ci go improvements by flavio · Pull Request #1631 · kubewarden/kubewarden-controller

flavio · 2026-04-02T10:38:05Z

This PR does some improvements to some GHA that deal with Go.

We now install the same version of go that is mentioned inside of the go.mod file. Moreover, we intruct govulncheck to look also at the go.mod.

Copilot

Pull request overview

This PR updates GitHub Actions workflows for Go to derive the Go toolchain version from go.mod and ensures the govulncheck workflow also runs when go.mod changes.

Changes:

Update govulncheck workflow triggers to include go.mod changes.
Switch Go installation in govulncheck and CI jobs from a hard-coded version to go-version-file: go.mod.
Remove check-latest: true from Go setup steps in the main CI workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/govulncheck.yml	Trigger govulncheck on `go.mod` changes and install Go based on `go.mod`.
.github/workflows/ci.yml	Install Go based on `go.mod` across Go-related CI jobs (tests/lint/manifests).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-02T10:40:56Z

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
-          go-version: "1.26"
-          check-latest: true # Always check for the latest patch release
+          go-version-file: "go.mod"
      - run: make test-go


actions/setup-go is now driven by go.mod, but this step no longer sets check-latest: true. That can lead to CI running a different (and potentially older) Go patch level than other workflows (e.g. govulncheck still forces the latest patch). Consider re-adding check-latest: true here (or alternatively pin via a toolchain go1.x.y directive in go.mod if you want deterministic patch selection).

Copilot · 2026-04-02T10:40:56Z

        with:
-          go-version: "1.26"
-          check-latest: true # Always check for the latest patch release
+          go-version-file: "go.mod"


This setup-go invocation switched to go-version-file, but dropped check-latest: true. If the intent is still “latest patch for the declared Go version”, re-add check-latest: true so e2e tests don’t run against a different patch than other Go jobs.

Suggested change

go-version-file: "go.mod"

go-version-file: "go.mod"

check-latest: true

Copilot · 2026-04-02T10:40:56Z

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
-          go-version: "1.26"
-          check-latest: true # Always check for the latest patch release
+          go-version-file: "go.mod"
      - name: golangci-lint


Same as other Go jobs: after switching to go-version-file, check-latest: true was removed. Unless you intentionally want to test an older cached patch, re-add check-latest: true to keep linting aligned with the patch level used elsewhere.

Copilot · 2026-04-02T10:40:56Z

        with:
-          go-version: "1.26"
-          check-latest: true
+          go-version-file: "go.mod"


This job also switched to go-version-file without check-latest: true. If the goal is “use Go version from go.mod but always get the newest patch”, add check-latest: true here to avoid running controller-gen/manifests generation on a different patch level than other Go checks.

Suggested change

go-version-file: "go.mod"

go-version-file: "go.mod"

check-latest: true

viccuad

Oh, this is nice. We should do the same for the policies repos.

I'm ok with removing check-latest: true, I prefer to pin the version from go.mod.

codecov · 2026-04-02T11:05:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.46%. Comparing base (2a6b879) to head (f70bb67).
⚠️ Report is 33 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1631      +/-   ##
==========================================
- Coverage   80.48%   80.46%   -0.03%     
==========================================
  Files         127      127              
  Lines       16411    16411              
==========================================
- Hits        13209    13205       -4     
- Misses       3202     3206       +4

Flag	Coverage Δ
rust-tests	`80.46% <ø> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

jvanz · 2026-04-02T12:04:11Z

-          go-version: "1.26"
+          go-version-file: "go.mod"


We do not need this step. govulncheck-action already install go. You can define the go.mod file in its inputs as well

Considering the action has the check-latest as true by default. I suspect that means the go lang version will be update under the hood. That's what copilot is warning us. Therefore, I would say to remove the setup-go step here and move this configuration to the govulncheck-action instead.

I think I need to remove the chack-latest, then the govulncheck is going to use the version cached by this step (hence the one we have inside of go.mod:

The precedence for inputs go-version-input, go-version-file, check-latest, cache, and cache-dependency-path specifying Go version and caches is inherited from actions/setup-go

From the README of the project.

