Repository: securego/gosec (language: go)

Issue:
Go version issues when running in CI (Github Actions)
### Summary 

I'm running into a version mismatch when running gosec in Github Actions. I have a dependency [ariga.io/atlas v0.25.0](https://github.com/ariga/atlas/blob/23e5130d5eddbdb31f90c4a3e50f256b701c59d6/go.mod#L3) which is forcing my `go.mod` file to specify the Go version as `go 1.22.5`. It appear the Docker image `securego/gosec:2.20.0` was built iwth [go 1.22.3](https://hub.docker.com/layers/securego/gosec/2.20.0/images/sha256-1b2c61f3a4832d7f464656523a44813f01b0124a517c23ec1ca82dce4a3f399d?context=explore). This results in my CI action failing with errors such as:

```cosole
Golang errors in file: [cmd]:

  > [line 0 : column 0] - loading files from package "cmd": err: exit status 1: stderr: go: go.mod requires go >= 1.22.5 (running go 1.22.3; GOTOOLCHAIN=local)
```

I'm not sure if there is a workaround or if a new Docker image could be built with the latest Go version.

### Steps to reproduce the behavior

Use Github Action (setup-go may not be needed):
```yaml
jobs:
  gosec:
    name: Gosec
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.22.5'

      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: '-exclude=G108,G203 -exclude-generated ./...'
```

### gosec version

`2.20.0`

### Go version (output of 'go version')

`go version go1.22.5 linux/amd64`



Discussion / hints:
The version is already bumped in the CI scripts to 1.22.5. This will be fixed with the next release when a new docker image will be released with an updated Go version.

In the meantime, you can build a new docker image from master.
@ccojocar please release a new patch for the gosec docker image, using `action.yaml` from master still gives the hardcoded image

perhaps master should use latest image and the tagged versions will reference the specific versions

but for now please just release a patch so to unclog CIs around the world :)
I'll release soon a new version. Usually we keep a 3 months cadence. 

> perhaps master should use latest image and the tagged versions will reference the specific versions

The `latest` tag is alway pointing to last released version. There ins't a continuous build of the latest image from master. We try to keep the version of the action is sync with the version of the image, this is why is hardcoded. I didn't find an automatic way to do this. Happy to have some suggestions how this could be automated.

 > but for now please just release a patch so to unclog CIs around the world :)

This sounds like a happy end for these CIs. In this case, they should consider sponsoring the project if is so critical for them ;-). 
I would suggest releasing patch / hotfix versions (e.g. `2.20.1`) for security issues in either Go versions or versions of dependencies. Those releases should only contain version updates separate from any feature releases. Then you can stick to a 3 month release cadence without falling behind on security issues.
@ccojocar Any update on this? We're now on to `go1.23` and it's causing issues across even more repos. Can we please at least get a hotfix release with just go version updates if other features/fixes aren't ready to release? 

Fix patch:
diff --git a/action.yml b/action.yml
index b1a7767052..847d89844a 100644
--- a/action.yml
+++ b/action.yml
@@ -10,7 +10,7 @@ inputs:
 
 runs:
     using: 'docker'
-    image: 'docker://securego/gosec:2.20.0'
+    image: 'docker://securego/gosec:2.21.0'
     args:
       - ${{ inputs.args }}
 


Test patch: