Skip to content

ci go improvements #1631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
flavio wants to merge 4 commits into
base: main
Choose a base branch
from
Open

ci go improvements #1631

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3369439
ci(govulncheck): small improvements
flavio Apr 2, 2026
82ad53f
ci(golang): use go version specified inside of `go.mod`
flavio Apr 2, 2026
b0d018d
ci: fix govulncheck GHA
flavio Apr 9, 2026
f70bb67
ci: cleanup of govulncheck
flavio Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 4 additions & 8 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,8 +137,7 @@ jobs:
persist-credentials: false
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "1.26"
check-latest: true # Always check for the latest patch release
go-version-file: "go.mod"
- run: make test-go
Comment on lines 138 to 141
Copy link

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/setup-go is now driven by go.mod, but this step no longer sets check-latest: true. That can lead to CI running a different (and potentially older) Go patch level than other workflows (e.g. govulncheck still forces the latest patch). Consider re-adding check-latest: true here (or alternatively pin via a toolchain go1.x.y directive in go.mod if you want deterministic patch selection).

Copilot uses AI. Check for mistakes.
- name: Upload Go test coverage to Codecov
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
Expand All @@ -161,8 +160,7 @@ jobs:
persist-credentials: false
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "1.26"
check-latest: true # Always check for the latest patch release
go-version-file: "go.mod"
Copy link

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This setup-go invocation switched to go-version-file, but dropped check-latest: true. If the intent is still “latest patch for the declared Go version”, re-add check-latest: true so e2e tests don’t run against a different patch than other Go jobs.

Suggested change
go-version-file: "go.mod"
go-version-file: "go.mod"
check-latest: true

Copilot uses AI. Check for mistakes.
- run: make test-e2e

golangci:
Expand All @@ -176,8 +174,7 @@ jobs:
persist-credentials: false
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "1.26"
check-latest: true # Always check for the latest patch release
go-version-file: "go.mod"
- name: golangci-lint
Comment on lines 175 to 178
Copy link

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as other Go jobs: after switching to go-version-file, check-latest: true was removed. Unless you intentionally want to test an older cached patch, re-add check-latest: true to keep linting aligned with the patch level used elsewhere.

Copilot uses AI. Check for mistakes.
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
with:
Expand Down Expand Up @@ -478,8 +475,7 @@ jobs:
persist-credentials: false
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "1.26"
check-latest: true
go-version-file: "go.mod"
Copy link

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This job also switched to go-version-file without check-latest: true. If the goal is “use Go version from go.mod but always get the newest patch”, add check-latest: true here to avoid running controller-gen/manifests generation on a different patch level than other Go checks.

Suggested change
go-version-file: "go.mod"
go-version-file: "go.mod"
check-latest: true

Copilot uses AI. Check for mistakes.
- run: |
make check-generate

Expand Down
13 changes: 9 additions & 4 deletions .github/workflows/govulncheck.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ on:
push:
paths:
- go.sum
- go.mod
schedule:
- cron: "0 0 * * *"

Expand All @@ -14,12 +15,16 @@ jobs:
name: govulncheck
runs-on: ubuntu-latest
steps:
- name: Install Golang
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
# checkout the source, required to have `go.mod`
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
go-version: "1.26"
check-latest: true # Always check for the latest patch release
fetch-depth: 0
persist-credentials: false
- name: govulncheck
uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
with:
# required to override the default value that is 'stable'
# in this way `go-version-file` is going to be taken into account
go-version-input: ""
go-version-file: "go.mod"
Comment on lines +28 to +29
Copy link
Copy Markdown
Member

@jvanz jvanz Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would include the input to disable patch version updates

https://github.com/golang/govulncheck-action/blob/31f7c5463448f83528bd771c2d978d940080c9fd/action.yml#L8-L11

go-package: ./...
Loading