/zksync_signer_test.go

@@ -73,7 +73,7 @@ func Test_zkSyncSigner_SignTypedData(t *testing.T) {
 		return func(hash []byte) ([]byte, error) {
 			sig := make([]byte, 65)
 			copy(sig, hash)
-			sig[64] = byte(v)
+			sig[64] = byte(v) //nolint:gosec // G115: v is a test-controlled small int (recovery byte 0/1/27/28)
 
 			return sig, nil
 		}