chore: update Go to 1.25.7 (#1574)

* chore: update Go toolchain to 1.25.3

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

* chore: update Go toolchain to 1.25.5

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

* fixup! chore: update Go toolchain to 1.25.5

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

* fixup! fixup! chore: update Go toolchain to 1.25.5

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

* fixup! fixup! fixup! chore: update Go toolchain to 1.25.5

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

* fixup! fixup! fixup! fixup! chore: update Go toolchain to 1.25.5

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

---------

Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>

Author: akurinnoy

.ci/oci.Dockerfile

@@ -19,14 +19,20 @@ ENV GO_VERSION=1.25.7
 ENV GOROOT=/usr/local/go
 ENV PATH=$GOROOT/bin:$PATH
 
+ENV GO_VERSION=1.25.7
+ENV GOROOT=/usr/local/go
+ENV PATH=$GOROOT/bin:$PATH
+
 SHELL ["/bin/bash", "-c"]
 
 # Install Go 1.25.7 to satisfy go.mod toolchain requirement (go 1.25.0)
 RUN export ARCH="$(uname -m)" && if [[ ${ARCH} == "x86_64" ]]; then export ARCH="amd64"; elif [[ ${ARCH} == "aarch64" ]]; then export ARCH="arm64"; fi && \
     curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" -o go.tar.gz && \
     rm -rf /usr/local/go && \
     tar -C /usr/local -xzf go.tar.gz && \
-    rm go.tar.gz
+    rm go.tar.gz && \
+    ln -sf /usr/local/go/bin/go /usr/bin/go.real && \
+    ln -sf /usr/local/go/bin/gofmt /usr/bin/gofmt
 RUN go version
 
 # Temporary workaround since mirror.centos.org is down and can be replaced with vault.centos.org

.github/workflows/code-coverage.yml

@@ -14,7 +14,7 @@ jobs:
       name: Set up Go 1.x
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: 1.24.6
+        go-version: 1.25.7
     -
       name: Set up Python 3.11
       uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa # v4.8.0

.github/workflows/pr.yml

@@ -15,7 +15,7 @@ jobs:
       name: Set up Go 1.x
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: 1.24.6
+        go-version: 1.25.7
     -
       name: Set up Python 3.11
       uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa # v4.8.0

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: 1.23.6
+          go-version: 1.25.7
       - name: Set up QEMU
         uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 #v2.2.0
 

CONTRIBUTING.md

@@ -46,7 +46,7 @@ Detailed instructions regarding the DevWorkspace Operator development are provid
 
 To build, test and debug the DevWorkspace Operator the following development tools are required:
 
-- go 1.16 or later
+- go 1.25 or later
 - git
 - sed
 - jq

build/Dockerfile

@@ -15,7 +15,8 @@
 
 # https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/ubi9/go-toolset
 # Use BUILDPLATFORM to ensure the builder always runs natively on the host machine
-FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.24.6-1758501173 AS builder
+# Image pinned by SHA256 to address GitHub security bot warnings about unpinned dependencies
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.25.7-1771417345@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc AS builder
 
 # Accept TARGETARCH and TARGETPLATFORM, which are automatically passed by the builder
 ARG TARGETARCH

go.mod

@@ -1,8 +1,8 @@
 module github.com/devfile/devworkspace-operator
 
-go 1.24.0
+go 1.25.0
 
-toolchain go1.24.6
+toolchain go1.25.7
 
 require (
 	github.com/devfile/api/v2 v2.3.1-alpha.0.20250521155908-5c3d7b99d252

project-clone/Dockerfile

@@ -15,7 +15,8 @@
 
 # Build the manager binary
 # https://access.redhat.com/containers/?tab=tags#/registry.access.redhat.com/ubi9/go-toolset
-FROM registry.access.redhat.com/ubi9/go-toolset:1.24.6-1758501173 as builder
+# Image pinned by SHA256 to address GitHub security bot warnings about unpinned dependencies
+FROM registry.access.redhat.com/ubi9/go-toolset:1.25.7-1771417345@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc as builder
 ARG TARGETARCH
 ARG TARGETOS
 ENV GOPATH=/go/