Stop pinning Go to patch versions, use stable in CI (#1137)

<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
We keep bumping `go 1.26.x` across the repo every time a new Go patch
drops
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **`go.mod` / `deploy/go.mod`**: `go 1.25.8` → `go 1.26` (minor only —
"this module needs Go 1.26")
- **All CI workflows**: `go-version-file: 'go.mod'` → `go-version:
'stable'` — CI always uses the latest stable Go, no more
  bump PRs
- **govulncheck**: removed hardcoded `go-version-input: '1.26.1'` →
`go-version-input: 'stable'`
## Breaking Changes
<!-- Will users need to update their code or configurations? -->

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

Author: rdimitrov

.github/workflows/ci.yml

@@ -21,13 +21,13 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
       with:
-        go-version-file: 'go.mod'
+        go-version: 'stable'
         cache: true
 
     - name: Run lint
       uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20
       with:
-        version: v2.4.0
+        version: v2.11.4
 
     - name: Validate schemas and examples
       run: make validate
@@ -38,9 +38,7 @@ jobs:
     - name: Run govulncheck
       uses: golang/govulncheck-action@v1
       with:
-        # Use Go 1.26.1 to pick up crypto/x509 vulnerability fixes (GO-2026-4600, GO-2026-4599).
-        # go.mod stays at go 1.25.8 for golangci-lint compatibility until it supports Go 1.26.
-        go-version-input: '1.26.1'
+        go-version-input: 'stable'
         go-package: ./...
         repo-checkout: false
 
@@ -55,7 +53,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
       with:
-        go-version-file: 'go.mod'
+        go-version: 'stable'
         cache: true
 
     - name: Set up ko

.github/workflows/deploy-production.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
-          go-version-file: 'deploy/go.mod'
+          go-version: 'stable'
           cache: true
 
       - name: Setup Pulumi

.github/workflows/deploy-staging.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
-          go-version-file: 'go.mod'
+          go-version: 'stable'
           cache: true
 
       - name: Set up ko
@@ -75,7 +75,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
-          go-version-file: 'deploy/go.mod'
+          go-version: 'stable'
           cache: true
 
       - name: Setup Pulumi

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
-          go-version-file: 'go.mod'
+          go-version: 'stable'
           cache: true
 
       - name: Install cosign
@@ -50,7 +50,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
         with:
-          go-version-file: 'go.mod'
+          go-version: 'stable'
           cache: true
 
       - name: Set up ko

.golangci.yml

@@ -66,6 +66,11 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
+    rules:
+      # httptest.NewRequest is idiomatic in tests; noctx is not useful there.
+      - path: _test\.go
+        linters:
+          - noctx
     paths:
       - third_party$
       - builtin$

cmd/publisher/auth/common.go

@@ -160,7 +160,7 @@ func parseRawPrivateKey(curve elliptic.Curve, privateKeyBytes []byte) (*ecdsa.Pr
 		return nil, fmt.Errorf("invalid private scalar")
 	}
 
-	x, y := curve.ScalarBaseMult(d.Bytes())
+	x, y := curve.ScalarBaseMult(d.Bytes()) //nolint:staticcheck // SA1019: needs crypto/ecdh refactor
 	return &ecdsa.PrivateKey{
 		PublicKey: ecdsa.PublicKey{
 			Curve: curve,
@@ -192,7 +192,7 @@ func PrintEcdsaP384KeyInfo(pubKey ecdsa.PublicKey) {
 }
 
 func printEcdsaKeyInfo(k string, pubKey ecdsa.PublicKey) {
-	compressed := elliptic.MarshalCompressed(pubKey.Curve, pubKey.X, pubKey.Y)
+	compressed := elliptic.MarshalCompressed(pubKey.Curve, pubKey.X, pubKey.Y) //nolint:staticcheck // SA1019: needs crypto/ecdh refactor
 	pubKeyString := base64.StdEncoding.EncodeToString(compressed)
 	fmt.Fprint(os.Stdout, "Expected proof record:\n")
 	fmt.Fprintf(os.Stdout, "v=MCPv1; k=%s; p=%s\n", k, pubKeyString)

cmd/publisher/auth/github-oidc.go

@@ -122,7 +122,7 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string
 	fullURL := requestURL + "&audience=mcp-registry"
 
 	// Create the request
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil) //nolint:gosec // G704: URL is from GitHub Actions ACTIONS_ID_TOKEN_REQUEST_URL env var
 	if err != nil {
 		return "", fmt.Errorf("failed to create request: %w", err)
 	}
@@ -133,7 +133,7 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string
 
 	// Make the request
 	client := &http.Client{}
-	resp, err := client.Do(req)
+	resp, err := client.Do(req) //nolint:gosec // G704: URL is from GitHub Actions env var
 	if err != nil {
 		return "", fmt.Errorf("failed to send request: %w", err)
 	}

deploy/go.mod

@@ -1,6 +1,6 @@
 module github.com/modelcontextprotocol/registry/deploy/infra
 
-go 1.25.8
+go 1.26
 
 require (
 	github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1

go.mod

@@ -1,6 +1,6 @@
 module github.com/modelcontextprotocol/registry
 
-go 1.25.8
+go 1.26
 
 require (
 	cloud.google.com/go/kms v1.26.0

internal/api/handlers/v0/auth/oidc_test.go

@@ -31,7 +31,7 @@ func TestOIDCHandler_ExchangeToken(t *testing.T) {
 		token         string
 		expectedError bool
 	}{
-		{
+		{ //nolint:gosec // G101: test data, not real credentials
 			name: "successful token exchange with publish permissions",
 			config: &config.Config{
 				OIDCEnabled:      true,