From ac49f3c2a6dc46d8fcebba68bc98204c8d735152 Mon Sep 17 00:00:00 2001 From: Joakim Olsson Date: Mon, 17 Aug 2026 08:24:17 +0200 Subject: [PATCH] ci: derive Go version from go.mod instead of 'stable' actions/setup-go resolves 'stable' from the go-versions manifest, which lagged behind the go1.26.6 security release and installed the vulnerable go1.26.5. That both failed govulncheck and broke builds once go.mod required >= 1.26.6 (GOTOOLCHAIN=local). Using go-version-file keeps CI on exactly the toolchain go.mod asks for, which Renovate already keeps current. --- .gitea/workflows/ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index e4264ad..7728d3c 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v7 with: - go-version: 'stable' + go-version-file: go.mod - name: Run tests run: go test -race -coverprofile=coverage.txt ./... @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-go@v7 with: - go-version: 'stable' + go-version-file: go.mod - name: Check vulnerabilities run: | go install golang.org/x/vuln/cmd/govulncheck@latest