cascade: pass CHANGELOG_SECRET so auto-bumps get LLM changelogs (#19)

* cascade: pass CHANGELOG_SECRET so auto-bumps get LLM changelogs

Org-wide CHANGELOG_SECRET was never forwarded to the reusable tag-bump
workflow, so its auto-changelog step silently skipped on every cascade
bump. Matches trustedagents, the one repo already wired.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* go.mod: bump go directive to 1.25.12 (GO-2026-5856 + web4 v1.12.5 sibling constraint)

govulncheck flags GO-2026-5856 (crypto/tls, fixed in go1.25.12), and CI
runs GOTOOLCHAIN=local with the sibling web4 checkout now requiring
go >= 1.25.12 — same bump web4 shipped in v1.12.5.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci: track go toolchain from go.mod instead of pinning 1.25

go-version: '1.25' resolves to the runner's cached 1.25.11 while
GOTOOLCHAIN=local forbids auto-upgrade, so the go.mod 1.25.12 bump
(GO-2026-5856) fails every job. go-version-file keeps CI in lockstep
with the module.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci: go-version-file must point into the subdir checkout

This job checks the repo out at path: libpilot, so go.mod lives at
libpilot/go.mod, not the workspace root.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: TeoSlayer

.github/workflows/cascade.yml

@@ -34,3 +34,5 @@ jobs:
       version: ${{ inputs.version || github.event.client_payload.version }}
       is_prerelease: ${{ inputs.is_prerelease == true || github.event.client_payload.is_prerelease == true }}
       stable_only: true
+    secrets:
+      CHANGELOG_SECRET: ${{ secrets.CHANGELOG_SECRET }}

.github/workflows/ci.yml

@@ -116,7 +116,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25'
+          go-version-file: libpilot/go.mod
           cache: true
           cache-dependency-path: libpilot/go.sum
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/pilot-protocol/libpilot
 
-go 1.25.11
+go 1.25.12
 
 require (
 	github.com/pilot-protocol/common v0.5.5