From 5e6b5a2714564f9422420d83384c95857d2ebe35 Mon Sep 17 00:00:00 2001 From: Rex Raphael Date: Mon, 17 Aug 2026 11:55:38 -0500 Subject: [PATCH] fix(go-ci): resolve a bare Go minor to the newest patch setup-go matches a bare minor against the runner's toolcache before it looks for anything newer, so '1.26' kept resolving to a cached 1.26.5 well after 1.26.6 shipped. That failed govulncheck in a caller on 7 standard-library advisories the newer patch already fixed. Callers could pin a patch instead, but the matrix job name embeds the version string, and a branch ruleset requiring 'Test (ubuntu-latest, go1.26)' can never report once the name changes. check-latest keeps the name and the coverage gate's primary-version comparison intact while still picking up the fix. --- .github/workflows/go-ci.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml index bf02133..76f81c9 100644 --- a/.github/workflows/go-ci.yml +++ b/.github/workflows/go-ci.yml @@ -129,6 +129,10 @@ jobs: uses: actions/setup-go@v7 with: go-version: ${{ matrix.go-version }} + # Resolve a bare minor (e.g. "1.26") to the newest patch instead of whatever + # the runner toolcache happens to hold, which otherwise pins security scans to + # a stale, vulnerable Go. + check-latest: true cache-dependency-path: ${{ inputs.working-directory }}/go.mod - name: Set up Node.js @@ -263,6 +267,10 @@ jobs: uses: actions/setup-go@v7 with: go-version: ${{ needs.setup.outputs.primary-go-version }} + # Resolve a bare minor (e.g. "1.26") to the newest patch instead of whatever + # the runner toolcache happens to hold, which otherwise pins security scans to + # a stale, vulnerable Go. + check-latest: true cache-dependency-path: ${{ inputs.working-directory }}/go.mod - name: Run golangci-lint @@ -291,6 +299,10 @@ jobs: uses: actions/setup-go@v7 with: go-version: ${{ needs.setup.outputs.primary-go-version }} + # Resolve a bare minor (e.g. "1.26") to the newest patch instead of whatever + # the runner toolcache happens to hold, which otherwise pins security scans to + # a stale, vulnerable Go. + check-latest: true cache-dependency-path: ${{ inputs.working-directory }}/go.mod - name: Check formatting @@ -354,6 +366,10 @@ jobs: uses: actions/setup-go@v7 with: go-version: ${{ needs.setup.outputs.primary-go-version }} + # Resolve a bare minor (e.g. "1.26") to the newest patch instead of whatever + # the runner toolcache happens to hold, which otherwise pins security scans to + # a stale, vulnerable Go. + check-latest: true cache-dependency-path: ${{ inputs.working-directory }}/go.mod - name: Run gosec