fix(ci): adopt patched release and Go tools

.github/actions/govulncheck/action.yaml

@@ -51,7 +51,7 @@ runs:
         GOBIN: ${{ runner.temp }}/govulncheck-bin
         # The scanner's parser must support the newest Go version we test.
         # Scanning below still uses the caller's setup-go installation.
-        GOTOOLCHAIN: go1.27.1
+        GOTOOLCHAIN: go1.27.2
         GOWORK: 'off'
       run: go install golang.org/x/vuln/cmd/govulncheck@v1.8.0
     - name: Scan and enforce reachable findings

.github/scripts/delete-workflow-runs/go.mod

@@ -1,3 +1,3 @@
 module github.com/devantler-tech/.github/scripts/delete-workflow-runs
 
-go 1.26.8
+go 1.26.9

.github/tests/catalogue-credentials/go.mod

@@ -1,5 +1,5 @@
 module github.com/devantler-tech/.github/catalogue-credentials
 
-go 1.26.6
+go 1.26.9
 
 require go.yaml.in/yaml/v3 v3.0.5

.github/tests/create-release-fixture.sh

@@ -35,7 +35,7 @@ jq '.plugins |= map(select((if type == "array" then .[0] else . end) != "@semant
 run="$(yq -r '.jobs.release.steps[] | select(.name == "🎉 Release") | .run' "$workflow")"
 hooks="\${{ inputs.disable-issue-side-effects && '--success false --fail false' || '' }}"
 dry="\${{ inputs.dry-run && '--dry-run' || '' }}"
-[[ "$run" == "npx semantic-release@25.0.3 $hooks $dry" ]] || {
+[[ "$run" == "npx semantic-release@25.0.9 $hooks $dry" ]] || {
   echo 'FAIL: unsupported shipped release command' >&2
   exit 1
 }

.github/tests/create-release-stable-channel-fixture.sh

@@ -17,7 +17,7 @@ jq '.plugins |= map(select((if type == "array" then .[0] else . end) != "@semant
 run="$(yq -r '.jobs.release.steps[] | select(.name == "🎉 Release") | .run' "$workflow")"
 hooks="\${{ inputs.disable-issue-side-effects && '--success false --fail false' || '' }}"
 dry="\${{ inputs.dry-run && '--dry-run' || '' }}"
-[[ "$run" == "npx semantic-release@25.0.3 $hooks $dry" ]] || fail 'unsupported shipped release command'
+[[ "$run" == "npx semantic-release@25.0.9 $hooks $dry" ]] || fail 'unsupported shipped release command'
 run="${run//"$hooks"/}"
 run="${run//"$dry"/--dry-run}"
 read -r -a command_parts <<< "$run"

.github/tests/go-test-fixture/go.mod

@@ -1,3 +1,3 @@
 module example.com/go-test-fixture
 
-go 1.26
+go 1.26.9

.github/tests/test-create-release-config.sh

@@ -16,7 +16,7 @@ fi
 release_run="$(
   yq -r '.jobs.release.steps[] | select(.name == "🎉 Release") | .run' "$workflow"
 )"
-expected_run="npx semantic-release@25.0.3 \${{ inputs.disable-issue-side-effects && '--success false --fail false' || '' }} \${{ inputs.dry-run && '--dry-run' || '' }}"
+expected_run="npx semantic-release@25.0.9 \${{ inputs.disable-issue-side-effects && '--success false --fail false' || '' }} \${{ inputs.dry-run && '--dry-run' || '' }}"
 if [[ "$release_run" != "$expected_run" ]]; then
   echo "create-release must disable semantic-release success and fail hooks when opted in" >&2
   exit 1

.github/tests/todo-scanner/go.mod

@@ -1,6 +1,6 @@
 module devantler-tech/todo-scanner-fixture
 
-go 1.26.8
+go 1.26.9
 
 require github.com/devantler-tech/dotgithub/scripts/todo-guard v0.0.0
 

.github/workflows/ci.yaml

@@ -4223,7 +4223,7 @@ jobs:
           node-version: 22
 
       - name: 📦 Acquire pinned release dependency for controls
-        run: npx --yes semantic-release@25.0.3 --version
+        run: npx --yes semantic-release@25.0.9 --version
 
       - name: 🧪 Verify release-decision regressions fail
         run: bash .github/tests/test-create-release-fixture-controls.sh
@@ -4578,7 +4578,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go: ['1.25.14', '1.26.8', '1.27.1']
+        go: ['1.25.14', '1.26.9', '1.27.2']
         fixture: [govulncheck-allowlist, govulncheck-generics]
     runs-on: ubuntu-latest
     permissions:
@@ -4625,7 +4625,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go: ['1.25.14', '1.26.8', '1.27.1']
+        go: ['1.25.14', '1.26.9', '1.27.2']
         fixture: [govulncheck-allowlist, govulncheck-generics]
     runs-on: ubuntu-latest
     permissions:

.github/workflows/create-release.yaml

@@ -322,7 +322,7 @@ jobs:
         # nonessential notification hooks so a bare issue reference intended for
         # another repository cannot turn an otherwise-published release red.
         run: >-
-          npx semantic-release@25.0.3
+          npx semantic-release@25.0.9
           ${{ inputs.disable-issue-side-effects && '--success false --fail false' || '' }}
           ${{ inputs.dry-run && '--dry-run' || '' }}
         env:
@@ -384,7 +384,7 @@ jobs:
           }
 
       - name: 📦 Acquire pinned release dependency
-        run: npx --yes semantic-release@25.0.3 --version
+        run: npx --yes semantic-release@25.0.9 --version
 
       - name: 🧪 Evaluate release decisions without credentials
         env:

.scripts/todo-guard/go.mod

@@ -1,3 +1,3 @@
 module github.com/devantler-tech/dotgithub/scripts/todo-guard
 
-go 1.26.8
+go 1.26.9

actions/create-issues-from-todos/action.yaml

@@ -62,7 +62,7 @@ runs:
     - name: Setup TODO supervisor compiler
       uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
-        go-version: 1.26.8
+        go-version: 1.26.9
         cache: false
     - name: 🧰 Preserve retry helper
       shell: bash

actions/validate-naming/go.mod

@@ -1,5 +1,5 @@
 module github.com/devantler-tech/actions/validate-naming
 
-go 1.26.6
+go 1.26.9
 
 require go.yaml.in/yaml/v3 v3.0.5

actions/validate-retired-repo-links/go.mod

@@ -1,3 +1,3 @@
 module github.com/devantler-tech/actions/validate-retired-repo-links
 
-go 1.26.8
+go 1.26.9

actions/validate-shell-pipelines/go.mod

@@ -1,5 +1,5 @@
 module github.com/devantler-tech/actions/validate-shell-pipelines
 
-go 1.26.8
+go 1.26.9
 
 require mvdan.cc/sh/v3 v3.14.1