tidy up go mod deps #4

	# This GitHub action can publish assets for release when a tag is created.
	# Currently its setup to run on any tag that matches the pattern "v*" (ie. v0.1.0).
	#
	# This uses an action (crazy-max/ghaction-import-gpg) that assumes you set your
	# private key in the `GPG_PRIVATE_KEY` secret and passphrase in the `PASSPHRASE`
	# secret. If you would rather own your own GPG handling, please fork this action
	# or use an alternative one for key handling.
	#
	# You will need to pass the `--batch` flag to `gpg` in your signing step
	# in `goreleaser` to indicate this is being used in a non-interactive mode.

	name: release
	on:
	push:
	tags:
	- 'v*'
	jobs:
	goreleaser:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	# Allow goreleaser to access older tag information.
	fetch-depth: 0
	- name: Set up Go
	uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
	- name: Generate Software Bill of Materials
	uses: anchore/sbom-action@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 # v0
	- name: Import GPG key
	id: import_gpg
	uses: crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5 # v6
	with:
	gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
	passphrase: ${{ secrets.PASSPHRASE }}
	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6
	with:
	args: release --clean
	env:
	GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback