I have two examples ([here](https://gitlab.com/sylva-projects/sylva-elements/misc-controllers-suite/-/jobs/13509518257) and [here](https://gitlab.com/sylva-projects/sylva-elements/misc-controllers-suite/-/jobs/13509912072)) where go-sbom CI job is failing on MRs without any obvious reason why, and the logs show the go-sbom installation failing with: ``` go: github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest: github.com/CycloneDX/cyclonedx-gomod@v1.10.0 requires go >= 1.25 (running go 1.24.13; GOTOOLCHAIN=local) ``` It appears that the problem is the use of an `@latest` version which results in trying to use a go version which isn't present in the maintenance branch of our repo. The problem is that to-be-continuous, from which we get that tool, does no pinning, and does not seem to provide any way of using something else than latest (https://gitlab.com/to-be-continuous/golang/-/blob/ac427d1a6075d1871d755f64aada0fa3dbc8c810/templates/gitlab-ci-golang.yml#L842).