Sync main with pion/dtls main

.github/workflows/fuzz.yaml

@@ -23,5 +23,5 @@ jobs:
   fuzz:
     uses: pion/.goassets/.github/workflows/fuzz.reusable.yml@main
     with:
-      go-version: "1.25" # auto-update/latest-go-version
+      go-version: "1.27" # auto-update/latest-go-version
       fuzz-time: "60s"

.github/workflows/goassets-automerge.yml

@@ -0,0 +1,96 @@
+#
+# DO NOT EDIT THIS FILE
+#
+# It is automatically copied from https://github.com/pion/.goassets repository.
+# If this repository should have package specific CI config,
+# remove the repository name from .goassets/.github/workflows/assets-sync.yml.
+#
+# If you want to update the shared CI config, send a PR to
+# https://github.com/pion/.goassets instead of this repository.
+#
+# SPDX-FileCopyrightText: 2026 The Pion community <https://pion.ly>
+# SPDX-License-Identifier: MIT
+
+name: Auto-merge .goassets updates
+on:
+  pull_request_target:
+    types: [opened]
+  workflow_run:
+    workflows: [API, CodeQL, Fuzz, Go mod tidy, Lint, REUSE Compliance Check, Test]
+    types: [completed]
+    branches: [sync-assets-*]
+
+permissions:
+  checks: read
+  contents: write
+  pull-requests: write
+  statuses: read
+
+concurrency:
+  group: goassets-automerge-${{ github.event.pull_request.head.ref || github.event.workflow_run.head_branch }}
+  cancel-in-progress: false
+
+jobs:
+  auto-merge:
+    if: >-
+      github.repository_owner == 'pion' &&
+      ((github.event_name == 'pull_request_target' &&
+        github.event.pull_request.user.login == 'pionbot' &&
+        github.event.pull_request.base.ref == 'main' &&
+       github.event.pull_request.head.repo.full_name == github.repository) ||
+       (github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.head_repository.full_name == github.repository))
+    runs-on: ubuntu-26.04
+    timeout-minutes: 60
+    steps:
+      - name: Validate .goassets PR
+        id: pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          HEAD: ${{ github.event.pull_request.head.ref || github.event.workflow_run.head_branch }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
+        run: |
+          if ! [[ "$HEAD" =~ ^sync-assets-v[0-9]+\.[0-9]+\.[0-9]+$ ]] &&
+             ! [[ "$REPOSITORY" == "pion/ci-sandbox" && "$HEAD" == "sync-assets-main" ]]; then
+            exit 0
+          fi
+
+          # Fetch current PR data: reruns may refer to a closed PR or an old commit.
+          gh api --method GET "repos/$REPOSITORY/pulls" \
+            -f state=open -f base=main -f head="${REPOSITORY%%/*}:$HEAD" |
+            jq -r --arg repository "$REPOSITORY" --arg head "$HEAD" --arg sha "$HEAD_SHA" '
+              .[] | select(
+                .user.login == "pionbot" and
+                .state == "open" and
+                .draft == false and
+                .base.ref == "main" and
+                .head.repo.full_name == $repository and
+                .head.ref == $head and
+                .head.sha == $sha and
+                .title == ("Update CI configs to " + ($head | ltrimstr("sync-assets-")))
+              ) | "url=\(.html_url)"
+            ' >> "$GITHUB_OUTPUT"
+
+      - name: Approve
+        if: steps.pr.outputs.url != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ steps.pr.outputs.url }}
+        run: gh pr review "$PR_URL" --approve
+
+      - name: Wait for required checks
+        if: steps.pr.outputs.url != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ steps.pr.outputs.url }}
+        run: gh pr checks "$PR_URL" --required --watch --fail-fast
+
+      - name: Merge
+        if: steps.pr.outputs.url != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ steps.pr.outputs.url }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
+        run: gh pr merge "$PR_URL" --rebase --match-head-commit "$HEAD_SHA"

.github/workflows/interop.yaml

@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: 2026 The Pion community <https://pion.ly>
+# SPDX-License-Identifier: MIT
+
+name: Interoperability
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: interop-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  interop:
+    uses: pion/dtls-interop/.github/workflows/interop-tests.yaml@main
+    with:
+      dtls-repository: ${{ github.repository }}
+      dtls-ref: ${{ github.event.pull_request.head.sha || github.sha }}

.github/workflows/release.yml

@@ -21,4 +21,4 @@ jobs:
   release:
     uses: pion/.goassets/.github/workflows/release.reusable.yml@main
     with:
-      go-version: "1.25" # auto-update/latest-go-version
+      go-version: "1.27" # auto-update/latest-go-version

