Build with Go 1.26

.github/workflows/backport.yaml

@@ -7,6 +7,6 @@ jobs:
     permissions:
       contents: write # for reading and creating branches.
       pull-requests: write # for creating pull requests against release branches.
-    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.4.0
+    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.6.0
     secrets:
       github-token: ${{ secrets.BOT_GITHUB_TOKEN }}

.github/workflows/cifuzz.yaml

@@ -11,9 +11,9 @@ jobs:
       contents: read # for reading the repository code.
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.4.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.6.0
         with:
-          go-version: 1.25.x
+          go-version: 1.26.x
       - name: Smoke test Fuzzers
         run: make fuzz-smoketest
         env:

.github/workflows/e2e.yaml

@@ -13,9 +13,9 @@ jobs:
       contents: read # for reading the repository code.
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.4.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.6.0
         with:
-          go-version: 1.25.x
+          go-version: 1.26.x
       - name: Verify
         run: make verify
       - name: Enable integration tests

.github/workflows/release.yaml

@@ -15,7 +15,7 @@ jobs:
       contents: write # for creating the GitHub release.
       id-token: write # for creating OIDC tokens for signing.
       packages: write # for pushing and signing container images.
-    uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.4.0
+    uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.6.0
     with:
       controller: ${{ github.event.repository.name }}
       release-candidate-prefix: ${{ github.event.inputs.tag }}

.github/workflows/scan.yaml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: read # for reading the repository code.
       security-events: write # for uploading the CodeQL analysis results.
-    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.4.0
+    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.6.0
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}
       fossa-token: ${{ secrets.FOSSA_TOKEN }}

.github/workflows/sync-labels.yaml

@@ -11,6 +11,6 @@ jobs:
     permissions:
       contents: read # for reading the labels file.
       issues: write # for creating and updating labels.
-    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.4.0
+    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.6.0
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yaml

@@ -11,9 +11,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.4.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.6.0
         with:
-          go-version: 1.25.x
+          go-version: 1.26.x
       - name: Run tests
         env:
           SKIP_COSIGN_VERIFICATION: true

Dockerfile

@@ -1,5 +1,5 @@
-ARG GO_VERSION=1.25
-ARG XX_VERSION=1.6.1
+ARG GO_VERSION=1.26
+ARG XX_VERSION=1.9.0
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 
@@ -35,7 +35,7 @@ ARG TARGETARCH
 ENV CGO_ENABLED=0
 RUN xx-go build -trimpath -a -o source-controller main.go
 
-FROM alpine:3.22
+FROM alpine:3.23
 
 ARG TARGETPLATFORM
 RUN apk --no-cache add ca-certificates \

Makefile

@@ -118,8 +118,8 @@ api-docs: gen-crd-api-reference-docs  ## Generate API reference documentation
 	$(GEN_CRD_API_REFERENCE_DOCS) -api-dir=./api/v1 -config=./hack/api-docs/config.json -template-dir=./hack/api-docs/template -out-file=./docs/api/v1/source.md
 
 tidy:  ## Run go mod tidy
-	cd api; rm -f go.sum; go mod tidy -compat=1.25
-	rm -f go.sum; go mod tidy -compat=1.25
+	cd api; rm -f go.sum; go mod tidy -compat=1.26
+	rm -f go.sum; go mod tidy -compat=1.26
 
 fmt:  ## Run go fmt against code
 	go fmt ./...

go.mod

@@ -1,6 +1,6 @@
 module github.com/fluxcd/source-controller
 
-go 1.25.5
+go 1.26.0
 
 replace github.com/fluxcd/source-controller/api => ./api
 
@@ -25,7 +25,7 @@ require (
 	github.com/fluxcd/pkg/apis/event v0.24.0
 	github.com/fluxcd/pkg/apis/meta v1.25.0
 	github.com/fluxcd/pkg/artifact v0.8.0
-	github.com/fluxcd/pkg/auth v0.38.0
+	github.com/fluxcd/pkg/auth v0.38.2
 	github.com/fluxcd/pkg/cache v0.13.0
 	github.com/fluxcd/pkg/git v0.43.0
 	github.com/fluxcd/pkg/gittestserver v0.25.0

go.sum

@@ -371,8 +371,8 @@ github.com/fluxcd/pkg/apis/meta v1.25.0 h1:fmZgMoe7yITGfhFqdOs7w2GOu3Y/2Vvz4+4p/
 github.com/fluxcd/pkg/apis/meta v1.25.0/go.mod h1:1D92RqAet0/n/cH5S0khBXweirHWkw9rCO0V4NCY6xc=
 github.com/fluxcd/pkg/artifact v0.8.0 h1:9PI+jGvgZzObYQeC6Myg4j2dctAD42C0kjxvfbvdufk=
 github.com/fluxcd/pkg/artifact v0.8.0/go.mod h1:p3QugDJKttgI0XYI6M0Rb8pHs9Qfldh1BgVwn7GcTAU=
-github.com/fluxcd/pkg/auth v0.38.0 h1:9sslEwJp2lGZKQyXU5X/AEMil8eXkApQz8AQXZM0rf0=
-github.com/fluxcd/pkg/auth v0.38.0/go.mod h1:038UyC92mnW1mzZ/A2fHJQUpuhPkJzw39ppChuOdYfI=
+github.com/fluxcd/pkg/auth v0.38.2 h1:AjB64oZO1Er3fxJUw1hRbN6J+2Cf0HWgZIOBE5xUtn8=
+github.com/fluxcd/pkg/auth v0.38.2/go.mod h1:038UyC92mnW1mzZ/A2fHJQUpuhPkJzw39ppChuOdYfI=
 github.com/fluxcd/pkg/cache v0.13.0 h1:MqtlgOwIVcGKKgV422e39O+KFSVMWuExKeRaMDBjJlk=
 github.com/fluxcd/pkg/cache v0.13.0/go.mod h1:0xRZ1hitrIFQ6pl68ke2wZLbIqA2VLzY78HpDo9DVxs=
 github.com/fluxcd/pkg/git v0.43.0 h1:11LKsTHw+yx3rcGSrSbkURcdc4huUv3FxQZhHIAMofc=