Pin CI to Go 1.26.7 and stable action tags.

setup-go@main plus go-version-file 1.26.0 was flaky (version: not found) and still scanned an unpatched 1.26.0 stdlib.
2026-08-31 15:18:59 -05:00
parent c7a2312994
commit 19497eba0c
1 changed files with 6 additions and 8 deletions
@@ -9,11 +9,10 @@ jobs:
  check-and-test:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@main
-      - uses: actions/setup-go@main
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
        with:
-          go-version-file: 'go.mod'
-          check-latest: true
+          go-version: '1.26.7'
      - run: go mod tidy
      - run: go build ./...
      - run: go vet ./...
@@ -28,10 +27,9 @@ jobs:
  vulncheck:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@main
-      - uses: actions/setup-go@main
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
        with:
-          go-version-file: 'go.mod'
-          check-latest: true
+          go-version: '1.26.7'
      - run: GOTOOLCHAIN=auto go install golang.org/x/vuln/cmd/govulncheck@latest
      - run: govulncheck ./...