ci: pin Go to exact 1.26.8 so release builds are reproducible

[GeiserX]

#135 changed go-version from '1.26.5' to '1.26' in both workflows so setup-go tracks the latest 1.26.x and stdlib security releases arrive without a workflow edit. The cost is reproducibility: a release rebuilt later can compile with a different toolchain than the one that shipped.

This pins the exact patch again, in all three places (ci.yml twice, desktop-release.yml once).

Why 1.26.8 and not 1.26.5 or 1.26.6

• Not 1.26.5: that is the toolchain the workflows sat on while go1.26.6 fixed five stdlib advisories our code actually calls (GO-2026-6218, GO-2026-6090, GO-2026-6089, GO-2026-5026, GO-2026-5972). Pinning back to it would ship those again and turn the govulncheck gate red.
• Not 1.26.6: that was the latest 1.26.x on Sep 11, when fix(deps): clear the Docker CVEs no version bump could ever reach #135's control run measured it clean. Two patches have shipped since. Pinning to it would already be stale on day one.
• 1.26.8 is the current stable 1.26.x per go.dev today.

What keeps an exact pin from rotting

The govulncheck hard gate runs on the pinned toolchain. A reachable stdlib advisory fails CI on the next PR, which is the prompt to bump the pin. docs/SECURITY-NOTES.md now describes that policy instead of the floating one, so the doc and the workflows say the same thing.

Scope

Workflow and doc only. No Go code, go.mod or go.sum change, so auto-tag.yml's paths filter will not cut a release from this merge.

Verification

The govulncheck job on this PR is the evidence: it runs against 1.26.8 as a hard gate. Green means 0 reachable vulnerabilities on the exact toolchain that will build releases.

Summary by CodeRabbit

• Security
  • Updated release and continuous integration workflows to use Go 1.26.8 for consistent, reproducible builds and vulnerability checks.
  • Added guidance explaining the pinned toolchain and the process for updating it when security releases or relevant advisories are published.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 07c5bc0e-33bf-40c6-87eb-9ce4203ad979

📥 Commits

Reviewing files that changed from the base of the PR and between 2d661b1 and bfd95d6.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .github/workflows/desktop-release.yml
• docs/SECURITY-NOTES.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

CI and desktop release workflows now pin Go 1.26.8. Security notes explain the manual update requirement and identify all three workflow locations.

Changes

Go toolchain pinning

Layer / File(s)	Summary
Workflow pins and security guidance .github/workflows/ci.yml, .github/workflows/desktop-release.yml, docs/SECURITY-NOTES.md	The test, vulnerability, and desktop release workflows now use Go 1.26.8. The security notes document the three pin locations and the required update process.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to bfd95

The change consistently pins Go 1.26.8 across CI and release workflows without introducing an identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning Go to exact version 1.26.8 to make release builds reproducible.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/pin-go-1.26.8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.56%. Comparing base (2d661b1) to head (bfd95d6).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #139      +/-   ##
==========================================
+ Coverage   78.50%   78.56%   +0.05%     
==========================================
  Files          18       18              
  Lines        3797     3797              
==========================================
+ Hits         2981     2983       +2     
+ Misses        587      586       -1     
+ Partials      229      228       -1     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.