minor updates

.github/workflows/branch-pipeline.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version: '1.24'
 

.github/workflows/pr-pipeline.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version: '1.24'
 

.github/workflows/release-pipeline.yaml

@@ -3,7 +3,10 @@ name: release-pipeline
 on:
   push:
     tags:
-      - 'v*'
+      - 'v[0-9]+.[0-9]+.[0-9]+'
+
+permissions:
+  contents: write
 
 jobs:
   build:
@@ -48,3 +51,13 @@ jobs:
           ${{ vars.DOCKER_USERNAME }}/valkey-operator:${{ env.RELEASE_VERSION }}
           ghcr.io/${{ github.repository_owner }}/valkey-operator:${{ env.RELEASE_VERSION }}
         platforms: linux/amd64,linux/arm64
+
+  release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        with:
+          generate_release_notes: true

internal/ops/sentinel/actor/actor_ensure_resource.go

@@ -127,7 +127,7 @@ func (a *actorEnsureResource) ensureStatefulSet(ctx context.Context, inst types.
 			logger.Error(err, "generate secret sig failed")
 			return actor.NewResultWithError(ops.CommandAbort, err)
 		}
-		sts.Spec.Template.Labels[builder.ChecksumKey("secret")] = secretSig
+		sts.Spec.Template.Annotations[builder.ChecksumKey("secret")] = secretSig
 	}
 
 	configName := sentinelbuilder.SentinelConfigMapName(sen.Name)