.github/workflows/test.yaml

@@ -23,7 +23,7 @@ jobs:
     uses: pion/.goassets/.github/workflows/test.reusable.yml@main
     strategy:
       matrix:
-        go: ["1.25", "1.24"] # auto-update/supported-go-version-list
+        go: ["1.27", "1.26"] # auto-update/supported-go-version-list
       fail-fast: false
     with:
       go-version: ${{ matrix.go }}
@@ -33,7 +33,7 @@ jobs:
     uses: pion/.goassets/.github/workflows/test-i386.reusable.yml@main
     strategy:
       matrix:
-        go: ["1.25", "1.24"] # auto-update/supported-go-version-list
+        go: ["1.27", "1.26"] # auto-update/supported-go-version-list
       fail-fast: false
     with:
       go-version: ${{ matrix.go }}
@@ -42,7 +42,7 @@ jobs:
     uses: pion/.goassets/.github/workflows/test-windows.reusable.yml@main
     strategy:
       matrix:
-        go: ["1.25", "1.24"] # auto-update/supported-go-version-list
+        go: ["1.27", "1.26"] # auto-update/supported-go-version-list
       fail-fast: false
     with:
       go-version: ${{ matrix.go }}
@@ -51,13 +51,13 @@ jobs:
     uses: pion/.goassets/.github/workflows/test-macos.reusable.yml@main
     strategy:
       matrix:
-        go: ["1.25", "1.24"] # auto-update/supported-go-version-list
+        go: ["1.27", "1.26"] # auto-update/supported-go-version-list
       fail-fast: false
     with:
       go-version: ${{ matrix.go }}
 
   test-wasm:
     uses: pion/.goassets/.github/workflows/test-wasm.reusable.yml@main
     with:
-      go-version: "1.25" # auto-update/latest-go-version
+      go-version: "1.27" # auto-update/latest-go-version
     secrets: inherit

.github/workflows/tidy-check.yaml

@@ -22,4 +22,4 @@ jobs:
   tidy:
     uses: pion/.goassets/.github/workflows/tidy-check.reusable.yml@main
     with:
-      go-version: "1.25" # auto-update/latest-go-version
+      go-version: "1.27" # auto-update/latest-go-version

.golangci.yml

@@ -23,10 +23,8 @@ linters:
     - forbidigo        # Forbids identifiers
     - forcetypeassert  # finds forced type assertions
     - gochecknoglobals # Checks that no globals are present in Go code
-    - gocognit         # Computes and checks the cognitive complexity of functions
     - goconst          # Finds repeated strings that could be replaced by a constant
     - gocritic         # The most opinionated Go source code linter
-    - gocyclo          # Computes and checks the cyclomatic complexity of functions
     - godot            # Check if comments end in a period
     - godox            # Tool for detection of FIXME, TODO and other comment keywords
     - goheader         # Checks is file header matches to pattern
@@ -38,7 +36,6 @@ linters:
     - importas         # Enforces consistent import aliases
     - ineffassign      # Detects when assignments to existing variables are not used
     - lll              # Reports long lines
-    - maintidx         # maintidx measures the maintainability index of each function.
     - makezero         # Finds slice declarations with non-zero initial length
     - misspell         # Finds commonly misspelled English words in comments
     - modernize        # Replace and suggests simplifications to code
@@ -78,6 +75,8 @@ linters:
     - wrapcheck        # Checks that errors returned from external packages are wrapped
     - wsl              # Whitespace Linter - Forces you to use empty lines!
   settings:
+    lll:
+      line-length: 320
     staticcheck:
       checks:
         - all
@@ -105,12 +104,19 @@ linters:
     govet:
       enable:
         - shadow
+    gosec:
+      excludes:
+        - G117 # noisy secret/password field-name checks.
     revive:
       rules:
         # Prefer 'any' type alias over 'interface{}' for Go 1.18+ compatibility
         - name: use-any
           severity: warning
           disabled: false
+        # Keep package documentation consistent and avoid duplicate package comments.
+        - name: package-comments
+          severity: warning
+          disabled: false
     misspell:
       locale: US
     varnamelen:
@@ -130,11 +136,7 @@ linters:
     rules:
       - linters:
           - forbidigo
-          - gocognit
         path: (examples|main\.go)
-      - linters:
-          - gocognit
-        path: _test\.go
       - linters:
           - forbidigo
         path: cmd
@@ -147,5 +149,5 @@ formatters:
   exclusions:
     generated: lax
 issues:
+  max-same-issues: 0
   max-issues-per-linter: 0
-  max-same-issues: 0