ci: pin Go toolchain to 1.25.13

setup-go resolved `1.25.x` to go1.25.12 from the actions manifest, whose
standard library carries GO-2026-6218, GO-2026-6090, GO-2026-5972 and
GO-2026-5026. govulncheck reached all four through internal/client and
main, failing the v0.1.0 release run.

All four are fixed in go1.25.13. Pin the exact patch in every workflow,
matching how the repository already pins actions, Terraform, GoReleaser
and the scanners, and raise the go.mod minimum so local builds cannot
silently link the vulnerable standard library either.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DpUsd73mXSq8bGp6zDLGhX

Author: zibuyu1995

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.x
+          go-version: 1.25.13
           cache-dependency-path: go.sum
       - name: Initialize CodeQL
         uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.x
+          go-version: 1.25.13
           cache-dependency-path: go.sum
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
@@ -79,7 +79,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.x
+          go-version: 1.25.13
           cache-dependency-path: go.sum
       - name: Import GPG key
         id: import_gpg

.github/workflows/security.yml

@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.x
+          go-version: 1.25.13
           cache-dependency-path: go.sum
       - name: Scan dependencies for known Go vulnerabilities
         run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...

.github/workflows/terraform_provider.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.x
+          go-version: 1.25.13
           cache-dependency-path: go.sum
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
@@ -73,7 +73,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.25.x
+          go-version: 1.25.13
           cache-dependency-path: go.sum
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:

go.mod

@@ -1,6 +1,6 @@
 module github.com/emqx/terraform-provider-emqxcloud
 
-go 1.25.8
+go 1.25.13
 
 require (
 	github.com/hashicorp/terraform-plugin-framework v1.19.0