<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
We keep bumping `go 1.26.x` across the repo every time a new Go patch
drops
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
- **`go.mod` / `deploy/go.mod`**: `go 1.25.8` → `go 1.26` (minor only —
"this module needs Go 1.26")
- **All CI workflows**: `go-version-file: 'go.mod'` → `go-version:
'stable'` — CI always uses the latest stable Go, no more
bump PRs
- **govulncheck**: removed hardcoded `go-version-input: '1.26.1'` →
`go-version-input: 'stable'`
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Bumps the actions group with 2 updates in the / directory:
[actions/setup-go](https://github.com/actions/setup-go) and
[sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).
Updates `actions/setup-go` from 6.3.0 to 6.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-go/releases">actions/setup-go's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add go-download-base-url input for custom Go distributions by <a
href="https://github.com/gdams"><code>@gdams</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/727">actions/setup-go#727</a></li>
</ul>
<h3>Documentation update</h3>
<ul>
<li>Rearrange README.md, add advanced-usage.md by <a
href="https://github.com/priyagupta108"><code>@priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-go/pull/724">actions/setup-go#724</a></li>
<li>Fix Microsoft build of Go link by <a
href="https://github.com/gdams"><code>@gdams</code></a> in <a
href="https://redirect.github.com/actions/setup-go/pull/734">actions/setup-go#734</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/gdams"><code>@gdams</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-go/compare/v6...v6.4.0">https://github.com/actions/setup-go/compare/v6...v6.4.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="4a3601121d"><code>4a36011</code></a>
docs: fix Microsoft build of Go link (<a
href="https://redirect.github.com/actions/setup-go/issues/734">#734</a>)</li>
<li><a
href="8f19afcc70"><code>8f19afc</code></a>
feat: add go-download-base-url input for custom Go distributions (<a
href="https://redirect.github.com/actions/setup-go/issues/721">#721</a>)</li>
<li><a
href="27fdb267c1"><code>27fdb26</code></a>
Bump minimatch from 3.1.2 to 3.1.5 (<a
href="https://redirect.github.com/actions/setup-go/issues/727">#727</a>)</li>
<li><a
href="def8c394e3"><code>def8c39</code></a>
Rearrange README.md, add advanced-usage.md (<a
href="https://redirect.github.com/actions/setup-go/issues/724">#724</a>)</li>
<li>See full diff in <a
href="4b73464bb3...4a3601121d">compare
view</a></li>
</ul>
</details>
<br />
Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's
releases</a>.</em></p>
<blockquote>
<h2>v4.1.1</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: update default cosign-release to v3.0.5 in <a
href="https://redirect.github.com/sigstore/cosign-installer/pull/223">sigstore/cosign-installer#223</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1">https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="cad07c2e89"><code>cad07c2</code></a>
chore: update default cosign-release to v3.0.5 (<a
href="https://redirect.github.com/sigstore/cosign-installer/issues/223">#223</a>)</li>
<li>See full diff in <a
href="ba7bc0a3fe...cad07c2e89">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary
Fixes two CI issues:
### 1. Deploy workflows broken since PR #1034 (all staging deploys
failing)
The deploy-staging and deploy-production workflows install Go using the
**root** `go.mod`, but then build Pulumi infrastructure code from the
`deploy/` directory which has its own `go.mod`.
This started failing when PR #1034 (`build(deps): bump
github.com/pulumi/pulumi/sdk/v3 from 3.220.0 to 3.225.1 in /deploy`)
bumped `deploy/go.mod` from Go 1.24.11 to **Go 1.25.6** — a version
newer than the root module's Go 1.24.13. Every staging deploy since that
merge (Mar 6) has failed with:
```
go: go.mod requires go >= 1.25.6 (running go 1.24.13; GOTOOLCHAIN=local)
```
The last successful deploy was commit cb4807a on Mar 1, before the Go
version bump.
**Fix**: point `go-version-file` in both deploy workflows at
`deploy/go.mod` instead of the root `go.mod`.
### 2. `govulncheck` failing due to Go stdlib vulnerabilities
Five new Go stdlib vulnerabilities (GO-2026-4599 through GO-2026-4603)
were published on Mar 5-6 affecting Go 1.24.13, fixed in Go 1.25.8.
These cause `govulncheck` in the CI pipeline to fail.
**Fix**: bump root `go.mod` from Go 1.24.13 to Go 1.25.8.
## Test plan
- [ ] CI pipeline passes (govulncheck, build, lint, tests)
- [ ] Verify the deploy-staging workflow passes on the next push to main
after merge
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Bumps the actions group with 2 updates:
[actions/checkout](https://github.com/actions/checkout) and
[anchore/sbom-action](https://github.com/anchore/sbom-action).
