chore: align toolchain versions and enforce them in CI

.github/dependabot.yml

@@ -1,77 +1,52 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
       interval: "weekly"
     labels:
       - "dependencies"
       - "github-actions"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: "gomod"
-    directory: "/ci/cloudrunners"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "gomod"
-    directory: "/ci/gha-runner-vm"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "gomod"
-    directory: "/ci/gha-runner-vm-oci"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "gomod"
-    directory: "/utilities/dot-project"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "gomod"
-    directory: "/utilities/labeler"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "gomod"
-    directory: "/utilities/landscape-mcp-server"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "gomod"
-    directory: "/utilities/landscape-sync"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "docker"
-    directory: "/ci/cloudrunners"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "docker"
-    directory: "/ci/cloudrunners/gcp"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "docker"
-    directory: "/ci/gha-runner-image"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "docker"
-    directory: "/utilities/dot-project"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "docker"
-    directory: "/utilities/labeler"
-    schedule:
-      interval: "weekly"
+    directories:
+      - "/ci/cloudrunners"
+      - "/ci/gha-runner-vm"
+      - "/ci/gha-runner-vm-oci"
+      - "/utilities/dot-project"
+      - "/utilities/labeler"
+      - "/utilities/landscape-mcp-server"
+      - "/utilities/landscape-sync"
+    schedule:
+      interval: "weekly"
+    groups:
+      go-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "docker"
-    directory: "/utilities/landscape-mcp-server"
+    directories:
+      - "/ci/cloudrunners"
+      - "/ci/cloudrunners/gcp"
+      - "/ci/gha-runner-image"
+      - "/utilities/dot-project"
+      - "/utilities/labeler"
+      - "/utilities/landscape-mcp-server"
     schedule:
       interval: "weekly"
+    groups:
+      docker-base-images:
+        patterns:
+          - "*"
 
   - package-ecosystem: "terraform"
     directories:
@@ -80,21 +55,18 @@ updates:
       interval: "weekly"
 
   - package-ecosystem: "pip"
-    directory: "/Ambassadors"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "pip"
-    directory: "/Kubestronaut"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "pip"
-    directory: "/Kubestronaut/Rendering"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "pip"
-    directory: "/Kubestronaut/kubestronauts-coupons"
-    schedule:
-      interval: "weekly"
+    directories:
+      - "/Ambassadors"
+      - "/Kubestronaut"
+      - "/Kubestronaut/Rendering"
+      - "/Kubestronaut/kubestronauts-coupons"
+      - "/utilities/audit_project_lifecycle_across_tools"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"

.github/scripts/check-go-version.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# CI guard: ensures every go.mod and Dockerfile matches .go-version
+# CI guard: ensures every go.mod, Dockerfile (FROM golang / go.dev tarball),
+# and hardcoded go-version: in .github workflows matches .go-version
 
 set -euo pipefail
 
@@ -33,8 +34,20 @@ while IFS= read -r file; do
     version=$(echo "$line" | sed -n 's/.*golang:\([0-9]*\.[0-9]*\(\.[0-9]*\)\?\).*/\1/p')
     check "$file" "$version" || FAIL=1
   done < <(grep -E '^FROM golang:' "$file" || true)
+  while IFS= read -r line; do
+    version=$(echo "$line" | sed -n 's#.*go\.dev/dl/go\([0-9]*\.[0-9]*\(\.[0-9]*\)\?\)\..*#\1#p')
+    check "$file (go.dev/dl tarball)" "$version" || FAIL=1
+  done < <(grep -E 'go\.dev/dl/go[0-9]' "$file" || true)
 done < <(find "$ROOT" -name "Dockerfile" -not -path "*/vendor/*")
 
+echo "Checking hardcoded go-version in workflows and actions..."
+while IFS= read -r file; do
+  while IFS= read -r line; do
+    version=$(echo "$line" | sed -n "s/.*go-version:[[:space:]]*['\"]\?\([0-9][0-9.]*\)['\"]\?.*/\1/p")
+    check "$file" "$version" || FAIL=1
+  done < <(grep -E "^[[:space:]]*go-version:[[:space:]]*['\"]?[0-9]" "$file" || true)
+done < <(find "$ROOT/.github" \( -name "*.yml" -o -name "*.yaml" \) -not -path "*/node_modules/*")
+
 if [[ $FAIL -ne 0 ]]; then
   echo "FAILED: version mismatch found — update files to match .go-version ($WANT)"
   exit 1

