build(deps): bump cboone/gh-actions/.github/workflows/go-release.yml from 1 to 2

[dependabot]

Bumps cboone/gh-actions/.github/workflows/go-release.yml from 1 to 2.

Changelog

Sourced from cboone/gh-actions/.github/workflows/go-release.yml's changelog.

[2.0.0] - 2026-03-09

Changed

• go-ci.yml now requires consuming repos to have a Makefile with targets: vet, test, and optionally lint, build, fmt (matching enabled jobs)
• go-ci.yml test job runs make vet and make test instead of direct Go commands
• go-ci.yml lint job runs make lint instead of golangci-lint run ./...
• go-ci.yml build job runs make build instead of go build
• go-ci.yml format-check job runs make fmt instead of inline gofmt/goimports
• go-ci.yml test-flags input now only applies when coverage is enabled
• Updated actions/setup-go from v5 to v6 across go-ci.yml and go-release.yml

Removed

• go-ci.yml use-makefile input (Makefile is now the only execution mode)
• go-ci.yml build-flags input (build flags belong in each repo's Makefile)

[1.0.0] - 2026-03-08

Added

• Composite action setup-golangci-lint to install golangci-lint with a pinned version
• Composite action setup-goreleaser to install GoReleaser with a pinned version
• Composite action setup-scrut to install scrut CLI testing tool with a pinned version
• Composite action setup-actionlint to install actionlint with a pinned version
• Composite action setup-shfmt to install shfmt with a pinned version
• Composite action run-gitleaks to install and run gitleaks secret scanner
• Composite action run-trufflehog to install and run trufflehog secret scanner
• Reusable workflow go-ci.yml for Go testing, linting, building, scrut tests, and format checking
• Reusable workflow go-release.yml for GoReleaser-based releases
• Reusable workflow secret-scan.yml for gitleaks and/or trufflehog scanning
• Reusable workflow text-lint.yml for markdownlint, Prettier, cspell, and yamllint
• Reusable workflow shell-lint.yml for ShellCheck and shfmt
• Reusable workflow github-lint.yml for actionlint
• Reusable workflow pages-deploy.yml for GitHub Pages build and deploy
• Reusable workflow npm-publish.yml for npm package publishing
• SHA-256 checksum verification for all tool downloads (except scrut, which lacks upstream checksums)
• Cross-platform support for Linux and macOS runners
• Codecov coverage upload support in go-ci workflow
• gofmt and goimports format checking in go-ci workflow
• Scrut inputs for custom build commands (scrut-build-cmd), environment variables (scrut-env), test directories (scrut-test-dir), and setup commands (scrut-setup-cmd)
• Self-hosting workflows (ci.yml, gitleaks.yml, trufflehog.yml) as integration tests
• Linter and formatter configuration (markdownlint, Prettier, cspell, editorconfig)

Fixed

• Install tools to RUNNER_TEMP and add to GITHUB_PATH instead of writing to system paths
• Extract scrut binary with --strip-components=1 for correct tarball layout

... (truncated)

Commits

• 3a2db70 release: v2.0.0
• 3dc9fe3 docs: rename and move simplify-go-ci plan to done
• 1ff47d3 docs: move Phase 4 plan to done
• f272a99 docs: update README, CHANGELOG, CLAUDE.md, and copilot-instructions for v2
• e666aec feat(go-ci)!: require Makefile targets, remove direct command fallbacks
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)