From f37540262d5f699e5b0b97dcbf1c670abb703ce0 Mon Sep 17 00:00:00 2001
From: zzwong <6979793+zzwong@users.noreply.github.com>
Date: Tue, 20 Oct 2026 20:53:42 -0400
Subject: [PATCH] fix: build with Go 1.26.10 for the eMudhra CA distrust

Pin the Go toolchain to 1.26.10, which distrusts the compromised eMudhra intermediate keys (CVE-2026-111943), and read the Go version from go.mod in every setup-go step.
---
 .github/workflows/test-chocolatey.yml | 2 +-
 go.mod                                | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-chocolatey.yml b/.github/workflows/test-chocolatey.yml
index 2dacf7f..000b786 100644
--- a/.github/workflows/test-chocolatey.yml
+++ b/.github/workflows/test-chocolatey.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26'
+          go-version-file: go.mod
 
       - name: Build binary for testing
         run: go build -o packaging/chocolatey/tools/slck.exe ./cmd/slck
diff --git a/go.mod b/go.mod
index eca87c0..6f95f96 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/open-cli-collective/slack-chat-api
 
 go 1.26
 
+toolchain go1.26.10
+
 require (
 	github.com/byteness/keyring v1.11.0
 	github.com/open-cli-collective/cli-common v0.4.1