ci: track the go toolchain from go.mod

.execs/tools.flow

@@ -25,11 +25,6 @@ executables:
               echo "goreleaser is not installed. Installing..."
               go install github.com/goreleaser/goreleaser/v2@v2.12.5
             fi
-        - cmd: |
-            if ! command -v golangci-lint &> /dev/null; then
-              echo "golangci-lint is not installed. Installing..."
-              curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s v2.5.0
-            fi
         - cmd: |
             if ! command -v ginkgo &> /dev/null; then
               echo "ginkgo is not installed. Installing..."

.execs/validate.flow

@@ -62,17 +62,20 @@ executables:
         - cmd: go fmt ./...
         - cmd: go mod tidy
         - cmd: |
-            if ! command -v golangci-lint &> /dev/null; then
-              echo "Installing golangci-lint..."
-              curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s v2.5.0
-              export PATH="$PATH:./bin"
-            fi
+            set -euo pipefail
+
+            # go run builds the linter with this repo's toolchain, so its language version always
+            # matches the go directive in go.mod. A prebuilt release binary carries whatever Go
+            # upstream built it with, and golangci-lint refuses to run once that trails the
+            # directive. This also pins one version for CI and local runs alike, rather than
+            # deferring to whatever happens to be on PATH.
+            lint="go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0"
 
-            if [ "$CI" = "true" ]; then
+            if [ "${CI:-}" = "true" ]; then
               echo "Running golangci-lint with sarif output..."
-              golangci-lint run ./... --fix --output.sarif.path lint.sarif --output.text.path stdout
+              $lint run ./... --fix --output.sarif.path lint.sarif --output.text.path stdout
             else
-              golangci-lint run ./... --fix
+              $lint run ./... --fix
             fi
 
   - verb: scan
@@ -82,12 +85,16 @@ executables:
     exec:
       dir: //
       cmd: |
+        # Without this, a failed install leaves the scan to run a missing binary and the step
+        # still "succeeds" — CI then fails two steps later on an empty SARIF file.
+        set -euo pipefail
+
         if ! command -v govulncheck &> /dev/null; then
           echo "Installing govulncheck..."
           go install golang.org/x/vuln/cmd/govulncheck@latest
         fi
 
-        if [ "$CI" = "true" ]; then
+        if [ "${CI:-}" = "true" ]; then
           govulncheck -format sarif ./... > govuln.sarif
           echo "Security scan completed. Results saved to govuln.sarif"
         else

.github/workflows/ci.yaml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       # Build the flow under review and run every task with it, so CI exercises
       # the code as it would land on main rather than the released CLI.
       - name: Build flow
@@ -47,7 +47,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
@@ -78,7 +78,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
@@ -134,7 +134,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       - name: Install mockgen
         run: go install go.uber.org/mock/mockgen@v0.4.0
       # Build the flow under review and run every task with it, so CI exercises
@@ -167,7 +167,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       # Build the flow under review and run every task with it, so CI exercises
       # the code as it would land on main rather than the released CLI. The
       # bootstrap binary lives in ./bin; `build binary` writes its own to .bin.
@@ -200,7 +200,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
@@ -222,7 +222,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       # Build the flow under review and run every task with it, so CI exercises
       # the code as it would land on main rather than the released CLI.
       - name: Build flow

.github/workflows/codeql.yaml

@@ -22,7 +22,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4.37.4
         with:

.github/workflows/release.yaml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx

.github/workflows/windows-ci.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
           cache: true
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -62,7 +62,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
           cache: true
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -103,7 +103,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
           cache: true
       - name: Build flow binary
         uses: flowexec/action@v1
@@ -127,7 +127,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
           cache: true
       - name: Download built binary
         uses: actions/download-artifact@v8
@@ -159,7 +159,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: "1.25.x"
+          go-version-file: go.mod
           cache: true
       - name: Set up Python
         uses: actions/setup-python@v7

go.mod

@@ -1,6 +1,6 @@
 module github.com/flowexec/flow/v2
 
-go 1.25.8
+go 1.26.0
 
 require (
 	charm.land/bubbletea/v2 v2.0.9