[np5]

Moves the toolchain to 1.26.9 and adds a govulncheck workflow.

Why

go.mod pinned go 1.25.3, and release.yml builds the shipped binaries with exactly that (setup-go with go-version-file: go.mod). Go 1.25.3 carries 48 stdlib advisories, 35 of them fixed by a later 1.25.x patch alone — the HTTP/2, net/http and html/template XSS classes.

Nothing here would ever have surfaced that. This repo has no scanner of any kind, and osv-scanner would not have helped either: it reads module requirements and ignores the go directive, so stdlib advisories are invisible to it.

1.26.9 rather than the newest 1.25.x because 1.25 is outside the supported window now that 1.26 and 1.27 are current, so it stops receiving fixes.

The two halves are a package, not a coincidence

govulncheck v1.9.0 requires go >= 1.26.0. Under the old pin it refuses to build at all:

golang.org/x/vuln@v1.9.0 requires go >= 1.26.0 (running go 1.25.3; GOTOOLCHAIN=local)

So bumping the toolchain is a precondition for having the check, not just a tidy-up alongside it.

Configuration detail

Important

govulncheck keys off the toolchain it runs under, not the go directive.

The workflow therefore uses setup-go with go-version-file: go.mod. Running it on stable — the default of golang/govulncheck-action — would assess whatever Go is newest and report clean while go.mod still pinned a vulnerable release, which is exactly the case it exists to catch. A go version step makes the assessed toolchain visible in the log.

Triggers mirror terraform-provider-zentral's, which is already configured this way: pull_request, push to main, a daily cron, and workflow_dispatch. The scheduled run matters most — these advisories get published against unchanged code.

Verification

In containers, on go1.26.9: go mod verify → all modules verified; go build ./... and go vet ./... clean; govulncheck ./... → No vulnerabilities found.

Note on go test: it passes, but it proves only that the code compiles — this repo has no test files at all, every package reports [no test files].

⚠️ This PR cannot merge as the repo is currently configured

Separate from the change itself, and worth fixing before this or any other PR can land.

The main ruleset requires build-darwin and build-others with strict=true. Both come from release.yml, which triggers only on:

on:
  push:
    tags: ['v*']
  workflow_dispatch:

There is no pull_request trigger, and every workflow run in this repo's history is a v* tag push or a workflow_dispatch — none has ever been triggered by a pull request. So those two required checks can never report on a PR, and no PR can satisfy them.

They are also not PR-safe as written: build-darwin pulls Apple signing certificates from 1Password and notarizes, and build-others runs goreleaser release, which publishes.

The ruleset was last updated 2026-07-06; the most recent PRs merged 2026-05-29, so nothing has exercised this since the change. Resolving it is a decision for you — most likely requiring a PR-safe check instead (this govulncheck job, or a build-only job that does not sign or publish) rather than the two release jobs.

🤖 Generated with Claude Code

[soysauceconspiracy]

LGTM