Add go-version-file-behavior input

By default an exact version read from go-version-file is used as
written, so a "go 1.22.0" directive pins CI to the oldest patch
release of the minor even when newer patches with security fixes
exist. Dependencies can force such an exact version into go.mod.

Setting go-version-file-behavior to latest-patch widens an exact
major.minor.patch version into a ~X.Y.Z range, resolving the newest
available patch release of the same minor while keeping the file's
version as a floor. Bare minors and prereleases pass through
unchanged. The default behavior (exact) is unchanged.
This commit is contained in:
John Maguire 2026-08-18 11:35:13 -04:00
commit 71b6f8926f
7 changed files with 168 additions and 0 deletions

View file

@ -6,6 +6,9 @@ inputs:
description: 'The Go version to download (if necessary) and use. Supports semver spec and ranges. Be sure to enclose this option in single quotation marks.'
go-version-file:
description: 'Path to the go.mod, go.work, .go-version, or .tool-versions file.'
go-version-file-behavior:
description: 'How to interpret an exact version read from go-version-file. Use "latest-patch" to resolve the newest available patch release of the same minor version (e.g. "1.22.0" in go.mod resolves to the newest 1.22.x). Defaults to "exact", which uses the version as written.'
default: exact
check-latest:
description: 'Set this option to true if you want the action to always check for the latest available version that satisfies the version spec'
default: false