From 32adca78f1cbf0b0bdb5db5840bfe4303607b64f Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Tue, 10 Mar 2026 13:45:29 +0000
Subject: [PATCH] pull-toolchain.sh: advance the next hash if it's behind

Updates tailscale/corp#36382

Change-Id: Ida55b7b1a2cdd0a4653bb41852008e7088fc4a48
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
---
 pull-toolchain.sh | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/pull-toolchain.sh b/pull-toolchain.sh
index c80c913bb..effeca669 100755
--- a/pull-toolchain.sh
+++ b/pull-toolchain.sh
@@ -20,6 +20,32 @@ if [ "$upstream" != "$current" ]; then
 	echo "$upstream" >"$go_toolchain_rev_file"
 fi
 
+# When updating the regular (non-next) toolchain, also bump go.toolchain.next.rev
+# if it has fallen behind on the same branch. This happens when "next" was tracking
+# a release candidate (e.g. Go 1.26.0rc2) and the regular toolchain later gets
+# bumped to a newer release (e.g. Go 1.26.2) on the same branch. At that point
+# the "next" rev shouldn't still point at the older RC.
+if [ "${TS_GO_NEXT:-}" != "1" ]; then
+    read -r next_branch <go.toolchain.next.branch
+    if [ "$go_branch" = "$next_branch" ]; then
+        next_rev=$(cat go.toolchain.next.rev)
+        new_rev=$(cat go.toolchain.rev)
+        if [ "$next_rev" != "$new_rev" ]; then
+            # Fetch only commit objects (no trees/blobs) with limited depth
+            # to keep this fast — we just need the commit graph for ancestry check.
+            tmpdir="/tmp/tailscale-pull-toolchain-$$"
+            if git clone --bare --filter=tree:0 --depth=20000 --single-branch --branch "$go_branch" \
+                https://github.com/tailscale/go "$tmpdir" 2>/dev/null; then
+                if git -C "$tmpdir" merge-base --is-ancestor "$next_rev" "$new_rev" 2>/dev/null; then
+                    echo "$new_rev" >go.toolchain.next.rev
+                    echo "pull-toolchain.sh: also bumped go.toolchain.next.rev to match (was behind on same branch)" >&2
+                fi
+            fi
+            rm -rf "$tmpdir"
+        fi
+    fi
+fi
+
 # Only update go.toolchain.version and go.toolchain.rev.sri for the main toolchain,
 # skipping it if TS_GO_NEXT=1. Those two files are only used by Nix, and as of 2026-01-26
 # don't yet support TS_GO_NEXT=1 with flake.nix or in our corp CI.
@@ -29,6 +55,6 @@ if [ "${TS_GO_NEXT:-}" != "1" ]; then
     ./update-flake.sh
 fi
 
-if [ -n "$(git diff-index --name-only HEAD -- "$go_toolchain_rev_file" go.toolchain.rev.sri go.toolchain.version)" ]; then
+if [ -n "$(git diff-index --name-only HEAD -- "$go_toolchain_rev_file" go.toolchain.next.rev go.toolchain.rev.sri go.toolchain.version)" ]; then
     echo "pull-toolchain.sh: changes imported. Use git commit to make them permanent." >&2
 fi