ci: refactor govulncheck; chore: bump go to 1.26.4

.github/workflows/ci.yml

@@ -49,19 +49,14 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          # govulncheck-action runs its own internal actions/checkout@v4.1.1,
-          # which sets an http.extraheader Authorization. Combined with v6's
-          # default credential persistence, git ends up sending two
-          # Authorization headers and GitHub returns 400 ("Duplicate header").
-          persist-credentials: false
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: go.mod
           cache: true
-      - uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1
-        with:
-          go-version-file: go.mod
+      - name: Run govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
 
   test:
     name: Test

Makefile

@@ -39,9 +39,9 @@ lint:
 	golangci-lint run
 
 vuln:
-	# CI pins govulncheck via golang/govulncheck-action (Dependabot-tracked).
-	# This target is a local-dev fallback; it pulls whatever @latest is today.
-	# If you want a deterministic run locally, pin a specific version here.
+	# Mirrors the CI govulncheck job, which runs golang.org/x/vuln @latest
+	# directly. This is the local-dev equivalent; it pulls whatever @latest
+	# is today. Pin a specific version here for a deterministic local run.
 	go run golang.org/x/vuln/cmd/govulncheck@latest ./...
 
 tidy:

examples/go.mod

@@ -1,6 +1,6 @@
 module github.com/pcanilho/go-github-kit/examples
 
-go 1.26.2
+go 1.26.4
 
 require (
 	github.com/bradleyfalzon/ghinstallation/v2 v2.18.0

go.mod

@@ -1,6 +1,6 @@
 module github.com/pcanilho/go-github-kit
 
-go 1.26.2
+go 1.26.4
 
 require (
 	github.com/gofri/go-github-ratelimit/v2 v2.0.2