From 3c5ec3ab692f9f846ddb397dda7e486637ef16ea Mon Sep 17 00:00:00 2001
From: Riyad Khan <rr3khan@uwaterloo.ca>
Date: Wed, 21 Oct 2026 16:06:55 -0400
Subject: [PATCH] ci: use patched Go toolchain for eMudhra CA compromise

The eMudhra intermediate CA keys disclosed on 2026-10-20 are only
handled in Go 1.26.10 and 1.27.3; there is no backport to 1.24 or 1.25.
- go.mod: add `toolchain go1.26.10`. The `go 1.24` minimum is
  unchanged, so consumers aren't forced to upgrade.
- CI: both jobs now read the Go version from go.mod
  (go-version-file), so the toolchain line is the single place
  to bump. Previously Test used ^1.18 (whatever Go was cached
  on the runner) and Lint was pinned to 1.24.
---
 .github/workflows/test.yaml | 4 ++--
 go.mod                      | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 6541316e..11f3e495 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -29,7 +29,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: ^1.18
+          go-version-file: go.mod
 
       - name: Test
         run: make test
@@ -54,7 +54,7 @@ jobs:
       - name: "Set up Go 1.x"
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.24
+          go-version-file: go.mod
 
       - name: Lint with golangci-lint
         uses: step-security/golangci-lint-action@2697867e9c204558ca23d0decdd0039dc21f2b93 # v9.3.0
diff --git a/go.mod b/go.mod
index b0dd61c5..c9f90554 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/1Password/shell-plugins
 
 go 1.24
 
+toolchain go1.26.10
+
 require (
 	github.com/99designs/aws-vault/v7 v7.0.0-rc2
 	github.com/99designs/keyring v1.2.2