Updates `actions/checkout` from 5.0.0 to 5.0.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="93cb6efe18"><code>93cb6ef</code></a>
Cleanup actions/checkout@v6 auth style (<a
href="https://redirect.github.com/actions/checkout/issues/2301">#2301</a>)</li>
<li>See full diff in <a
href="08c6903cd8...93cb6efe18">compare
view</a></li>
</ul>
</details>
<br />
Updates `anchore/sbom-action` from 0.20.9 to 0.20.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anchore/sbom-action/releases">anchore/sbom-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.20.10</h2>
<h2>Changes in v0.20.10</h2>
<ul>
<li>chore(deps): update Syft to v1.38.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/548">#548</a>)
[[<a
href="https://github.com/apps/anchore-actions-token-generator">anchore-actions-token-generator[bot]</a>](<a
href="https://github.com/%5Banchore-actions-token-generator%5Bbot%5D%5D(https://github.com/apps/anchore-actions-token-generator))%5D">https://github.com/[anchore-actions-token-generator[bot]](https://github.com/apps/anchore-actions-token-generator))]</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="fbfd9c6c18"><code>fbfd9c6</code></a>
chore(deps): update Syft to v1.38.0 (<a
href="https://redirect.github.com/anchore/sbom-action/issues/548">#548</a>)</li>
<li>See full diff in <a
href="https://github.com/anchore/sbom-action/compare/v0.20.9...v0.20.10">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the actions group with 1 update:
[pulumi/actions](https://github.com/pulumi/actions).
Updates `pulumi/actions` from 6.6.0 to 6.6.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/actions/releases">pulumi/actions's
releases</a>.</em></p>
<blockquote>
<h2>v6.6.1</h2>
<h2>What's Changed</h2>
<ul>
<li>upgrade pulumi/pulumi to latest by <a
href="https://github.com/tgummerer"><code>@tgummerer</code></a> in <a
href="https://redirect.github.com/pulumi/actions/pull/1394">pulumi/actions#1394</a></li>
<li>Prepare changelog for 6.6.1 by <a
href="https://github.com/tgummerer"><code>@tgummerer</code></a> in <a
href="https://redirect.github.com/pulumi/actions/pull/1395">pulumi/actions#1395</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pulumi/actions/compare/v6...v6.6.1">https://github.com/pulumi/actions/compare/v6...v6.6.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pulumi/actions/blob/main/CHANGELOG.md">pulumi/actions's
changelog</a>.</em></p>
<blockquote>
<h1>CHANGELOG</h1>
<h2>HEAD (Unreleased)</h2>
<p><strong>(none)</strong></p>
<hr />
<h2>6.6.1 (2025-11-12)</h2>
<ul>
<li>chore: Update pulumi/pulumi dependency
(<a
href="https://redirect.github.com/pulumi/actions/pull/1394">#1394</a>)</li>
</ul>
<h2>6.6.0 (2025-09-29)</h2>
<ul>
<li>feat: Strip ansi control characters from GitHub step Summary and PR
comment
(<a
href="https://redirect.github.com/pulumi/actions/pull/1312">#1312</a>)</li>
</ul>
<h2>6.4.0 (2025-07-16)</h2>
<ul>
<li>feat: Add <code>run-program</code> flag support for refresh,
destroy, preview, and
up/update commands (<a
href="https://redirect.github.com/pulumi/actions/pull/1376">#1376</a>)</li>
</ul>
<h2>6.3.0 (2025-05-08)</h2>
<ul>
<li>
<p>feat: support <code>--exclude</code> and
<code>--exclude-dependents</code> flags
(<a
href="https://redirect.github.com/pulumi/actions/pull/1363">#1363</a>)</p>
</li>
<li>
<p>feat: verbosity and debug inputs to enable debug options
(<a
href="https://redirect.github.com/pulumi/actions/pull/1046">#1046</a>)</p>
</li>
<li>
<p>fix: update "user agent" string to pulumi/actions@v6
(<a
href="https://redirect.github.com/pulumi/actions/pull/1367">#1357</a>)</p>
</li>
</ul>
<h2>6.2.0 (2025-03-05)</h2>
<ul>
<li>feat: support continue on error flag (--continue-on-error)
(<a
href="https://redirect.github.com/pulumi/actions/pull/1357">#1357</a>)</li>
</ul>
<h2>6.1.0 (2025-02-27)</h2>
<ul>
<li>feat: Add clickable View Live link to PR comments
(<a
href="https://redirect.github.com/pulumi/actions/pull/1355">#1355</a>)</li>
</ul>
<h2>6.0.1 (2025-01-13)</h2>
<ul>
<li>
<p>fix: Make <code>pulumi login</code> respect configuration in
<code>Pulumi.yaml</code>
(<a
href="https://redirect.github.com/pulumi/actions/pull/1299">#1299</a>)</p>
</li>
<li>
<p>fix: Log stderr from commands</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8582a9e8cc"><code>8582a9e</code></a>
Prepare changelog for 6.6.1 (<a
href="https://redirect.github.com/pulumi/actions/issues/1395">#1395</a>)</li>
<li><a
href="7c2e7ce1cd"><code>7c2e7ce</code></a>
chore(dist): Update dist [automated commit]</li>
<li><a
href="e5bcb14630"><code>e5bcb14</code></a>
upgrade pulumi/pulumi to latest (<a
href="https://redirect.github.com/pulumi/actions/issues/1394">#1394</a>)</li>
<li>See full diff in <a
href="d7ceb0215d...8582a9e8cc">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR splits the workflows for deploying to prod and staging
easing the use of gitops flows for promotions.
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
Radoslav Dimitrov
dependabot[bot]
Tadas Antanavicius