fix: ci pipeline with correct version

Author: hpsing

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+
+updates:
+  # Go module dependencies
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    groups:
+      # Batch all indirect deps into one PR to reduce noise
+      indirect:
+        dependency-type: indirect
+
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10

.github/workflows/ci.yml

@@ -9,6 +9,10 @@ on:
 permissions:
   contents: read
 
+env:
+  go-version: "1.26.0"
+  lint-version: "v2.9.0"
+
 jobs:
   test:
     name: Test (${{ matrix.os }})
@@ -23,7 +27,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: stable
+          go-version: ${{ env.go-version }}
           cache: true
 
       - name: Verify module consistency
@@ -55,15 +59,32 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: stable
+          go-version: ${{ env.go-version }}
           cache: true
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v6
         with:
-          version: latest
+          version: ${{ env.lint-version }}
           args: --timeout=5m
 
+  vuln:
+    name: Vulnerability scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.go-version }}
+          cache: true
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...
+
   build-snapshot:
     name: Build snapshot
     runs-on: ubuntu-latest
@@ -74,7 +95,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: stable
+          go-version: ${{ env.go-version }}
           cache: true
 
       - uses: goreleaser/goreleaser-action@v6

.github/workflows/release.yml

@@ -9,6 +9,9 @@ permissions:
   contents: write
   packages: write
 
+env:
+  go-version: "1.26.0"
+
 jobs:
   release:
     name: Release
@@ -20,7 +23,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: stable
+          go-version: ${{ env.go-version }}
           cache: true
 
       - name: Run tests before release