What Changed

• Updated GOVULNCHECK_GO_VERSION from 1.25.5 to 1.25.6 in .github/.env.base
• Updated MAGE_X_VERSION from v1.17.4 to v1.18.0 in .github/.env.base
• Enhanced error handling in download-artifact-resilient action to gracefully handle API failures when fetching artifacts list
• Added JSON validation to verify artifacts API response structure before processing
• Improved error messages with detailed API response logging for troubleshooting
• Added explicit handling for continue-on-error mode with proper warning/error annotations when API calls fail
• Updated cancel-workflow-on-failure action to add explicit contents: read permission
• Modified multiple fortress workflow files to add explicit contents: read and actions: read permissions at workflow level
• Standardized permission declarations across all fortress workflows for better security and clarity

Why It Was Necessary

• Bump to latest Go version (1.25.6) ensures accurate vulnerability detection with the most recent security patches and standard library updates
• Upgrade to Mage-X v1.18.0 brings latest tooling improvements and bug fixes for build automation
• Enhanced error handling prevents CI failures from artifact API transient errors or rate limiting issues, improving workflow reliability
• Explicit permissions follow GitHub Actions security best practices by declaring minimum required permissions upfront

Testing Performed

• Version bumps are straightforward dependency updates to stable releases
• Error handling improvements can be validated by simulating artifact API failures or invalid responses
• Permission changes are declarative and will be validated by GitHub Actions runtime when workflows execute
• All changes maintain backward compatibility with existing workflow behavior

Impact / Risk

• Low Risk: Version bumps are to stable releases; error handling improvements only affect failure scenarios
• No Breaking Changes: All modifications are backward compatible and enhance existing functionality
• Improved Reliability: Better error handling reduces false-negative CI failures from transient API issues
• Security Enhancement: Explicit permissions follow least-privilege principle and improve auditability