fix(ci): install the release Go toolchain from go.mod

[devantler]

🤖 Generated by the Daily AI Assistant

Problem

The CD - Go release pipeline has been failing since the go.mod floor was bumped. The GoReleaser job in .github/workflows/cd.yaml hardcoded go-version: "1.25.1", but #63 raised the go.mod floor to go 1.25.10 (needed for deadcode@v0.43.0). actions/setup-go pins GOTOOLCHAIN=local when given an explicit go-version, so GoReleaser bailed immediately at "getting and validating git state":

release failed after 0s
  │ failed to get module path: exit status 1: go: go.mod requires go >= 1.25.10 (running go 1.25.1; GOTOOLCHAIN=local)

As a result the v1.0.2 and v1.0.3 tag releases never published (run 26451728699, run 26451227121). main CI stayed green throughout because CI installs Go via the reusable validate-go-project workflow's go-version-file: go.mod — only this local CD workflow drifted.

Fix

Read the release Go version from go.mod (go-version-file: go.mod) instead of a hardcoded string, mirroring what CI already does. The release toolchain now tracks the floor automatically and can't silently drift below it again on the next bump.

Validation

• actionlint .github/workflows/cd.yaml — clean.
• Behaviour-preserving otherwise: cache: false (cache-poisoning guard) is unchanged; no new dependency; no caller-interface change.

Notes

Holistic follow-up (not in this PR): other Go products with a GoReleaser CD that hardcode go-version would hit the same wall once their go.mod floor moves past the pin — worth a consistency sweep (e.g. ksail). Tracked in the run report.

[Copilot]

Pull request overview

Fixes the broken CD - Go release pipeline by sourcing the Go toolchain version from go.mod instead of a hardcoded 1.25.1, which was below the go 1.25.10 floor and caused GoReleaser to fail under GOTOOLCHAIN=local.

Changes:

• Replace go-version: "1.25.1" with go-version-file: go.mod in the GoReleaser setup-go step.
• Add an explanatory comment about why the floor must be tracked dynamically.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	6		0	0	0.4s
✅ ACTION	zizmor	6	0	0	0	2.36s
✅ COPYPASTE	jscpd	yes		no	no	1.07s
✅ GO	golangci-lint	yes	yes	no	no	13.2s
✅ JSON	jsonlint	1		0	0	0.31s
✅ JSON	prettier	1	0	0	0	0.5s
✅ JSON	v8r	1		0	0	2.91s
⚠️ MARKDOWN	markdownlint	4	0	4	0	0.94s
✅ MARKDOWN	markdown-table-formatter	4	0	0	0	0.19s
✅ REPOSITORY	checkov	yes		no	no	22.26s
✅ REPOSITORY	gitleaks	yes		no	no	0.08s
✅ REPOSITORY	git_diff	yes		no	no	0.0s
✅ REPOSITORY	grype	yes		no	no	49.57s
✅ REPOSITORY	osv-scanner	yes		no	no	0.43s
✅ REPOSITORY	secretlint	yes		no	no	0.96s
✅ REPOSITORY	syft	yes		no	no	1.6s
✅ REPOSITORY	trivy	yes		no	no	11.9s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.21s
✅ REPOSITORY	trufflehog	yes		no	no	3.51s
✅ SPELL	lychee	15		0	0	1.2s
✅ YAML	prettier	10	0	0	0	0.38s
✅ YAML	v8r	10		0	0	11.37s
✅ YAML	yamllint	10		0	0	0.62s

Detailed Issues

⚠️ MARKDOWN / markdownlint - 4 errors

.claude/skills/maintain/SKILL.md:5 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "Perform maintenance per the **..."]
AGENTS.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 436]
AGENTS.md:31:401 error MD013/line-length Line length [Expected: 400; Actual: 1143]
CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository