ci: build with Go 1.27 and grant PR checks access

go.mod needs Go 1.26 but the workflows pinned Go 1.25. The pull request workflow also lacked the permissions that the shared workflow requires, so it never started.

.github/workflows/autoupdate.yaml

@@ -14,6 +14,6 @@ jobs:
   autoupdate:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
     with:
-      go-version: ">=1.25"
+      go-version: ">=1.27"
       release-workflow: "release.yaml"
     secrets: inherit

.github/workflows/pr.yaml

@@ -9,8 +9,13 @@ on:
       - "**"
       - "!main"
 
+permissions:
+  contents: read
+  pull-requests: write
+  security-events: write
+
 jobs:
   pr-checks:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-pr.yaml@main
     with:
-      go-version: "1.25"
+      go-version: ">=1.27"

.github/workflows/release.yaml

@@ -22,7 +22,7 @@ jobs:
   release:
     uses: lukaszraczylo/shared-actions/.github/workflows/go-release-cgo.yaml@main
     with:
-      go-version: "1.25"
+      go-version: ">=1.27"
       # Enable frontend build
       node-enabled: true
       node-version: "20"
@@ -45,7 +45,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.25"
+          go-version: ">=1.27"
 
       - name: Run benchmarks
         run: go test -bench=. -benchmem ./... -run=^# | tee output.txt