docs: note govulncheck api limit workflow fix

.gitea/workflows/do-release.yml

@@ -126,7 +126,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: '1.26.1'
-          check-latest: true
+          check-latest: false
           cache: true
           cache-dependency-path: go.sum
 

.gitea/workflows/prepare-release.yml

@@ -35,7 +35,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: '1.26.1'
-          check-latest: true
+          check-latest: false
           cache: true
           cache-dependency-path: go.sum
 
@@ -77,6 +77,8 @@ jobs:
       - name: Run govulncheck
         uses: golang/govulncheck-action@v1.0.4
         with:
+          go-version-file: go.mod
+          check-latest: false
           go-package: ./...
           cache: true
           cache-dependency-path: go.sum

.gitea/workflows/push-validation.yml

@@ -31,7 +31,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: '1.26.1'
-          check-latest: true
+          check-latest: false
           cache: true
           cache-dependency-path: go.sum
 
@@ -73,6 +73,8 @@ jobs:
       - name: Run govulncheck
         uses: golang/govulncheck-action@v1.0.4
         with:
+          go-version-file: go.mod
+          check-latest: false
           go-package: ./...
           cache: true
           cache-dependency-path: go.sum
@@ -123,7 +125,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: '1.26.1'
-          check-latest: true
+          check-latest: false
           cache: true
           cache-dependency-path: go.sum
 

CHANGELOG.md

@@ -35,6 +35,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 
 ### Fixed
 
+- Prevented `govulncheck-action` from defaulting to `setup-go` version `stable` by explicitly setting `go-version-file` and disabling `check-latest`, avoiding unauthenticated GitHub API rate-limit failures on self-hosted/act-style runners.
 - Made `do-release` version resolution resilient to `workflow_call` input passing issues by adding a separate tag detection step that fetches and discovers the latest tag from origin as a fallback when `inputs.tag` is empty, enabling proper operation even when Gitea's workflow_call doesn't pass inputs through correctly.
 - Fixed version resolution in `do-release` workflow by moving version calculation before checkout, resolving from inputs/git tags, and always passing explicit version to `publish` action.
 - Fixed tag detection in `do-release` to prioritize the tag at current HEAD (created by `prepare-release`) over the globally latest tag, ensuring correct version is detected when called from `prepare-release` workflow.