From 14da198a4bc33ac6a4cc5e20f24c8423fc5cd397 Mon Sep 17 00:00:00 2001
From: zzwong <6979793+zzwong@users.noreply.github.com>
Date: Tue, 20 Oct 2026 20:53:35 -0400
Subject: [PATCH] fix: build with Go 1.26.10 for the eMudhra CA distrust

Pin the Go toolchain to 1.26.10, which distrusts the compromised eMudhra intermediate keys (CVE-2026-111943), and read the Go version from go.mod in every setup-go step.
---
 .github/workflows/release-build-check.yml | 2 +-
 .github/workflows/test-chocolatey.yml     | 2 +-
 go.mod                                    | 2 ++
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-build-check.yml b/.github/workflows/release-build-check.yml
index 957ca3d..a6f5ac0 100644
--- a/.github/workflows/release-build-check.yml
+++ b/.github/workflows/release-build-check.yml
@@ -35,7 +35,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.26"
+          go-version-file: go.mod
 
       - name: Install GoReleaser
         uses: goreleaser/goreleaser-action@v6
diff --git a/.github/workflows/test-chocolatey.yml b/.github/workflows/test-chocolatey.yml
index b63647f..a783afd 100644
--- a/.github/workflows/test-chocolatey.yml
+++ b/.github/workflows/test-chocolatey.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26'
+          go-version-file: go.mod
 
       - name: Build binary for testing
         run: go build -o packaging/chocolatey/tools/nrq.exe ./cmd/nrq
diff --git a/go.mod b/go.mod
index 36f73d9..24e09fa 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/open-cli-collective/newrelic-cli
 
 go 1.26
 
+toolchain go1.26.10
+
 require (
 	github.com/byteness/keyring v1.11.0
 	github.com/fatih/color v1.18.0