.github/workflows/auto-sync-labels.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.11'
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: |

.github/workflows/change-file-build-new-actions-vm.yml

@@ -69,7 +69,7 @@ jobs:
       - name: Install OCI CLI
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.13'
+          python-version-file: .python-version
 
       - name: Install OCI CLI packages
         run: pip install oci-cli
@@ -164,7 +164,7 @@ jobs:
       - name: Install OCI CLI
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.13'
+          python-version-file: .python-version
 
       - name: Install OCI CLI packages
         run: pip install oci-cli

.github/workflows/check-go-version.yml

@@ -0,0 +1,36 @@
+name: Check Go Version Consistency
+
+on:
+  pull_request:
+    paths:
+      - '.go-version'
+      - '**/go.mod'
+      - '**/Dockerfile'
+      - '.github/workflows/**'
+      - '.github/actions/**'
+      - '.github/scripts/check-go-version.sh'
+  push:
+    branches: [main]
+    paths:
+      - '.go-version'
+      - '**/go.mod'
+      - '**/Dockerfile'
+      - '.github/workflows/**'
+      - '.github/actions/**'
+      - '.github/scripts/check-go-version.sh'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check-go-version:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Verify go.mod, Dockerfile, and workflow Go versions match .go-version
+        run: bash .github/scripts/check-go-version.sh

.github/workflows/detect-label-drift.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.11'
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: |

.github/workflows/landscape-data-content-auditor.yml

@@ -19,12 +19,12 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: "3.11"
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install pyyaml
+          pip install -r utilities/audit_project_lifecycle_across_tools/requirements.txt
 
       - name: Validate required datasource snapshots exist
         working-directory: ./utilities/audit_project_lifecycle_across_tools

.github/workflows/periodic-build-new-actions-vm.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Install OCI CLI
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.13'
+          python-version-file: .python-version
 
       - name: Install OCI CLI packages
         run: pip install oci-cli
@@ -168,7 +168,7 @@ jobs:
       - name: Install OCI CLI
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.13'
+          python-version-file: .python-version
 
       - name: Install OCI CLI packages
         run: pip install oci-cli

.github/workflows/python-syntax-check.yml

@@ -0,0 +1,34 @@
+name: Python Syntax Check
+
+on:
+  pull_request:
+    paths:
+      - '**.py'
+      - '.python-version'
+      - 'tests/syntax_check.py'
+  push:
+    branches: [main]
+    paths:
+      - '**.py'
+      - '.python-version'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  syntax-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: .python-version
+
+      - name: Compile all tracked Python files
+        run: python tests/syntax_check.py

.github/workflows/reusable-generate-sbom.yml

@@ -45,7 +45,9 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '1.22'
+          # Caller's repo is checked out here, so .go-version is unavailable.
+          # Keep in sync with /.go-version (enforced by .github/scripts/check-go-version.sh).
+          go-version: '1.27.1'
           cache: false
 
       - name: Install bom tool and go-licenses

.github/workflows/sync-lfx-insights-health.yml

@@ -22,12 +22,12 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: "3.11"
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install requests pyyaml
+          pip install -r utilities/audit_project_lifecycle_across_tools/requirements.txt
 
       - name: Generate lfx_insights_health.yaml
         run: |

.github/workflows/sync-pcc-and-audit-statuses.yml

@@ -19,12 +19,12 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: "3.11"
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install requests pyyaml beautifulsoup4
+          pip install -r utilities/audit_project_lifecycle_across_tools/requirements.txt
 
       - name: Generate pcc_projects.yaml
         env:

.github/workflows/test-landscape-guard.yml

@@ -22,7 +22,7 @@ jobs:
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.12'
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: pip install pyyaml
@@ -81,7 +81,7 @@ jobs:
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.12'
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: pip install pyyaml
@@ -147,7 +147,7 @@ jobs:
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.12'
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: pip install pyyaml
@@ -188,7 +188,7 @@ jobs:
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.12'
+          python-version-file: .python-version
 
       - name: Install dependencies
         run: pip install pyyaml