Add go-version-file-behavior input

By default an exact version read from go-version-file is used as
written, so a "go 1.22.0" directive pins CI to the oldest patch
release of the minor even when newer patches with security fixes
exist. Dependencies can force such an exact version into go.mod.

Setting go-version-file-behavior to latest-patch widens an exact
major.minor.patch version into a ~X.Y.Z range, resolving the newest
available patch release of the same minor while keeping the file's
version as a floor. Bare minors and prereleases pass through
unchanged. The default behavior (exact) is unchanged.
This commit is contained in:
John Maguire 2026-08-18 11:35:13 -04:00
commit 71b6f8926f
7 changed files with 168 additions and 0 deletions

View file

@ -44,6 +44,11 @@ See [action.yml](action.yml).
# Note: if both go-version and go-version-file are provided, go-version takes precedence.
go-version-file: 'go.mod'
# How to interpret an exact version read from go-version-file.
# Set to latest-patch to use the newest patch release of the same minor version.
# Default: exact
go-version-file-behavior: 'exact'
# Set this option if you want the action to check for the latest available version
# Default: false
check-latest: false