What do you think?

Ah, I just saw the check-latest in this setup-go action. But I think you cannot remove the input. Actually, we need to keep the go version configuration in sync with the govulncheck input values. Otherwise, you will install a go version here and govulncheck may update the version before run.

jvanz

I think we need to do a little change. See my comment in the govulncheck.yml file

Check also `go.mod`, plus use the same version of go mentioned inside of `go.mod`. Signed-off-by: Flavio Castelli <fcastelli@suse.com>

Signed-off-by: Flavio Castelli <fcastelli@suse.com>

Checkout the source code to ensure `go.mod` is available. Signed-off-by: Flavio Castelli <fcastelli@suse.com>

Apply lessons learnt from sbomscanner Signed-off-by: Flavio Castelli <fcastelli@suse.com>

flavio · 2026-04-16T17:13:21Z

@jvanz ready for review again

jvanz

Thanks for the changes! But I think we need to consider the copilot comments. Just to ensure that we are run the same go version in all CI jobs. Maybe we can follow the suggestion from its first comment and define the version including the patch version.

jvanz · 2026-04-17T11:42:25Z

+          go-version-input: ""
+          go-version-file: "go.mod"


I would include the input to disable patch version updates

https://github.com/golang/govulncheck-action/blob/31f7c5463448f83528bd771c2d978d940080c9fd/action.yml#L8-L11

flavio requested a review from a team as a code owner April 2, 2026 10:38

Copilot AI review requested due to automatic review settings April 2, 2026 10:38

github-project-automation Bot added this to Kubewarden Admission Controller Apr 2, 2026

github-project-automation Bot moved this to Pending review in Kubewarden Admission Controller Apr 2, 2026

Copilot started reviewing on behalf of flavio April 2, 2026 10:38 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

viccuad approved these changes Apr 2, 2026

View reviewed changes

viccuad assigned flavio Apr 2, 2026

jvanz approved these changes Apr 2, 2026

View reviewed changes

jvanz reviewed Apr 2, 2026

View reviewed changes

jvanz requested changes Apr 2, 2026

View reviewed changes

viccuad moved this from Pending review to In Progress in Kubewarden Admission Controller Apr 7, 2026

flavio added 3 commits April 9, 2026 14:56

ci(govulncheck): small improvements

3369439

Check also `go.mod`, plus use the same version of go mentioned inside of `go.mod`. Signed-off-by: Flavio Castelli <fcastelli@suse.com>

ci(golang): use go version specified inside of go.mod

82ad53f

Signed-off-by: Flavio Castelli <fcastelli@suse.com>

ci: fix govulncheck GHA

b0d018d

Checkout the source code to ensure `go.mod` is available. Signed-off-by: Flavio Castelli <fcastelli@suse.com>

flavio force-pushed the ci-go-improvements branch from 511e050 to b0d018d Compare April 9, 2026 12:57

jvanz mentioned this pull request Apr 9, 2026

chore: update go lang used in Dockerfile to v1.26.2 #1643

Merged

ci: cleanup of govulncheck

f70bb67

Apply lessons learnt from sbomscanner Signed-off-by: Flavio Castelli <fcastelli@suse.com>

flavio moved this from In Progress to Pending review in Kubewarden Admission Controller Apr 16, 2026

jvanz requested changes Apr 17, 2026

View reviewed changes

flavio moved this from Pending review to In Progress in Kubewarden Admission Controller Apr 17, 2026

	go-version-file: "go.mod"
	go-version-file: "go.mod"
	check-latest: true

Conversation

flavio commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

viccuad left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jvanz Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

flavio Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

jvanz Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jvanz left a comment

Choose a reason for hiding this comment

Uh oh!

flavio commented Apr 16, 2026

Uh oh!

jvanz left a comment

Choose a reason for hiding this comment

Uh oh!

jvanz Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

viccuad left a comment •

edited

Loading

codecov Bot commented Apr 2, 2026 •

edited

Loading

jvanz Apr 2, 2026 •

edited

Loading