chore: Golang 1.25.6 to close CVE + claude skill (#6379)

.claude/skills/update-go-version/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: update-go-version
+description: Update Go version across the Tempo codebase (go.mod, tools/go.mod, Dockerfile, CI workflows, tools image tag)
+allowed-tools: WebFetch, Grep, Read, Write
+---
+
+# Update Go Version
+
+Updates the Go version across all relevant files in the Tempo codebase.
+
+## Usage
+
+Invoke with `/update-go-version`
+
+## Steps to Perform
+
+### 1. Get the version
+
+Extract Go version from tools/Dockerfile. 
+
+This file is updated by a Renovate workflow automatically.
+
+### 2. Check if go.mod files need updating
+
+Check these files:
+- `go.mod` (main module)
+- `tools/go.mod` (tools module)
+If the versions already match, advise user that tools/Dockerfile needs to be updated and merged first to build new image, then stop.
+
+### 3. Update go.mod files
+
+Update the `go X.Y.Z` directive in both:
+- `go.mod` (main module)
+- `tools/go.mod` (tools module)
+
+### 4. Update TOOLS_IMAGE_TAG in build/tools.mk
+
+Fetch the latest tools image tag from Docker Hub:
+```bash
+curl -s "https://hub.docker.com/v2/repositories/grafana/tempo-ci-tools/tags?page_size=5&ordering=last_updated" | jq -r '.results[0].name'
+```
+
+Update `TOOLS_IMAGE_TAG ?= main-XXXXXXX` with the latest tag.
+
+### 5. Verify changes compile
+
+```bash
+make vendor
+make build
+```
+
+## Files to Update
+
+| File | What to change |
+|------|----------------|
+| `go.mod` | `go X.Y.Z` directive |
+| `tools/go.mod` | `go X.Y.Z` directive |
+| `build/tools.mk` | `TOOLS_IMAGE_TAG` value |

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
         with:
-          go-version: '1.25.5'
+          go-version-file: 'go.mod'
 
       - name: check-fmt
         run: make check-fmt
@@ -83,7 +83,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
         with:
-          go-version: '1.25.5'
+          go-version-file: 'go.mod'
 
       - name: Run Tests
         run: make ${{ matrix.test-target }}
@@ -166,7 +166,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
         with:
-          go-version: '1.25.5'
+          go-version-file: 'go.mod'
       - name: Run Tests
         run: make ${{ matrix.test-target }}
 
@@ -182,7 +182,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
         with:
-          go-version: '1.25.5'
+          go-version-file: 'go.mod'
 
       - name: Build Tempo
         run: make tempo
@@ -211,7 +211,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
         with:
-          go-version: '1.25.5'
+          go-version-file: 'go.mod'
 
       - name: Check vendor
         run: make vendor-check
@@ -228,7 +228,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
         with:
-          go-version: '1.25.5'
+          go-version-file: 'go.mod'
 
       - name: Check jsonnet
         run: make jsonnet-check
@@ -269,7 +269,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
         with:
-          go-version: '1.25.5'
+          go-version-file: 'go.mod'
 
       - name: Download all coverage artifacts
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7

.gitignore

@@ -1,7 +1,7 @@
 .DS_Store
 .idea
 .vscode
-.claude
+.claude/settings.local.json
 *.test
 *.out
 .coverage/

build/tools.mk

@@ -12,7 +12,7 @@ TOOL_DIR     ?= tools
 TOOL_CONFIG  ?= $(TOOL_DIR)/tools.go
 
 TOOLS_IMAGE ?= grafana/tempo-ci-tools
-TOOLS_IMAGE_TAG ?= main-7162983
+TOOLS_IMAGE_TAG ?= main-d9d391d
 
 GOTOOLS ?= $(shell cd $(TOOL_DIR) && go list -e -f '{{ .Imports }}' -tags tools |tr -d '[]')
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/grafana/tempo
 
-go 1.25.5
+go 1.25.6
 
 require (
 	cloud.google.com/go/storage v1.59.1

tools/go.mod

@@ -1,6 +1,6 @@
 module github.com/grafana/tempo/tools
 
-go 1.25.5
+go 1.25.6
 
 require (
 	github.com/golangci/golangci-lint/v2 v2.8.0