Use porch setup-go-kpt composite action in CI workflows

[aravindtga]

Replace direct actions/setup-go usage and manual kpt installation with the kptdev/porch/.github/actions/setup-go-kpt composite action across all workflows.

Changes:

• Use setup-go-kpt with install-kpt: 'false' for Go-only jobs (validate-metadata, go-unit-test-ci, build-push workflows)
• Use setup-go-kpt with functions/go/list-setters/go.mod in e2e-ci to resolve both Go and kpt versions from go.mod
• Remove separate "Install kpt" step from e2e-ci (now handled by the action)
• Bump actions/checkout to v6

AI usage disclosure

• AI assistance (Kiro CLI) was used to draft portions of this change, and this PR description.

[netlify]

✅ Deploy Preview for krm-function-catalog canceled.

Name	Link
🔨 Latest commit	e45a91f
🔍 Latest deploy log	https://app.netlify.com/projects/krm-function-catalog/deploys/6a16947f03f7d500084fc320

[Copilot]

Pull request overview

This PR updates the repository’s GitHub Actions workflows to standardize Go (+ optional kpt) setup via the kptdev/porch/.github/actions/setup-go-kpt composite action, removing bespoke setup logic from individual jobs.

Changes:

• Replaces actions/setup-go and manual go install github.com/kptdev/kpt@... steps with setup-go-kpt across CI/release workflows (disabling kpt install for Go-only jobs).
• Updates CI checkout usage (including removing the legacy “checkout into GOPATH” pattern for unit tests).
• Bumps actions/checkout usage in the touched workflows to @v6.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/ci.yaml	Switches CI jobs to use setup-go-kpt (with/without kpt) and updates checkout version.
.github/workflows/after-tag-with-version.yaml	Updates release-tag build workflow to use setup-go-kpt and newer checkout.
.github/workflows/after-push-to-branch.yaml	Updates main-branch build/push workflow to use setup-go-kpt and newer checkout.

Comments suppressed due to low confidence (2)

.github/workflows/ci.yaml:60

• Using a Git ref of @main for a third-party/composite GitHub Action is not immutable and can change unexpectedly (or be force-pushed), which can break CI and weakens supply-chain security. Prefer pinning to a versioned tag (e.g. @vX.Y.Z) or a full commit SHA.

      - name: Set up Go
        uses: kptdev/porch/.github/actions/setup-go-kpt@main
        with:
          go-version-file: documentation/go.mod
          install-kpt: 'false'

.github/workflows/ci.yaml:76

• Using a Git ref of @main for a third-party/composite GitHub Action is not immutable and can change unexpectedly (or be force-pushed), which can break CI and weakens supply-chain security. Prefer pinning to a versioned tag (e.g. @vX.Y.Z) or a full commit SHA.

      - uses: actions/checkout@v6
      - name: Set up Go and install kpt
        uses: kptdev/porch/.github/actions/setup-go-kpt@main
        with:
          go-version-file: functions/go/list-setters/go.mod

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.