build(ci): replace go mod tidy with go mod download

Use go mod download instead of go mod tidy in CI workflows to avoid unnecessary modifications to go.mod and go.sum files during builds

.gitea/workflows/build.yml

@@ -16,7 +16,7 @@ env:
   GOPRIVATE: git.marketally.com
   GONOSUMDB: git.marketally.com
   GOTOOLCHAIN: local
-  GO_VERSION: "1.26.2"
+  GO_VERSION: "1.25.9"
   NODE_VERSION: "22"
 
 jobs:
@@ -346,10 +346,11 @@ jobs:
 
       - name: Update vault dependency (Unix)
         if: matrix.goos != 'windows'
+        env:
+          GOPRIVATE: ""
+          GOPROXY: direct
         run: |
           set -x
-          export GOPRIVATE=""
-          export GOPROXY=direct
           VAULT_VERSION="${{ steps.vault.outputs.version }}"
           echo "Building with vault $VAULT_VERSION"
           # BSD sed (macOS) requires -i '', GNU sed (Linux) requires -i without arg
@@ -359,14 +360,15 @@ jobs:
             sed -i "s|replace git.marketally.com/gitcaddy/gitcaddy-vault => ../gitcaddy-vault|replace git.marketally.com/gitcaddy/gitcaddy-vault => git.marketally.com/gitcaddy/gitcaddy-vault $VAULT_VERSION|" go.mod
           fi
           cat go.mod | grep -A2 "gitcaddy-vault" || true
-          go mod download 2>&1
+          go mod download
 
       - name: Update vault dependency (Windows)
         if: matrix.goos == 'windows'
         shell: pwsh
+        env:
+          GOPRIVATE: ""
+          GOPROXY: direct
         run: |
-          $env:GOPRIVATE = ""
-          $env:GOPROXY = "direct"
           $vaultVersion = "${{ steps.vault-win.outputs.version }}"
           Write-Host "Building with vault $vaultVersion"
           $content = Get-Content go.mod -Raw
@@ -599,13 +601,7 @@ jobs:
 
       - name: Install Go
         run: |
-          # Resolve the full version (go.dev requires patch version, e.g. 1.26.0 not 1.26)
-          GO_DL_VERSION="${{ env.GO_VERSION }}"
-          if ! echo "$GO_DL_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
-            GO_DL_VERSION="${GO_DL_VERSION}.0"
-          fi
-          echo "Downloading go${GO_DL_VERSION}.linux-arm64.tar.gz"
-          curl -fsSL "https://go.dev/dl/go${GO_DL_VERSION}.linux-arm64.tar.gz" -o go.tar.gz
+          curl -fsSL "https://go.dev/dl/go${{ env.GO_VERSION }}.linux-arm64.tar.gz" -o go.tar.gz
           tar -C /usr/local -xzf go.tar.gz
           rm go.tar.gz
           echo "/usr/local/go/bin" >> $GITHUB_PATH
@@ -632,15 +628,16 @@ jobs:
           ./scripts/sync-vault.sh
 
       - name: Update vault dependency
+        env:
+          GOPRIVATE: ""
+          GOPROXY: direct
         run: |
           set -x
-          export GOPRIVATE=""
-          export GOPROXY=direct
           VAULT_VERSION="${{ steps.vault.outputs.version }}"
           echo "Building with vault $VAULT_VERSION"
           sed -i "s|replace git.marketally.com/gitcaddy/gitcaddy-vault => ../gitcaddy-vault|replace git.marketally.com/gitcaddy/gitcaddy-vault => git.marketally.com/gitcaddy/gitcaddy-vault $VAULT_VERSION|" go.mod
           cat go.mod | grep -A2 "gitcaddy-vault" || true
-          /usr/local/go/bin/go mod download 2>&1
+          /usr/local/go/bin/go mod download
 
       - name: Install pnpm
         run: npm install -g pnpm

go.mod

@@ -2,7 +2,7 @@ module code.gitcaddy.com/server/v3
 
 go 1.25.0
 
-toolchain go1.25.5
+toolchain go1.25.9
 
 // rfc5280 said: "The serial number is an integer assigned by the CA to each certificate."
 // But some CAs use negative serial number, just relax the check. related:
@@ -340,4 +340,9 @@ exclude github.com/goccy/go-json v0.4.11
 
 exclude github.com/satori/go.uuid v1.2.0
 
+// Pin SDK to v0.22.0 — v0.24.x requires go 1.26
+exclude code.gitea.io/sdk/gitea v0.24.0
+
+exclude code.gitea.io/sdk/gitea v0.24.1
+
 tool code.gitea.io/gitea-vet

go.sum

@@ -31,6 +31,8 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 git.marketally.com/gitcaddy/actions-proto-go v0.5.8 h1:MBipeHvY6A0jcobvziUtzgatZTrV4fs/HE1rPQxREN4=
 git.marketally.com/gitcaddy/actions-proto-go v0.5.8/go.mod h1:RPu21UoRD3zSAujoZR6LJwuVNa2uFRBveadslczCRfQ=
+git.marketally.com/gitcaddy/gitcaddy-vault v1.0.60 h1:SHmAZG1PxbC9kG9gWdrhrQ7cHVmP0e6iMloBK100kQA=
+git.marketally.com/gitcaddy/gitcaddy-vault v1.0.60/go.mod h1:UAmVrJUXHsGe3iJz2gmow2zsIE/KAXaW4jKytrxT8jQ=
 git.marketally.com/mirrors/gotextdiff v1.0.3 h1:Mxf+YurdCHT4y1GNiZCTDWYtVXSxhlLUeG7g7i9Za70=
 git.marketally.com/mirrors/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 gitea.com/gitea/act v0.261.7-0.20251003180512-ac6e4b751763 h1:ohdxegvslDEllZmRNDqpKun6L4Oq81jNdEDtGgHEV2c=