build: update Polygon Cosmos SDK to fix govulncheck failures

[vbhattaccmu]

Summary

Replaces Bor's unmaintained OpenPGP release-signing dependency with the maintained ProtonMail implementation, updates Go build surfaces to 1.26.5, and moves GitHub Actions caches to the Node 24-compatible release. The branch temporarily points Bor at the patched Polygon Cosmos SDK branch and enables govulncheck on feature-branch pushes so the complete dependency chain can be validated. With these changes, make vulncheck reports zero reachable vulnerabilities.

Executed tests

• make vulncheck — passed with zero reachable vulnerabilities.
• go test ./internal/build ./consensus/bor/heimdall/... ./internal/cli/server — passed.
• Polygon Cosmos SDK: GOTOOLCHAIN=go1.26.5 go test ./crypto/... — passed.
• Polygon Cosmos SDK: GOTOOLCHAIN=go1.26.5 make vulncheck — passed with zero reachable vulnerabilities.
• git diff --check — passed.

diffguard was unavailable in the local environment and was not run.

Rollout notes

This change is not consensus-affecting and does not require a coordinated network upgrade. Release signing remains backward-compatible, and the Cosmos SDK change preserves legacy CRC24 validation for armored keys. Before merge, replace the temporary Cosmos SDK pseudo-version with the released Polygon SDK tag and remove the feature-branch-only govulncheck push trigger so the workflow returns to its normal nightly schedule.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​ProtonMail/​go-crypto@​v1.4.1

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.03%. Comparing base (65bb314) to head (7fce297).
⚠️ Report is 5 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #2305      +/-   ##
===========================================
+ Coverage    53.80%   54.03%   +0.22%     
===========================================
  Files          898      907       +9     
  Lines       160827   161989    +1162     
===========================================
+ Hits         86534    87524     +990     
- Misses       68913    69052     +139     
- Partials      5380     5413      +33     

Files with missing lines	Coverage Δ
internal/build/pgp.go	0.00% <ø> (ø)

... and 33 files with indirect coverage changes

Files with missing lines	Coverage Δ
internal/build/pgp.go	0.00% <ø> (ø)

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

Pull request overview

This PR modernizes Bor’s build and CI surfaces by replacing the deprecated OpenPGP implementation used for release signing, bumping the Go toolchain version across build entrypoints, and updating GitHub Actions caching to a newer major version.

Changes:

• Switched release-signing code from golang.org/x/crypto/openpgp to ProtonMail’s maintained go-crypto/openpgp.
• Updated Go version surfaces to 1.26.5 (module, Docker builders, golangci-lint).
• Adjusted CI workflows (govulncheck trigger behavior; cache action major version bump) and temporarily pinned Bor to a patched Polygon Cosmos SDK pseudo-version.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/build/pgp.go	Moves release signing to ProtonMail’s maintained OpenPGP implementation.
go.mod	Bumps Go version; adds ProtonMail go-crypto; updates Cosmos SDK replace to a patched pseudo-version.
go.sum	Updates checksums to reflect dependency changes (including go-crypto and Cosmos SDK).
Dockerfile	Updates builder image to Go 1.26.5.
Dockerfile.alltools	Updates builder image to Go 1.26.5.
cmd/keeper/go.mod	Updates module Go version to 1.26.5.
.golangci.yml	Updates golangci-lint configured Go version to 1.26.5.
.github/workflows/nightly-govulncheck.yml	Adds a temporary push trigger and bumps cache action major version.
.github/workflows/diffguard.yml	Bumps cache action major version.
.github/workflows/ci.yml	Bumps cache action major version across CI jobs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.

[marcello33]

LGTM. Can we first merge cosmos-sdk's PR, release a new version and then update the dependency here and in heimdall-v2 too?
Thanks

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

go.mod:358

• The Cosmos SDK replace target is a pseudo-version (v0.50.13-0...) even though the PR description says this is temporary and should be replaced with the released Polygon SDK tag before merge. Leaving a commit-based pseudo-version in go.mod makes builds less reproducible and complicates downstream dependency auditing/version tracking.

	github.com/cometbft/cometbft-db => github.com/0xPolygon/cometbft-db v0.14.1-polygon
	github.com/cosmos/cosmos-sdk => github.com/0xPolygon/cosmos-sdk v0.50.13-0.20260715080111-ed2455f86da0
	github.com/ethereum/go-ethereum => github.com/0xPolygon/bor v1.14.14-0.20260219070410-6b0405c0a5ca

.github/workflows/nightly-govulncheck.yml:22

• The PR description mentions enabling govulncheck on feature-branch pushes (and later removing that push trigger), but this workflow file still only has schedule and workflow_dispatch triggers. If branch-push coverage is still required for this PR’s validation plan, a push: trigger needs to be added; otherwise the PR description/rollout note should be updated to match the actual workflow behavior.

    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-go@v6

.github/workflows/diffguard.yml:39

• This workflow updates actions/cache to v6 (Node.js 24 runtime), but the same workflow still uses actions/upload-artifact@v4 later in the job, which runs on Node.js 20 (per actions/upload-artifact v4 action.yml). If the goal is full Node 24 compatibility (and to avoid future Node 20 deprecation breakage), upload-artifact should be bumped here as well (e.g. to v6/v7).

      - uses: actions/cache@v6
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-diffguard-${{ hashFiles('**/go.sum') }}
          restore-keys: ${{ runner.os }}-diffguard-