From ad45ddf83100f4edf2d71da10cb5e0bcdac720b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Mon, 18 May 2026 14:47:51 +0200
Subject: [PATCH] fixup! versions: bump containerd version to 2.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tests/common: use GOTOOLCHAIN=auto instead of bumping Go version

Instead of bumping the project-wide Go version to 1.26.2, add a helper
that sets GOTOOLCHAIN=auto before building containerd from source.  This
lets Go auto-download the toolchain that containerd's go.mod requires
without changing Kata's pinned Go version.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
---
 .github/workflows/basic-ci-amd64.yaml | 2 +-
 tests/common.bash                     | 8 ++++++++
 versions.yaml                         | 7 ++++---
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/basic-ci-amd64.yaml b/.github/workflows/basic-ci-amd64.yaml
index d8fec03a60..f3679d1457 100644
--- a/.github/workflows/basic-ci-amd64.yaml
+++ b/.github/workflows/basic-ci-amd64.yaml
@@ -28,7 +28,7 @@ jobs:
       # all the tests due to a single flaky instance.
       fail-fast: false
       matrix:
-        containerd_version: ['active']
+        containerd_version: ['sandbox_api']
         vmm: ['dragonball', 'clh-runtime-rs', 'qemu-runtime-rs']
     concurrency:
       group: ${{ github.workflow }}-${{ github.job }}-${{ github.event.pull_request.number || github.ref }}-sandboxapi-amd64-${{ toJSON(matrix) }}
diff --git a/tests/common.bash b/tests/common.bash
index fbfb0cf416..afd0dccba1 100644
--- a/tests/common.bash
+++ b/tests/common.bash
@@ -764,6 +764,14 @@ function get_latest_patch_release_from_a_github_project() {
           | grep "${regex}" -m1
 }
 
+# GitHub Actions' setup-go often sets GOTOOLCHAIN=local, which forbids fetching a newer
+# toolchain required by cloned containerd (e.g. v2.3 go.mod vs Kata's pinned Go). Use
+# automatic toolchain selection only while building upstream containerd.
+function export_go_toolchain_for_containerd_source_builds() {
+	export GOTOOLCHAIN=auto
+	info "GOTOOLCHAIN=auto so containerd is built with the toolchain its go.mod requires"
+}
+
 # base_version: The version to be intalled in the ${major}.${minor} format
 function clone_cri_containerd() {
 	base_version="${1}"
diff --git a/versions.yaml b/versions.yaml
index cbf0bd28f0..93cad9e9f1 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -314,7 +314,8 @@ externals:
     # version older than them.
     version: "v1.7.25"
     lts: "v1.7"
-    active: "v2.3"
+    active: "v2.2"
+    sandbox_api: "v2.3"
 
   critools:
     description: "CLI tool for Container Runtime Interface (CRI)"
@@ -468,12 +469,12 @@ languages:
     description: "Google's 'go' language"
     notes: "'version' is the default minimum version used by this project."
     # When updating this, also update in go.mod files.
-    version: "1.26.2"
+    version: "1.25.10"
     meta:
       description: |
         'newest-version' is the latest version known to work when
         building Kata
-      newest-version: "1.26.2"
+      newest-version: "1.25.10"
 
   rust:
     description: "Rust language"