fix: align CLI build workflows with Go 1.26.5 toolchain

[plural-copilot]

Summary

• update the remaining GitHub Actions CLI build workflows to use actions/setup-go@v5
• keep all workflow Go resolution pointed at go.mod, which already requires Go 1.26.5
• cover the release path used to publish CLI artifacts via GoReleaser

Why

The embedded plural CLI binary used by ghcr.io/pluralsh/console is the source of the reported Go stdlib findings. This repository already pins the CLI toolchain and builder images to Go 1.26.5, but a few workflow declarations still referenced an older setup-go action version. This keeps the release and CI build paths consistently aligned on the Go version declared in go.mod.

Plural Service: mgmt/console

Files changed

• .github/workflows/goreleaser-cd.yml
• .github/workflows/codeql.yml
• .github/workflows/e2e.yaml

Validation

• audited all discovered Go toolchain and builder pins across repo build/release paths
• confirmed no remaining 1.26.4 or actions/setup-go@v4.1.0 references
• verified containerized go1.26.5 availability and a local CLI build path

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create the minimal PR needed to remediate fixable Go stdlib vulnerabilities in the embedded plural CLI binary used by the ghcr.io/pluralsh/console image....
🔗 Run history	View run history

[greptile-apps]

Greptile Summary

This PR upgrades actions/setup-go from @v4.1.0 to @v5 across all three remaining workflow files that still referenced the older action version, bringing them in line with the rest of the repository's CI workflows. All jobs continue to resolve the Go toolchain from go-version-file: go.mod, which already declares go 1.26.5.

• codeql.yml: One setup-go reference updated.
• e2e.yaml: Three setup-go references updated across three separate jobs.
• goreleaser-cd.yml: One setup-go reference updated in the release/publish job.

Confidence Score: 5/5

Straightforward action version bump with no functional logic changes; safe to merge.

The change is purely a version pin update for actions/setup-go across three workflow files. The v4→v5 upgrade is backward-compatible (the only runtime difference is Node 16→20 inside the action runner), and go-version-file: go.mod continues to drive Go toolchain resolution in every job. A scan of all workflow files confirms no remaining @v4.1.0 references, so the repository is now fully consistent.

No files require special attention — all changes are identical one-line action version bumps.

Important Files Changed

Filename	Overview
.github/workflows/codeql.yml	Updates actions/setup-go@v4.1.0 to @v5; Go version continues to resolve from go.mod.
.github/workflows/e2e.yaml	Updates three actions/setup-go@v4.1.0 references to @v5 across three jobs; all continue using go-version-file: go.mod.
.github/workflows/goreleaser-cd.yml	Updates actions/setup-go@v4.1.0 to @v5 in the GoReleaser release job; Go version still resolved from go.mod.

_{Reviews (1): Last reviewed commit: "fix: use setup-go v5 for CLI build workf..." | Re-trigger Greptile}