chore: pin the build toolchain in go.mod

`setup-go` took its version spec from the `go` directive, and `go 1.26` is a
range, so every job took go1.26.0 out of the runner image while go1.26.5 was
current. The `toolchain` directive names the exact build version, the `go` line
becomes an explicit minimum, and `check-latest` keeps the action from settling
for an older patch.

`go mod tidy` deletes the directive once the `go` line reaches the same
version, so `make tidy` writes it back.

The renovate config drops two presets that the shared default already carries,
`go-deps` fast-tracked the toolchain bump that the weekly group covers too.

Refs: https://github.com/golang/go/issues/75331
Assisted-by: Claude Code:claude-opus-5

.gitea/workflows/release-nightly.yml

@@ -27,6 +27,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: "go.mod"
+          check-latest: true
       - name: import gpg
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7

.gitea/workflows/release-tag.yml

@@ -28,6 +28,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: import gpg
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7

.gitea/workflows/test-pr.yml

@@ -20,6 +20,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: lint and build
         run: |
           make clean
@@ -45,6 +46,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - name: wait for the gitea instance to be ready
         run: |
           for i in $(seq 1 30); do

Makefile

@@ -118,7 +118,12 @@ unit-test-coverage:
 
 .PHONY: tidy
 tidy:
+	$(eval GO_TOOLCHAIN := $(shell grep -Eo '^toolchain\s+go[0-9.]+' go.mod | cut -d' ' -f2))
 	$(GO) mod tidy
+	@# workaround https://github.com/golang/go/issues/75331: restore toolchain if tidy dropped it
+	@if [ -n "$(GO_TOOLCHAIN)" ] && ! grep -qE '^toolchain\s' go.mod; then \
+		$(GO) mod edit -toolchain=$(GO_TOOLCHAIN); \
+	fi
 
 .PHONY: check
 check: test

go.mod

@@ -1,6 +1,8 @@
 module gitea.dev/tea
 
-go 1.26
+go 1.26.0
+
+toolchain go1.26.5
 
 require (
 	charm.land/glamour/v2 v2.0.1

renovate.json5

@@ -1,8 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>gitea/renovate-config",
-    "local>gitea/renovate-config:security",
-    "local>gitea/renovate-config:go-deps"
+    "local>gitea/renovate-config"
   ]
 }