unboundsoftware/cron-checker
6
0
Fork 0
Code Issues 1 Pull Requests 1 Actions 2 Packages Projects Releases 32 Activity

ci: derive Go version from go.mod instead of 'stable' #397

Merged
argoyle merged 3 commits from fix/ci-go-version-from-gomod into main 2026-08-17 08:24:31 +00:00
Conversation 0 Commits 3 Files Changed 3
+4 -4
argoyle commented 2026-08-17 06:24:34 +00:00
Owner
Copy Link
Copy Source

Root cause of the failing vulnerabilities and test jobs on the open Renovate PRs.

actions/setup-go resolves go-version: stable from the actions/go-versions manifest. On 2026-08-14 that manifest still pointed at go1.26.5, which carries 4 stdlib vulnerabilities (GO-2026-6218, GO-2026-6090, GO-2026-5972, GO-2026-5026), so govulncheck failed. It also broke the test job on #396 once go.mod required go >= 1.26.6, since setup-go sets GOTOOLCHAIN=local.

Switching to go-version-file: go.mod makes CI install exactly the toolchain go.mod declares. Renovate already tracks that directive (#395), so the Go version stops depending on manifest publishing lag.

After this lands, #394 / #395 / #396 should be rebased and re-run.

Root cause of the failing `vulnerabilities` and `test` jobs on the open Renovate PRs. `actions/setup-go` resolves `go-version: stable` from the `actions/go-versions` manifest. On 2026-08-14 that manifest still pointed at **go1.26.5**, which carries 4 stdlib vulnerabilities (GO-2026-6218, GO-2026-6090, GO-2026-5972, GO-2026-5026), so `govulncheck` failed. It also broke the `test` job on #396 once go.mod required `go >= 1.26.6`, since setup-go sets `GOTOOLCHAIN=local`. Switching to `go-version-file: go.mod` makes CI install exactly the toolchain go.mod declares. Renovate already tracks that directive (#395), so the Go version stops depending on manifest publishing lag. After this lands, #394 / #395 / #396 should be rebased and re-run.
argoyle added 1 commit 2026-08-17 06:24:36 +00:00
ci: derive Go version from go.mod instead of 'stable'
cron-checker / test (push) Skipped
cron-checker / vulnerabilities (push) Skipped
cron-checker / build (push) Skipped
cron-checker / vulnerabilities (pull_request) Failing after 1m11s
Details
cron-checker / test (pull_request) Successful in 1m35s
Details
cron-checker / build (pull_request) Skipped
Details
ac49f3c2a6 
actions/setup-go resolves 'stable' from the go-versions manifest, which lagged behind the go1.26.6 security release and installed the vulnerable go1.26.5. That both failed govulncheck and broke builds once go.mod required >= 1.26.6 (GOTOOLCHAIN=local).

Using go-version-file keeps CI on exactly the toolchain go.mod asks for, which Renovate already keeps current.
argoyle closed this pull request 2026-08-17 08:08:16 +00:00
argoyle reopened this pull request 2026-08-17 08:08:17 +00:00
argoyle merged commit 7c0445b4ef into main 2026-08-17 08:24:31 +00:00
argoyle deleted branch fix/ci-go-version-from-gomod 2026-08-17 08:24:33 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
go
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
acctest (Shiny Acctest) argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unboundsoftware/cron-checker#397