clean up ci and update go to 1.25

Signed-off-by: Carlos Panato <ctadeu@gmail.com>

Author: cpanato

.github/workflows/docs.yml

@@ -1,6 +1,5 @@
 name: github pages
-permissions:
-  contents: write
+
 on:
   push:
     paths:
@@ -9,9 +8,15 @@ on:
     branches:
       - main  # Set a branch to deploy
 
+permissions: {}
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

.github/workflows/release.yml

@@ -5,6 +5,8 @@ on:
     tags:
       - 'v*'
 
+permissions: {}
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -22,8 +24,9 @@ jobs:
 
       - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: '1.24'
+          go-version: '1.25'
           check-latest: true
+          cache: false
 
       - name: Install cosign
         uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

.github/workflows/snapshot.yml

@@ -5,19 +5,27 @@ on:
     branches:
       - 'main'
   pull_request:
+    branches:
+      - 'main'
+
+permissions: {}
 
 jobs:
   snapshot:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Check out code onto GOPATH
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
-          go-version: '1.24'
+          go-version: '1.25'
           check-latest: true
+          cache: false
 
       - name: Install GoReleaser
         uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0

.github/workflows/verify-spdx.yaml

@@ -2,17 +2,25 @@ name: Validate SPDX Conformance
 
 on:
   pull_request:
-    branches: ['main']
+    branches:
+      - 'main'
+
+permissions: {}
 
 jobs:
   check-spdx:
     name: Check SPDX SBOMs
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v3.3.0
         with:
-          go-version: '1.24'
+          go-version: '1.25'
           check-latest: true
+          cache: false
 
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - run: |