Update Go dependency from 1.24 to 1.25

.github/workflows/publish.yml

@@ -13,10 +13,10 @@ jobs:
       pull-requests: write
     steps:
       - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@8eb7f2efa6ab636da09aef605b497fd5b8a7587d # master
 
       - name: Set up git
-        uses: Homebrew/actions/git-user-config@master
+        uses: Homebrew/actions/git-user-config@8eb7f2efa6ab636da09aef605b497fd5b8a7587d # master
 
       - name: Pull bottles
         env:
@@ -27,7 +27,7 @@ jobs:
         run: brew pr-pull --debug --tap=$GITHUB_REPOSITORY $PULL_REQUEST
 
       - name: Push commits
-        uses: Homebrew/actions/git-try-push@master
+        uses: Homebrew/actions/git-try-push@8eb7f2efa6ab636da09aef605b497fd5b8a7587d # master
         with:
           token: ${{ github.token }}
           branch: main

.github/workflows/tests.yml

@@ -13,11 +13,11 @@ jobs:
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+        uses: Homebrew/actions/setup-homebrew@8eb7f2efa6ab636da09aef605b497fd5b8a7587d # master
 
       - name: Cache Homebrew Bundler RubyGems
         id: cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}
@@ -34,7 +34,7 @@ jobs:
 
       - name: Upload bottles as artifact
         if: always() && github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: bottles
           path: '*.bottle.*'

.github/workflows/update-formula.yml

@@ -28,11 +28,11 @@ jobs:
       shell: bash
 
     - name: Checkout Homebrew repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
     - name: Fetch the latest release from CLI repository
       id: latest-release
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
       with:
         script: |
           const { data } = await github.rest.repos.getLatestRelease({
@@ -58,11 +58,24 @@ jobs:
         SHA256=$(curl -L $TARBALL_URL | sha256sum | awk '{print $1}')
         echo "SHA256=$SHA256" >> $GITHUB_ENV
 
+    - name: Determine required Go version from go.mod
+      run: |
+        GO_MOD_URL="https://raw.githubusercontent.com/DefangLabs/defang/$TAG_NAME/src/go.mod"
+        GO_FULL=$(curl -fsSL "$GO_MOD_URL" | awk '/^go [0-9]/{print $2; exit}')
+        if [ -z "$GO_FULL" ]; then
+          echo "Failed to parse Go version from $GO_MOD_URL" >&2
+          exit 1
+        fi
+        GO_VERSION=$(echo "$GO_FULL" | cut -d. -f1,2)
+        echo "Detected Go version in go.mod: $GO_FULL -> go@$GO_VERSION"
+        echo "GO_VERSION=$GO_VERSION" >> $GITHUB_ENV
+
     - name: Update Homebrew formula
       run: |
         formula_path="Formula/defang.rb"
         sed -i.bak "s|url \".*|url \"$TARBALL_URL\"|g" $formula_path
         sed -i.bak "s|sha256 \".*|sha256 \"$SHA256\"|g" $formula_path
+        sed -i.bak "s|depends_on \"go@[^\"]*\" => :build|depends_on \"go@$GO_VERSION\" => :build|g" $formula_path
 
     - name: Commit and push changes
       run: |
@@ -78,7 +91,7 @@ jobs:
 
     - name: Notify Slack of Action Failures
       if: ${{ failure() && github.ref_name == 'main' }}
-      uses: rtCamp/action-slack-notify@v2
+      uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
       env:
         SLACK_TITLE: Defang Homebrew update workflow failed
         MSG_MINIMAL: actions url

Formula/defang.rb

@@ -6,7 +6,7 @@ class Defang < Formula
   license "MIT"
   head "https://github.com/DefangLabs/defang.git", branch: "main"
 
-  depends_on "go@1.24" => :build
+  depends_on "go@1.25" => :build
 
   def install
     version_info = "-X main.version=#{version}"