ci: harden workflows, upgrade actions, fix caching

Author: paskal

.github/workflows/ci.yml

@@ -6,20 +6,25 @@ on:
     tags:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
+      - name: checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       - name: set up go 1.24
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v6
         with:
           go-version: "1.24"
         id: go
 
-      - name: checkout
-        uses: actions/checkout@v3
-
       - name: build and test
         run: |
           go get -v
@@ -33,16 +38,13 @@ jobs:
         run: go test -timeout=60s -race
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.0.2
-          skip-pkg-cache: true
+          version: "v2.11.1"
 
-      - name: install goveralls
+      - name: submit coverage
         run: |
           go install github.com/mattn/goveralls@latest
-
-      - name: submit coverage
-        run: $(go env GOPATH)/bin/goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
+          goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
         env:
           COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}