update dependabot to care about go, make ci and govulncheck a little less fragile

.github/dependabot.yml

@@ -8,6 +8,11 @@ updates:
     schedule:
       interval: "daily"
 
+  - package-ecosystem: "gomod"
+    directory: "/sidecar"
+    schedule:
+      interval: "weekly"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

.github/workflows/ci.yaml

@@ -17,9 +17,6 @@ concurrency:
 permissions:
   contents: read
 
-env:
-  GO_VERSION: "1.26"
-
 defaults:
   run:
     working-directory: sidecar
@@ -33,7 +30,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: sidecar/go.mod
           check-latest: true
           cache-dependency-path: sidecar/go.sum
 
@@ -76,7 +73,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: sidecar/go.mod
           check-latest: true
           cache-dependency-path: sidecar/go.sum
 
@@ -94,7 +91,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: sidecar/go.mod
           check-latest: true
           cache-dependency-path: sidecar/go.sum
 

.github/workflows/govulncheck.yaml

@@ -19,10 +19,6 @@ concurrency:
 permissions:
   contents: read
 
-defaults:
-  run:
-    working-directory: sidecar
-
 jobs:
   govulncheck:
     name: govulncheck
@@ -30,13 +26,12 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: actions/setup-go@v6
+      # The action still installs govulncheck itself at @latest.
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@v1
         with:
-          go-version: "1.26"
+          go-version-file: sidecar/go.mod
           check-latest: true
           cache-dependency-path: sidecar/go.sum
-
-      - name: Run govulncheck
-        run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
-          govulncheck ./...
+          work-dir: sidecar
+          repo-checkout: false