From f438d879ed7012ec81692b7ed0287c9a21062408 Mon Sep 17 00:00:00 2001
From: zzwong <6979793+zzwong@users.noreply.github.com>
Date: Tue, 20 Oct 2026 20:53:25 -0400
Subject: [PATCH] fix: build with Go 1.26.10 for the eMudhra CA distrust

Pin the Go toolchain to 1.26.10, which distrusts the compromised eMudhra intermediate keys (CVE-2026-111943), and read the Go version from go.mod in every setup-go step.
---
 .github/workflows/ci.yml | 18 +++++++++---------
 go.work                  |  2 ++
 shared/go.mod            |  2 ++
 tools/cfl/go.mod         |  2 ++
 tools/jtk/go.mod         |  2 ++
 5 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 519de37e..955f9193 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26'
+          go-version-file: go.work
       - name: Tidy cfl
         run: cd tools/cfl && go mod tidy && git diff --exit-code go.mod go.sum
       - name: Build cfl
@@ -80,7 +80,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26'
+          go-version-file: go.work
       - name: Tidy jtk
         run: cd tools/jtk && go mod tidy && git diff --exit-code go.mod go.sum
       - name: Build jtk
@@ -114,11 +114,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26'
+          go-version-file: go.work
       - uses: golangci/golangci-lint-action@v7
         with:
           working-directory: tools/cfl
-          version: v2.12.2
+          version: v2.15.0
 
   lint-jtk-run:
     needs: detect-changes
@@ -128,11 +128,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26'
+          go-version-file: go.work
       - uses: golangci/golangci-lint-action@v7
         with:
           working-directory: tools/jtk
-          version: v2.12.2
+          version: v2.15.0
 
   build-test-shared:
     needs: detect-changes
@@ -142,7 +142,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26'
+          go-version-file: go.work
       - name: Tidy shared
         run: cd shared && go mod tidy && git diff --exit-code go.mod go.sum
       - name: Build shared
@@ -170,11 +170,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.26'
+          go-version-file: go.work
       - uses: golangci/golangci-lint-action@v7
         with:
           working-directory: shared
-          version: v2.12.2
+          version: v2.15.0
 
   # Per-tool identity drift guard (distribution.md §8.2): assert each tool's
   # packaging/identity.yml matches its tool-native files. working-directory is
diff --git a/go.work b/go.work
index 6c01ed3d..f1b9dfc5 100644
--- a/go.work
+++ b/go.work
@@ -1,5 +1,7 @@
 go 1.26
 
+toolchain go1.26.10
+
 use (
 	./shared
 	./tools/cfl
diff --git a/shared/go.mod b/shared/go.mod
index 3d030791..885effe3 100644
--- a/shared/go.mod
+++ b/shared/go.mod
@@ -2,6 +2,8 @@ module github.com/open-cli-collective/atlassian-go
 
 go 1.26
 
+toolchain go1.26.10
+
 require (
 	github.com/byteness/keyring v1.11.0
 	github.com/fatih/color v1.18.0
diff --git a/tools/cfl/go.mod b/tools/cfl/go.mod
index ec4d707e..e811b414 100644
--- a/tools/cfl/go.mod
+++ b/tools/cfl/go.mod
@@ -2,6 +2,8 @@ module github.com/open-cli-collective/confluence-cli
 
 go 1.26
 
+toolchain go1.26.10
+
 require (
 	github.com/JohannesKaufmann/html-to-markdown/v2 v2.5.0
 	github.com/charmbracelet/huh v0.8.0
diff --git a/tools/jtk/go.mod b/tools/jtk/go.mod
index 01f717b6..3dbc366e 100644
--- a/tools/jtk/go.mod
+++ b/tools/jtk/go.mod
@@ -2,6 +2,8 @@ module github.com/open-cli-collective/jira-ticket-cli
 
 go 1.26
 
+toolchain go1.26.10
+
 require (
 	github.com/charmbracelet/huh v0.8.0
 	github.com/open-cli-collective/atlassian-go v0.0.0-00010101000000-000000000000