ci(deps): bump workflows to v1.9.2

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 # Shared go-service CI from compliance-framework/workflows, pinned to a release commit that
 # ccf-bump moves. The status checks to require are `ci / required` and
-# `release-checks / release-checks` (skipped, so passing, on non-release PRs).
+# `release-checks / release-checks` (skipped, so passing, on non-release PRs). The image check
+# (fixable HIGH or CRITICAL vulnerabilities in the built image) runs outside them and gates nothing.
 name: ci
 
 on:
@@ -14,7 +15,7 @@ permissions: {}
 
 jobs:
   ci:
-    uses: compliance-framework/workflows/.github/workflows/ci-go-service.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/ci-go-service.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     with:
       # Regenerate the Swagger docs (docs/) from the handler annotations before vet, the tests
       # and the make targets, as the old CI did before its tests.
@@ -32,14 +33,14 @@ jobs:
     secrets: inherit
 
   release-checks:
-    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     permissions:
       contents: read
 
   notify:
     needs: [ci, release-checks]
     if: always()
-    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     with:
       needs: ${{ toJSON(needs) }}
     permissions:

.github/workflows/cut-prerelease.yml

@@ -7,7 +7,7 @@ permissions:
   contents: read
 jobs:
   cut:
-    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     permissions:
       contents: read
     secrets: inherit

.github/workflows/preview.yml

@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   preview:
-    uses: compliance-framework/workflows/.github/workflows/preview.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/preview.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     with:
       kind: image
       on-main: true

.github/workflows/release-please.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   release-please:
-    uses: compliance-framework/workflows/.github/workflows/release-please.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/release-please.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     permissions:
       contents: read
     secrets: inherit

.github/workflows/release.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   release:
-    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@e85d35af2af2ddfcd4b92061d2063e665c1831f6 # v1.7.0
+    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@dc7434879fbd0db1d1df9f590ed8bc13789bd320 # v1.9.2
     with:
       images: '[{"name":"api","dockerfile":"Dockerfile","context":"."}]'
     permissions:

AGENTS.md

@@ -31,7 +31,7 @@ Run these before calling a change done. They are what CI runs (`.github/workflow
 
 ```sh
 make swag                 # regenerate docs/ from handler annotations; commit any diff
-make lint                 # golangci-lint v2.11.4 (make lint.install), default linters
+make lint                 # golangci-lint v2.15.0 (make lint.install), default linters
 make test                 # unit tests only: files with the integration tag are not compiled
 make test-integration-single TEST_PATH=./internal/api/handler/... TEST_NAME=TestArtifactApi
 make test-integration     # everything; slow

Makefile

@@ -133,7 +133,7 @@ lint.check: ## Check install of golanci-lint
 .PHONY: lint.install
 lint.install: ## Install golangci-lint to the go bin dir
 		@$(INFO) "Installing golangci-lint"; \
-		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/main/install.sh | sh -s -- -b $(GOBIN) v2.11.4
+		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/main/install.sh | sh -s -- -b $(GOBIN) v2.15.0
 
 .PHONY: lint
 lint: lint.check ## Run golangci-lint