unboundsoftware/cron-checker
6
0 Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases 33 Activity

ci: derive Go version from go.mod instead of 'stable' #397

Merged
argoyle merged 3 commits from fix/ci-go-version-from-gomod into main 2026-08-17 08:24:31 +00:00
Conversation 0 Commits 3 Files Changed 3
+4 -4
argoyle commented 2026-08-17 06:24:34 +00:00
Owner
Copy link
Copy source

Root cause of the failing vulnerabilities and test jobs on the open Renovate PRs.

actions/setup-go resolves go-version: stable from the actions/go-versions manifest. On 2026-08-14 that manifest still pointed at go1.26.5, which carries 4 stdlib vulnerabilities (GO-2026-6218, GO-2026-6090, GO-2026-5972, GO-2026-5026), so govulncheck failed. It also broke the test job on #396 once go.mod required go >= 1.26.6, since setup-go sets GOTOOLCHAIN=local.

Switching to go-version-file: go.mod makes CI install exactly the toolchain go.mod declares. Renovate already tracks that directive (#395), so the Go version stops depending on manifest publishing lag.

After this lands, #394 / #395 / #396 should be rebased and re-run.

Root cause of the failing `vulnerabilities` and `test` jobs on the open Renovate PRs. `actions/setup-go` resolves `go-version: stable` from the `actions/go-versions` manifest. On 2026-08-14 that manifest still pointed at **go1.26.5**, which carries 4 stdlib vulnerabilities (GO-2026-6218, GO-2026-6090, GO-2026-5972, GO-2026-5026), so `govulncheck` failed. It also broke the `test` job on #396 once go.mod required `go >= 1.26.6`, since setup-go sets `GOTOOLCHAIN=local`. Switching to `go-version-file: go.mod` makes CI install exactly the toolchain go.mod declares. Renovate already tracks that directive (#395), so the Go version stops depending on manifest publishing lag. After this lands, #394 / #395 / #396 should be rebased and re-run.
argoyle closed this pull request 2026-08-17 08:08:16 +00:00
argoyle reopened this pull request 2026-08-17 08:08:17 +00:00
argoyle merged commit 7c0445b4ef into main 2026-08-17 08:24:31 +00:00
argoyle deleted branch fix/ci-go-version-from-gomod 2026-08-17 08:24:33 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
go
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
acctest (Shiny Acctest) argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unboundsoftware/cron-checker#397