From 7c0445b4ef22062bb5963628cf17cb66fadf2adb Mon Sep 17 00:00:00 2001 From: Joakim Olsson Date: Mon, 17 Aug 2026 08:24:28 +0000 Subject: [PATCH] ci: derive Go version from go.mod instead of 'stable' (#397) Root cause of the failing `vulnerabilities` and `test` jobs on the open Renovate PRs. `actions/setup-go` resolves `go-version: stable` from the `actions/go-versions` manifest. On 2026-08-14 that manifest still pointed at **go1.26.5**, which carries 4 stdlib vulnerabilities (GO-2026-6218, GO-2026-6090, GO-2026-5972, GO-2026-5026), so `govulncheck` failed. It also broke the `test` job on #396 once go.mod required `go >= 1.26.6`, since setup-go sets `GOTOOLCHAIN=local`. Switching to `go-version-file: go.mod` makes CI install exactly the toolchain go.mod declares. Renovate already tracks that directive (#395), so the Go version stops depending on manifest publishing lag. After this lands, #394 / #395 / #396 should be rebased and re-run. --------- Co-authored-by: Renovate Bot Reviewed-on: https://gitea.unbound.se/unboundsoftware/cron-checker/pulls/397 --- .gitea/workflows/ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index e4264ad..7728d3c 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v7 with: - go-version: 'stable' + go-version-file: go.mod - name: Run tests run: go test -race -coverprofile=coverage.txt ./... @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v7 with: - go-version: 'stable' + go-version-file: go.mod - name: Check vulnerabilities run: | go install golang.org/x/vuln/cmd/govulncheck@latest