chore: auto-bump golang patch versions

[chen-keinan]

Description

The following change will help to solve an issue of auto-bump golang patch versions.

Current behaviour

up to now that auto-bump golang patch versions was using the:

- uses: actions/setup-go@v5
    with:
      go-version-file: 'go.mod'

This setting assumes that the go.mod file of Trivy is configured with a partial Go version <major>.<minor> for instance, go 1.22.

The Problem

It has been observed that if a go.mod file includes a dependency like github.com/aquasecurity/trivy-kubernetes, and that dependency's go.mod file specifies a full Go version <major>.<minor>.<patch> such as go 1.22.0, then the Go version of this dependency will replace the Go version specified in trivy go.mod file.

therefore the above actions/setup-go cannot be used with go-version-file: 'go.mod' param.

Workaround

The workaround will be to use the following go-version param with partial version, which will auto bump patch version without relating to go mod file.

- uses: actions/setup-go@v5
    with:
      go-version: '1.22'

[knqyf263]

@aquasecurity/trivy FYI

Let me add something here. According to the document in actions/setup-go, it uses the specific patch version if it is specified in go.mod. That's why I suggested using go 1.22 here rather than go 1.22.0.

The go directive in go.mod can specify a patch version or omit it altogether (e.g., go 1.22.0 or go 1.22).
If a patch version is specified, that specific patch version will be used.
If no patch version is specified, it will search for the latest available patch version in the cache, versions-manifest.json, and the official Go language website, in that order.

https://github.com/actions/setup-go?tab=readme-ov-file#getting-go-version-from-the-gomod-file

We confirmed v1.22.0 was used in this workflow.
https://github.com/aquasecurity/trivy/actions/runs/9108238744/job/25038616208?pr=6707

It will miss patches in v1.22.x and be problematic in terms of security. However, it is impossible to ask all dependent modules not to use 1.22.0. We need this workaround for now.

[chen-keinan]

@knqyf263 comments has been addressed