Revert to go-version-file go.mod for controllable Go version pinning

Author: telegrapher

.github/workflows/ci.yml

@@ -20,11 +20,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      # Always use the latest stable Go release for the newest compiler and stdlib fixes.
+      # Go version is read from go.mod so it stays in sync with the project.
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 'stable'
+          go-version-file: go.mod
 
       # Verify dependency checksums match go.sum (detects corrupted or tampered modules).
       - name: Verify dependencies
@@ -48,7 +48,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 'stable'
+          go-version-file: go.mod
 
       - name: Run go vet
         run: go vet ./...
@@ -72,7 +72,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 'stable'
+          go-version-file: go.mod
 
       - name: Build
         run: go build -o /dev/null .

.github/workflows/govulncheck.yml

@@ -24,13 +24,13 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: 'stable'
+          go-version-file: go.mod
 
       # golang/govulncheck-action runs govulncheck against all packages (./...).
       # With the default text output format, the job fails if vulnerabilities are found.
       - uses: golang/govulncheck-action@v1
         with:
-          go-version-input: 'stable'
+          go-version-file: go.mod
 
   # Open a GitHub issue when the scheduled scan finds vulnerabilities.
   # Only runs on cron failures — PR and push failures are visible in the checks UI.

.github/workflows/main.yml

@@ -21,11 +21,11 @@ jobs:
         with:
           fetch-depth: 0
 
-      # Always use the latest stable Go release for the newest compiler and stdlib fixes.
+      # Go version is read from go.mod so it stays in sync with the project.
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: 'stable'
+          go-version-file: go.mod
 
       # GoReleaser builds, packages and publishes the release.
       # See .goreleaser.yml for build targets and packaging configuration.