chore: upgrade go to 1.26.0

.github/workflows/codeql.yml

@@ -49,9 +49,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Go
-        uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.25.6"
+          go-version-file: 'go.mod'
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

.github/workflows/lint.yml

@@ -24,25 +24,26 @@ jobs:
           - artifact-cas
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
-        with:
-          go-version: "1.25.6"
-
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Lint main module
-        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # 7.0.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
         if: ${{ matrix.app == 'main-module' }}
         with:
-          version: v2.4.0
+          version: v2.9.0
           only-new-issues: 'true'
 
       - name: Lint ${{ matrix.app }}
-        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # 7.0.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
         if: ${{ matrix.app != 'main-module' }}
         with:
           working-directory: app/${{ matrix.app }}
-          version: v2.4.0
+          version: v2.9.0
           only-new-issues: 'true'
 
   lint-protos:
@@ -65,19 +66,20 @@ jobs:
           cd ~/.local
           curl -L https://dl.dagger.io/dagger/install.sh | DAGGER_VERSION=0.19.3  sh
 
-      - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
-        with:
-          go-version: "1.25.6"
-
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Initialize module
         run: |
           make -C extras/dagger module-init
 
       - name: Lint
-        uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # 7.0.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
         with:
           working-directory: extras/dagger
-          version: v2.4.0
+          version: v2.9.0
           only-new-issues: 'true'

.github/workflows/release.yaml

@@ -79,9 +79,9 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Go
-        uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.25.6"
+          go-version-file: 'go.mod'
 
       # install qemu binaries for multiarch builds (needed by goreleaser/buildx)
       - name: Setup qemu

.github/workflows/test.yml

@@ -25,10 +25,10 @@ jobs:
           - artifact-cas
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.25.6"
-          cache: true
+          go-version-file: 'go.mod'
           cache-dependency-path: go.sum
 
       - name: Go Module tidy check

CLAUDE.md

@@ -135,7 +135,7 @@ make migration_lint         # Lint migration files
 
 ## Key Technologies
 
-- **Language**: Go 1.25.6
+- **Language**: Go 1.26.0
 - **API**: gRPC with HTTP/JSON gateway, Protocol Buffers with buf
 - **Database**: PostgreSQL with Ent ORM, Atlas for migrations
 - **Authentication**: OIDC, JWT tokens

app/artifact-cas/Dockerfile.goreleaser

@@ -1,4 +1,4 @@
-FROM golang:1.25.6@sha256:ce63a16e0f7063787ebb4eb28e72d477b00b4726f79874b3205a965ffd797ab2 AS builder
+FROM golang:1.26.0@sha256:75ca321c953ce0572c709fa186cff872a510a22d6dad515291c6eb29edb9c849 AS builder
 
 FROM scratch
 

app/cli/Dockerfile.goreleaser

@@ -1,4 +1,4 @@
-FROM golang:1.25.6@sha256:ce63a16e0f7063787ebb4eb28e72d477b00b4726f79874b3205a965ffd797ab2 AS builder
+FROM golang:1.26.0@sha256:75ca321c953ce0572c709fa186cff872a510a22d6dad515291c6eb29edb9c849 AS builder
 RUN mkdir -p /.config/chainloop
 
 FROM scratch

app/controlplane/Dockerfile.goreleaser

@@ -1,4 +1,4 @@
-FROM golang:1.25.6@sha256:ce63a16e0f7063787ebb4eb28e72d477b00b4726f79874b3205a965ffd797ab2 AS builder
+FROM golang:1.26.0@sha256:75ca321c953ce0572c709fa186cff872a510a22d6dad515291c6eb29edb9c849 AS builder
 
 FROM scratch
 

docs/examples/ci-workflows/github.yaml

@@ -39,9 +39,9 @@ jobs:
           chainloop attestation init --workflow $CHAINLOOP_WORKFLOW_NAME --project $CHAINLOOP_PROJECT_NAME
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.25.5"
+          go-version-file: 'go.mod'
 
       # Generate SBOM using syft in cycloneDX format
       - uses: anchore/sbom-action@v0

go.mod

@@ -1,6 +1,6 @@
 module github.com/chainloop-dev/chainloop
 
-go 1.25.6
+go 1.26.0
 
 require (
 	cloud.google.com/go/secretmanager v1.16.0