Fix Go version inconsistency: make go.mod authoritative

.github/workflows/label-check.yml

@@ -0,0 +1,19 @@
+name: Label Check
+on:
+  pull_request:
+    types: [opened, reopened, labeled, unlabeled, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  verify-labels:
+    name: verify labels
+    runs-on: ubuntu-latest
+    steps:
+      - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          disable-reviews: true
+          valid-labels: 'bug, feature, security, maintenance, documentation, dependencies'

.github/workflows/lint.yml

@@ -1,7 +1,7 @@
 name: fast lint checks
 on:
     pull_request:
-        types: [opened, reopened, labeled, unlabeled, synchronize]
+        types: [opened, reopened, synchronize]
 
 permissions:
   contents: read
@@ -35,12 +35,3 @@ jobs:
           reporter: github-pr-review
           github_token: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
           golangci_lint_flags: "--config=.golangci.yml"
-  verify-labels:
-    name: verify labels
-    runs-on: ubuntu-latest
-    steps:
-      - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
-        with:
-            github-token: '${{ secrets.GITHUB_TOKEN }}'
-            disable-reviews: true
-            valid-labels: 'bug, feature, security, maintenance, documentation, dependencies'

.github/workflows/release-publisher.yml

@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@master
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.25.6
+          go-version-file: 'go.mod'
       - name: Install bazelisk
         run: |
           sudo wget -O /usr/local/bin/bazel https://github.com/bazelbuild/bazelisk/releases/download/v1.3.0/bazelisk-linux-amd64

CLAUDE.md

@@ -2,5 +2,5 @@
 
 ## Pull Requests
 
-When creating pull requests, always add appropriate labels to help categorize and track the changes.
+When creating pull requests, always add exactly one of the required labels: `bug`, `feature`, `security`, `maintenance`, `documentation`, `dependencies`. The CI label check will fail without one.
 - when creating a PR, ask if it should be set to auto-merge.

WORKSPACE

@@ -6,7 +6,8 @@ workspace(
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-# Keep the version of rules_go in sync with go.mod
+load("//:go_version.bzl", "go_version")
+
 http_archive(
     name = "io_bazel_rules_go",
     sha256 = "0936c9bc3c4321ee372cb8f66dd972d368cb940ed01a9ba9fd7debcf0093f09b",
@@ -20,7 +21,11 @@ load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_depe
 
 go_rules_dependencies()
 
-go_register_toolchains(version = "1.22.8")
+go_version(name = "go_version_info")
+
+load("@go_version_info//:def.bzl", "GO_VERSION")
+
+go_register_toolchains(version = GO_VERSION)
 
 http_archive(
     name = "bazel_gazelle",

go.mod

@@ -1,6 +1,6 @@
 module github.com/kindlyops/vbs
 
-go 1.21
+go 1.22.8
 
 require (
 	github.com/aws/aws-sdk-go v1.55.8

go_version.bzl

@@ -0,0 +1,35 @@
+"""Repository rule to read the Go version from go.mod."""
+
+def _go_version_impl(repository_ctx):
+    go_mod_content = repository_ctx.read(repository_ctx.attr.go_mod)
+    go_version = ""
+    for line in go_mod_content.split("\n"):
+        line = line.strip()
+        if line.startswith("go "):
+            parts = line.split(" ")
+            if len(parts) >= 2:
+                go_version = parts[1]
+                break
+
+    if not go_version:
+        fail("Could not find 'go' directive in go.mod")
+
+    # go_register_toolchains requires a full major.minor.patch version
+    if go_version.count(".") < 2:
+        fail("go.mod version '{}' must include a patch version (e.g. 1.21.13) for Bazel toolchain registration".format(go_version))
+
+    repository_ctx.file("BUILD.bazel", "")
+    repository_ctx.file(
+        "def.bzl",
+        'GO_VERSION = "{}"\n'.format(go_version),
+    )
+
+go_version = repository_rule(
+    implementation = _go_version_impl,
+    attrs = {
+        "go_mod": attr.label(
+            default = "//:go.mod",
+            allow_single_file = True,
+        ),
+    },
+)