Add go-version-file-behavior input

By default an exact version read from go-version-file is used as
written, so a "go 1.22.0" directive pins CI to the oldest patch
release of the minor even when newer patches with security fixes
exist. Dependencies can force such an exact version into go.mod.

Setting go-version-file-behavior to latest-patch widens an exact
major.minor.patch version into a ~X.Y.Z range, resolving the newest
available patch release of the same minor while keeping the file's
version as a floor. Bare minors and prereleases pass through
unchanged. The default behavior (exact) is unchanged.
This commit is contained in:
John Maguire 2026-08-18 11:35:13 -04:00
commit 71b6f8926f
7 changed files with 168 additions and 0 deletions

22
dist/setup/index.js vendored
View file

@ -43581,6 +43581,17 @@ function parseGoVersionFile(versionFilePath) {
}
return contents.trim();
}
// Widen an exact version from a version file into a semver range matching
// the newest patch release of the same minor (go-version-file-behavior:
// latest-patch). Only exact major.minor.patch versions are widened: bare
// minors like '1.22' already resolve to the newest patch, and prereleases
// like '1.21rc2' have no patch series to float within.
function latestPatchSpec(version) {
if (!/^\d+\.\d+\.\d+$/.test(version)) {
return version;
}
return `~${version}`;
}
async function resolveStableVersionDist(versionSpec, arch) {
const archFilter = getArch(arch);
const platFilter = getPlatform();
@ -100360,6 +100371,17 @@ function resolveVersionInput() {
throw new Error(`The specified go version file at: ${versionFilePath} does not exist`);
}
version = parseGoVersionFile(versionFilePath);
const behavior = getInput('go-version-file-behavior') || 'exact';
if (behavior === 'latest-patch') {
const spec = latestPatchSpec(version);
if (spec !== version) {
core_info(`Using latest patch release satisfying ${spec} (version file specifies ${version})`);
version = spec;
}
}
else if (behavior !== 'exact') {
throw new Error(`Invalid go-version-file-behavior: '${behavior}'. Supported values: 'exact', 'latest-patch'`);
}
}
return version;
}