GeezerVison

… 2.34) (#30858)

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://github.com/coder/coder/blob/main/contributing/AI_CONTRIBUTING.md)
before submitting.

-->

Removes the nix dev image from `.github/workflows/dogfood.yaml` on
`release/2.34`, aligning it with `release/2.35` and later (`["22.04",
"26.04"]`). Tracked in
[ENT-214](https://linear.app/codercom/issue/ENT-214).

## Why

`build_image (nix)` fails on every `release/2.34` PR that triggers the
dogfood workflow (e.g. #30811):

`error: cannot download google-chrome-stable_143.0.7499.169-1_amd64.deb
from any mirror` (HTTP 404)

The nix dev image includes `google-chrome` from the `nixos-25.05`
nixpkgs pinned in this branch's `flake.lock`. Google only serves recent
Chrome builds, so the pinned `.deb` is gone. `main` removed the nix
image in #26022 after 2.34 was cut, so only this branch still builds it.
Bumping nixpkgs instead would change many packages on an old release
branch, and the Chrome pin would go stale again.

## Changes

`.github/workflows/dogfood.yaml` only, mirroring the workflow part of
#26022:

- Drop `nix` from the `build_image` matrix.
- Remove the nix-only steps: Nix install, `cache-nix-action`, `nix build
.#dev_image`, and the `codercom/oss-dogfood-nix` push.
- Drop the `matrix.image-version != 'nix'` guards, which are now always
true.
- Drop the `flake.nix` / `flake.lock` path triggers, since no job in
this workflow uses the flake anymore.
- Update comments that mentioned the nix image.

Not touched, to keep the backport small: `flake.nix` (`dev_image`
output), `nix/docker.nix`, and the nix image option in
`dogfood/coder/main.tf`. None of them is used by CI after this change.

## Notes

- `Analyze PR for Documentation Updates Needed` fails here for an
unrelated reason (outdated `agents-chat-action` pin, fixed by #30850 /
[ENT-212](https://linear.app/codercom/issue/ENT-212)).
- `chromatic` fails on all `release/2.34` PRs ("No app with code ...
found"), also unrelated.

…30850)

Bumps the pinned `coder/agents-chat-action` in
`.github/workflows/doc-check.yaml` on `release/2.34` from `v0` to v0.5.1
(`9b3ac42`). Same change as #29732 on `main`.

## Why

The `Analyze PR for Documentation Updates Needed` job fails on every PR
into `release/2.34` (e.g. #30811) with `Coder API error: Not Found`. The
pinned version calls `/api/experimental/chats`, which #29548 removed
after the chat API moved to `/api/v2` (#28496). v0.5.1 calls
`/api/v2/chats`.

v0.5.1 accepts every input this workflow passes (its inputs are a
superset of v0.3.0's), so no other workflow changes are needed. The
doc-check run on this PR is the end-to-end test.

## Changes

- `.github/workflows/doc-check.yaml`: one `uses:` line.

Related:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29)
(surfaced on the Go 1.26.9 backports).

Opened by Superblink on behalf of @droopy4096.

Co-authored-by: Dmytro Makovey <[email protected]>

Bump the Go toolchain from 1.26.5 to 1.26.9 ([released
2026-10-02](https://go.dev/doc/devel/release#go1.26.9)).

Tracked in Linear:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29).
Iron Bank fix-by date for the Critical finding is **2026-10-29**.

Go 1.26.9 includes fixes for the findings Iron Bank reported against
`coder/coder-enterprise/coder-service-2:2.38.0`. Of the 19 still-valid
advisories, 12 are only fixed in 1.26.9, including the Critical one:

- Critical: [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) /
CVE-2026-78663 (HTTP/2 server double flow-control refund)
- High: GO-2026-6603, -6605, -6607, -6608, -6609, -6610, -6611, -6613
- Low: GO-2026-6599, -6600, -6617

The other 7 (GO-2026-5026, -5942, -6088, -6089, -6090 High; -6091, -6218
Medium) are fixed since 1.26.6. The full list with links is in ENT-210.

## Changes

Same file set as #27157:

- `go.mod`: `go 1.26.5` to `go 1.26.9`
- `mise.toml` / `mise.lock`: Go toolchain pin and the archive URLs and
SHA-256 checksums for each platform (taken from the official `go.dev/dl`
release list)

## Verification

- `go build ./enterprise/cmd/coder` with go1.26.9 succeeds; `go mod tidy
-diff` is clean.
- `govulncheck -mode binary` on the resulting binary reports none of the
19 advisories above. The same scan of the released 2.38.0 binary
(go1.26.5) reports all 19.

## Not in this PR

`golang.org/x/net` v0.60.0 (the module-side half of GO-2026-6603, -6610,
-6611, -6612 and -6617) is already on `main` via #30772 and is
backported to the release branches in #30814 (2.38), #30815 (2.37),
#30816 (2.36), #30817 (2.35) and #30818 (2.34), tracked in
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix).
The Go 1.27.1 bump (#30288) stays a separate, larger change. Go
backports: #30808 (2.38), #30809 (2.37), #30810 (2.36), #30813 (2.35),
#30811 (2.34).

Opened by Superblink on behalf of @droopy4096.

## Problem

`build_image` in the dogfood workflow fails on every `release/2.29` run
since at least 2026-10-09 (e.g. #30555, #30811). Two independent causes,
both forms of pinned-branch rot:

1. **"Build and push Non-Nix image"**: the Rust stage of
`dogfood/coder/Dockerfile` runs `cargo install jj-cli typos-cli
[email protected]`, two crates unpinned and none locked, so every
build resolves today's crates.io against the rustc frozen by the base
image digest (1.91.1):
   ```
error: cannot install package `jj-cli 0.46.0`, it requires rustc 1.97.1
or newer
error: cannot install package `typos-cli 1.51.1`, it requires rustc 1.95
or newer
error: could not compile `watchexec-cli` (lib) due to 1 previous error
   ```
2. **"Build Nix image"**: the nixpkgs pinned in this branch's
`flake.lock` fetches `google-chrome-stable_138.0.7204.49`, which Google
no longer serves (same as #30858 on 2.34).

`main` has neither problem: it stopped compiling these tools in the
image and removed the nix image in #26022.

## Changes

- `dogfood/coder/Dockerfile`: `cargo install --locked [email protected]
[email protected] [email protected]`. The two pins are the newest
releases whose declared minimum rustc is at or below 1.91 (checked
against crates.io metadata); `--locked` uses each crate's own lockfile,
which is what fixes the `watchexec-cli` compile. Also corrects the stale
toolchain comment (said 1.86.0, digest is 1.91.1).
- `.github/workflows/dogfood.yaml`: drop the Nix install, Nix cache,
"Build Nix image" and "Push Nix image" steps and the `flake.*` path
triggers, mirroring the workflow part of #30858. `flake.nix`,
`nix/docker.nix` and the template's nix option are left alone to keep
the backport small, as on 2.34.

## Verification

This PR touches `dogfood/**` and the workflow, so its own `build_image`
run is the test. The first push (Dockerfile only) got "Build and push
Non-Nix image" green for the first time since October 9 and then failed
on the nix step; the second push removes that step.

Unblocks #30555 and the Go backport to 2.29.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Fable 5.1 <[email protected]>