From ec1d4be56e09a11e2210fd6498051e4e4980e97c Mon Sep 17 00:00:00 2001
From: Paulo Canilho <paulo@canilho.net>
Date: Thu, 4 Jun 2026 14:36:57 +0200
Subject: [PATCH] ci: refactor govulncheck; chore: bump go to 1.26.4

---
 .github/workflows/ci.yml | 13 ++++---------
 Makefile                 |  6 +++---
 examples/go.mod          |  2 +-
 go.mod                   |  2 +-
 4 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 368af04..b50d773 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -49,19 +49,14 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          # govulncheck-action runs its own internal actions/checkout@v4.1.1,
-          # which sets an http.extraheader Authorization. Combined with v6's
-          # default credential persistence, git ends up sending two
-          # Authorization headers and GitHub returns 400 ("Duplicate header").
-          persist-credentials: false
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           cache: true
-      - uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1
-        with:
-          go-version-file: go.mod
+      - name: Run govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
 
   test:
     name: Test
diff --git a/Makefile b/Makefile
index 5cba869..0e4b19e 100644
--- a/Makefile
+++ b/Makefile
@@ -39,9 +39,9 @@ lint:
 	golangci-lint run
 
 vuln:
-	# CI pins govulncheck via golang/govulncheck-action (Dependabot-tracked).
-	# This target is a local-dev fallback; it pulls whatever @latest is today.
-	# If you want a deterministic run locally, pin a specific version here.
+	# Mirrors the CI govulncheck job, which runs golang.org/x/vuln @latest
+	# directly. This is the local-dev equivalent; it pulls whatever @latest
+	# is today. Pin a specific version here for a deterministic local run.
 	go run golang.org/x/vuln/cmd/govulncheck@latest ./...
 
 tidy:
diff --git a/examples/go.mod b/examples/go.mod
index cfa4837..3bcabbb 100644
--- a/examples/go.mod
+++ b/examples/go.mod
@@ -1,6 +1,6 @@
 module github.com/pcanilho/go-github-kit/examples
 
-go 1.26.2
+go 1.26.4
 
 require (
 	github.com/bradleyfalzon/ghinstallation/v2 v2.18.0
diff --git a/go.mod b/go.mod
index 3abcd37..5073e31 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/pcanilho/go-github-kit
 
-go 1.26.2
+go 1.26.4
 
 require (
 	github.com/gofri/go-github-ratelimit/v2 v2.0.2