hermes: install pinned Go toolchain

services/hermes/scripts/install_agent_tools.sh

@@ -6,9 +6,10 @@ tools=${HERMES_AGENT_TOOLS_DIR:-/opt/data/tools}
 python=${HERMES_AGENT_PYTHON:-/opt/hermes/.venv/bin/python}
 bin=${tools}/bin
 stamp=${tools}/.operator-cli-versions-2.7.0-3.18.6-5.7.1-1.8.1-4.47.1-2.78.0-2.0.4-3.13.3-1.3.1-0.51.0-1.15.8
+go_stamp=${tools}/.go-toolchain-1.26.5
 mkdir -p "${bin}"
 
-if [ -f "${stamp}" ]; then
+if [ -f "${stamp}" ] && [ -f "${go_stamp}" ]; then
   exit 0
 fi
 
@@ -30,6 +31,29 @@ publish() {
   mv "${source}" "${bin}/${name}"
 }
 
+if [ ! -f "${go_stamp}" ]; then
+  go_root=${tools}/go-1.26.5
+  if [ ! -e "${go_root}" ]; then
+    fetch \
+      https://go.dev/dl/go1.26.5.linux-arm64.tar.gz \
+      fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49 \
+      "${work}/go.tar.gz"
+    tar -xzf "${work}/go.tar.gz" -C "${work}"
+    mv "${work}/go" "${go_root}"
+  fi
+  if [ ! -x "${go_root}/bin/go" ] || [ ! -x "${go_root}/bin/gofmt" ]; then
+    echo "incomplete Go toolchain path exists: ${go_root}" >&2
+    exit 1
+  fi
+  ln -sfn "../go-1.26.5/bin/go" "${bin}/go"
+  ln -sfn "../go-1.26.5/bin/gofmt" "${bin}/gofmt"
+  touch "${go_stamp}"
+fi
+
+if [ -f "${stamp}" ]; then
+  exit 0
+fi
+
 fetch \
   https://github.com/fluxcd/flux2/releases/download/v2.7.0/flux_2.7.0_linux_arm64.tar.gz \
   758703b8cd96be98f1ea23b7bd3ff2ae13d90a23467d8aba8b83adbe335c6854 \

testing/tests/test_hermes_cli_lanes.py

@@ -1234,8 +1234,15 @@ def test_owner_agent_installs_the_pinned_operator_toolchain():
         "age-keygen",
         "k9s",
         "terraform",
+        "go",
+        "gofmt",
     ]:
         assert value in script
+    assert "go1.26.5.linux-arm64.tar.gz" in script
+    assert (
+        "fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"
+        in script
+    )
     assert script.count("sha256sum -c -") == 1
 
     deployment = _agent_deployment()