Chore: fix ci workflow

[tkan145]

What

• Bump builder image to go1.25
• Update GH action and pin version by using sha
• Ignore circleci test on master and all PR to master

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.99%. Comparing base (4963add) to head (807385a).
⚠️ Report is 18 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1178      +/-   ##
==========================================
+ Coverage   41.84%   43.99%   +2.14%     
==========================================
  Files         203      204       +1     
  Lines       20859    20925      +66     
==========================================
+ Hits         8729     9205     +476     
+ Misses      11350    10918     -432     
- Partials      780      802      +22     

Flag	Coverage Δ
unit	43.99% <ø> (+2.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
apis/apps/v1alpha1 (u)	63.19% <ø> (+4.64%)	⬆️
apis/capabilities/v1alpha1 (u)	3.50% <ø> (ø)
apis/capabilities/v1beta1 (u)	20.21% <ø> (ø)
controllers (i)	12.08% <88.23%> (+2.76%)	⬆️
pkg (u)	63.69% <81.73%> (+1.97%)	⬆️
see 10 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[urbanikb]

No problem with the PR, approved.

One question:

Update GH action and pin version by using sha
Would this not create maintenance burden / how were these sha pinned, is there a cli support for that in gh or something like that?

[tkan145]

It's security practice to pin with SHA, see https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

Regarding maintenance, we probably only need to upgrade the action once a year at most, unless something really broken.