ci(govulncheck): set GOTOOLCHAIN=auto for the vuln scan (#5)

- setup-go v6 defaults GOTOOLCHAIN to "local", which blocks installing
  govulncheck@latest (needs go >= 1.25) against the go1.24.6 toolchain
- pinning GOTOOLCHAIN=auto restores the pre-v6 behavior so the tool
  install can pull the newer toolchain it requires

#ci #govulncheck

Author: htcom-code

.github/workflows/ci.yml

@@ -76,6 +76,11 @@ jobs:
           go-version-file: go.mod
           cache: true
       - name: govulncheck
+        env:
+          # govulncheck@latest requires a newer Go than go.mod pins; allow the
+          # toolchain to auto-upgrade for the tool install. setup-go v6 defaults
+          # GOTOOLCHAIN to "local", which otherwise blocks this.
+          GOTOOLCHAIN: auto
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...