chore: update CI workflows to go 1.25

[gbotrel]

update CI workflows to go 1.25

---

Note

Medium Risk
CI/tooling updates are low-risk but may affect build stability across runners, and the Go/toolchain + crypto dependency bumps plus prover/verification guard changes could impact proving behavior or performance if assumptions were previously relied upon.

Overview
CI/workflows: Update PR and push workflows to use Go 1.25.x, newer actions/checkout/setup-go, pinned tool versions, Go cache, and add workflow-level concurrency/minimal permissions. Tightens formatting checks by adding gofmt, improves go generate dirty-tree detection (ignoring go.mod/go.sum), upgrades golangci-lint action/version, sets push test matrix to 1.25.x with fail-fast: false, and removes Slack notification workflow wiring (and deletes slack-notifications.yml).

Code/deps: Bumps module go version to 1.25.6 and updates several deps (notably gnark-crypto, x/crypto, x/sys, pprof). Adds defensive validation in PLONK divideByZH (nil/zero/ratio domain checks) and in GKR verification to error on missing input-wire claims, tweaks tinyfield subtraction implementation, adjusts tinyfield sqrt benchmark input generation, fixes a small-rational Lagrange basis construction, and updates Eisenstein imports to the new gnark-crypto path. Also changes SHA-2 block compression to return a new hash state array instead of mutating currentHash in place.

^{Written by Cursor Bugbot for commit 415903e. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​gotesttools/​gotestfmt-action@​8b4478c7019be847373babde9300210e7de34bfb
	golang/​golang.org/​x/​crypto@​v0.46.0 ⏵ v0.48.0	+1
	golang/​github.com/​google/​pprof@​v0.0.0-20251213031049-b05bdaca462f ⏵ v0.0.0-20260202012954-cb029daf43ef	+1
	golang/​github.com/​consensys/​gnark-crypto@​v0.19.3-0.20260105204507-a918ce1daf68 ⏵ v0.19.3-0.20260210161253-243aa4749a4a	+1
	github/​actions/​checkout@​34e114876b0b11c390a56381ad16ebd13914f8d5 ⏵ de0fac2e4500dabe0009e67214ff5f5447ce83dd	+1
	golang/​github.com/​consensys/​bavard@​v0.2.2-0.20260105201452-c69d26cc6346 ⏵ v0.2.2-0.20260118153501-cba9f5475432

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Input argument leak: github gotesttools/gotestfmt-action exposes an input argument into sink Location: Package overview From: .github/workflows/pr.yml → github/gotesttools/gotestfmt-action@8b4478c7019be847373babde9300210e7de34bfb ℹ Read more on: This package | This alert | What are GitHub Actions taint flows? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Validate and sanitize all input arguments before using them in dangerous operations. Use parameterized commands or APIs instead of string concatenation for shell commands. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/gotesttools/gotestfmt-action@8b4478c7019be847373babde9300210e7de34bfb. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable leak: github gotesttools/gotestfmt-action passes an environment variable into sink Location: Package overview From: .github/workflows/pr.yml → github/gotesttools/gotestfmt-action@8b4478c7019be847373babde9300210e7de34bfb ℹ Read more on: This package | This alert | What are GitHub Actions taint flows? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Validate and sanitize environment variables before using them in dangerous operations. Ensure environment variables come from trusted sources only, and use parameterized commands or APIs instead of string concatenation. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/gotesttools/gotestfmt-action@8b4478c7019be847373babde9300210e7de34bfb. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

Updates the repository’s Go toolchain target and CI workflows to run on Go 1.25, and refines Slack CI notifications to report individual job outcomes.

Changes:

• Bump module go version to Go 1.25.7.
• Update GitHub Actions workflows (PR/push) to use Go 1.25.x and newer action versions, and bump golangci-lint configuration.
• Improve Slack notification workflow to accept separate job statuses and send richer messages with run metadata.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
go.mod	Updates the module go directive to Go 1.25.7.
AGENTS.md	Adds repository guidelines for structure, testing, and CI/dev commands.
.github/workflows/slack-notifications.yml	Reworks Slack workflow inputs/payload to reflect staticcheck + tests separately and include run details.
.github/workflows/push.yml	Updates push workflow to Go 1.25.x and aligns Slack workflow invocation with new inputs.
.github/workflows/pr.yml	Updates PR workflow to Go 1.25.x, refreshes tooling actions, and aligns Slack workflow invocation with new inputs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The PR title/description says this is a CI workflow update, but it also changes the module's go directive. If the go.mod bump is intended (it impacts local builds and downstream users), please reflect that in the PR description/title or split it into a separate change.

[Copilot]

AGENTS.md states CI runs on Go 1.23.x and the module targets 1.24.9, but this PR updates go.mod to Go 1.25.7 and workflows to Go 1.25.x. Please update this line to reflect the new supported/CI Go versions (or avoid hard-coding patch versions if you expect frequent bumps).

Suggested change

	Use Go 1.24+ (CI runs on Go 1.23.x; module currently targets 1.24.9).
	Use Go 1.25+ (CI and go.mod target Go 1.25.x).

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.