From d6cc6afb105dc124599f5975f4d594adf7c688fd Mon Sep 17 00:00:00 2001
From: zzwong <6979793+zzwong@users.noreply.github.com>
Date: Tue, 20 Oct 2026 20:53:44 -0400
Subject: [PATCH] fix: build with Go 1.26.10 for the eMudhra CA distrust

Pin the Go toolchain to 1.26.10, which distrusts the compromised eMudhra intermediate keys (CVE-2026-111943), and read the Go version from go.mod in every setup-go step.
---
 go.mod | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/go.mod b/go.mod
index c497022..f009129 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/open-cli-collective/spotify-cli
 
 go 1.26
 
+toolchain go1.26.10
+
 require (
 	github.com/charmbracelet/huh v0.8.0
 	github.com/open-cli-collective/cli-common v0.4.1