chore: align CLI CI with patched Go 1.26.5 toolchain

[plural-copilot]

Summary

• align remaining GitHub Actions Go setup steps with the repo's patched Go 1.26.5 toolchain
• keep the remediation limited to toolchain/build pinning for the embedded CLI built from this repo
• ensure CI/release paths consistently use the fixed toolchain when building and testing the CLI

Why

This repo is the source of the embedded CLI in ghcr.io/pluralsh/console, so Go stdlib vulnerabilities reported against the console image map back to builds from pluralsh/plural-cli.

This remediates the Go stdlib CVEs affecting Plural Service: mgmt/console:

• CVE-2026-42505 (crypto/tls)
• CVE-2026-39822 (os.Root)

The vulnerable environment was reported on Go 1.26.4; this repo already pins Go 1.26.5 in go.mod and Docker-based build paths, and this PR updates the remaining workflow action pins so CI/release jobs also resolve that fixed toolchain consistently.

Files changed

• .github/workflows/codeql.yml
• .github/workflows/e2e.yaml
• .github/workflows/goreleaser-cd.yml

Verification

• confirmed active Go version pins in go.mod, Dockerfile, test.Dockerfile, and helper scripts are 1.26.5
• attempted Dockerized test.Dockerfile/make test verification; the build did not complete within the available execution window in the agent environment

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Open a remediation PR in this repository to address Go stdlib CVEs affecting the ghcr.io/pluralsh/console image for Plural Service: mgmt/console....
🔗 Run history	View run history

[greptile-apps]

Greptile Summary

This PR upgrades actions/setup-go from v4.1.0 to v5 in the three remaining workflow files (codeql.yml, e2e.yaml, goreleaser-cd.yml) that hadn't yet been updated, bringing them in line with ci.yaml and edge.yaml which were already on v5.

• The changes are mechanically correct; Go 1.26.5 is resolved from go.mod via go-version-file in all affected jobs, independent of the action version.
• The step to v5 adds improved module-cache handling and better future support for the toolchain directive, but the actual Go SDK version installed was already 1.26.5 before this PR — the CVE remediation was already in place via go.mod.
• All five workflow files now consistently use actions/setup-go@v5, which is a welcome maintenance improvement.

Confidence Score: 5/5

Safe to merge — three workflow files get a straightforward action version bump with no behavioural risk.

The three changed files each swap a single action pin (v4.1.0 → v5) and are otherwise untouched. The Go toolchain version is determined by go.mod via go-version-file, so CI behaviour is unchanged. The update brings consistency with the rest of the workflow suite and picks up v5's improved caching defaults.

No files require special attention; the change is limited to action version tags in CI workflow files.

Important Files Changed

Filename	Overview
.github/workflows/codeql.yml	Upgrades actions/setup-go from v4.1.0 to v5; Go version still resolved from go.mod via go-version-file. No logic change.
.github/workflows/e2e.yaml	Upgrades actions/setup-go from v4.1.0 to v5 in all three e2e job steps; consistent with other workflows now.
.github/workflows/goreleaser-cd.yml	Upgrades actions/setup-go from v4.1.0 to v5 in the release job; Go version remains controlled by go.mod.

_{Reviews (1): Last reviewed commit: "chore: align Go setup actions with patch..." | Re-trigger Greptile}

[greptile-apps]

Action version doesn't drive toolchain selection here

The PR description frames this upgrade as CVE remediation, but actions/setup-go@v4.1.0 with go-version-file: go.mod already resolved and installed Go 1.26.5 (the version declared in go.mod). The action version (v4 vs v5) controls the action's own behaviour (caching defaults, toolchain directive support, etc.), not which Go SDK is downloaded — the go-version-file directive does that. Aligning to v5 is still a good maintenance step (consistent with ci.yaml and edge.yaml, and v5 adds improved module-cache handling), but it doesn't independently address the cited CVEs; those are already remediated by the go 1.26.5 pin in go.mod that was in place before this PR.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!