fix: update to go1.25.8, and use separate .go-version file (#2246)

Commit bf0f710 removed the patch
version from go.mod, but overlooked that the go-setup action in
github actions workflows were configured to use 'go.mod' for its
version.

Unfortunately, go-setup action (incorrectly) uses the specified
version as an exact version, not as minimum, which meant that
actions (and release flows) would now downgrade to go1.25.0;

    Run actions/setup-go@v6
    Setup go version spec 1.25.0
    Attempting to download 1.25.0...
    matching 1.25.0...
    Acquiring 1.25.0 from https://github.com/actions/go-versions/releases/download/1.25.0-16925932082/go-1.25.0-linux-x64.tar.gz
    Extracting Go...
    ...
    go version go1.25.0 linux/amd64

This patch:

- Adds a dedicated `.go-version` file, which specifies the version
  of go to use, independently from the version in `go.mod` (which
  defines the minimum supported version).
- Sets GOTOOLCHAIN=local to prevent changes in `go.mod` from implicitly
  updating the go version to a newer version.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Author: thaJeztah

.github/workflows/build.yaml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: ['main']
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
 
   build:
@@ -14,7 +17,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
+          go-version-file: '.go-version'
 
       - run: |
           go build ./...

.github/workflows/bump-deps.yaml

@@ -9,6 +9,9 @@ permissions:
   contents: write
   pull-requests: write
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   bump-deps:
     name: Bump Deps
@@ -21,7 +24,7 @@ jobs:
     - uses: actions/checkout@v6
     - uses: actions/setup-go@v6
       with:
-        go-version-file: go.mod
+        go-version-file: '.go-version'
 
     - run: ./hack/bump-deps.sh
     - name: Create Pull Request

.github/workflows/e2e.yaml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: ['main']
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   e2e:
     strategy:
@@ -19,7 +22,7 @@ jobs:
     - uses: actions/checkout@v6
     - uses: actions/setup-go@v6
       with:
-        go-version-file: go.mod
+        go-version-file: '.go-version'
 
     - name: crane append to an image, set the entrypoint, run it locally, roundtrip it
       shell: bash

.github/workflows/ecr-auth.yaml

@@ -10,6 +10,9 @@ permissions:
   # This lets us mint identity tokens.
   id-token: write
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   krane:
     runs-on: ubuntu-latest
@@ -21,7 +24,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
+          go-version-file: '.go-version'
 
       - name: Install krane
         working-directory: ./cmd/krane
@@ -60,7 +63,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
+          go-version-file: '.go-version'
 
       - name: Install crane
         working-directory: ./cmd/crane

.github/workflows/ghcr-auth.yaml

@@ -10,14 +10,17 @@ permissions:
   contents: read
   packages: read
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   krane:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
+          go-version-file: '.go-version'
 
       - name: Install krane
         working-directory: ./cmd/krane

.github/workflows/presubmit.yaml

@@ -20,6 +20,9 @@ on:
   pull_request:
     branches: ['main']
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   presubmit:
     name: Presubmit
@@ -29,5 +32,5 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
+          go-version-file: '.go-version'
       - run: ./hack/presubmit.sh

.github/workflows/release.yml

@@ -4,6 +4,9 @@ on:
   push:
     tags: ['*']
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   goreleaser:
     permissions:
@@ -17,8 +20,9 @@ jobs:
         run: git fetch --prune --unshallow
       - uses: actions/setup-go@v6
         with:
-          go-version: 1.25
-          check-latest: true
+          go-version-file: '.go-version'
+          check-latest: true # no-op if full version is specified
+          cache: false
       - uses: goreleaser/goreleaser-action@v7.0.0
         id: run-goreleaser
         with:

.github/workflows/style.yaml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: ['main']
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
 
   goimports:
@@ -13,7 +16,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
+          go-version-file: '.go-version'
       - uses: chainguard-dev/actions/goimports@main
 
   lint:
@@ -24,7 +27,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
+          go-version-file: '.go-version'
       - uses: golangci/golangci-lint-action@v9.2.0
         with:
           version: v2.10

.github/workflows/test.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ['main']
 
+env:
+  GOTOOLCHAIN: local
+
 jobs:
   test:
     name: Unit Tests
@@ -14,7 +17,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
+          go-version-file: '.go-version'
 
       - run: go test -coverprofile=coverage.txt -covermode=atomic -race ./...
 

.go-version

@@ -0,0 +1 @@
+1.25.8