Add go-version-file-behavior input

By default an exact version read from go-version-file is used as
written, so a "go 1.22.0" directive pins CI to the oldest patch
release of the minor even when newer patches with security fixes
exist. Dependencies can force such an exact version into go.mod.

Setting go-version-file-behavior to latest-patch widens an exact
major.minor.patch version into a ~X.Y.Z range, resolving the newest
available patch release of the same minor while keeping the file's
version as a floor. Bare minors and prereleases pass through
unchanged. The default behavior (exact) is unchanged.

src/installer.ts

@@ -672,6 +672,18 @@ export function parseGoVersionFile(versionFilePath: string): string {
   return contents.trim();
 }
 
+// Widen an exact version from a version file into a semver range matching
+// the newest patch release of the same minor (go-version-file-behavior:
+// latest-patch). Only exact major.minor.patch versions are widened: bare
+// minors like '1.22' already resolve to the newest patch, and prereleases
+// like '1.21rc2' have no patch series to float within.
+export function latestPatchSpec(version: string): string {
+  if (!/^\d+\.\d+\.\d+$/.test(version)) {
+    return version;
+  }
+  return `~${version}`;
+}
+
 async function resolveStableVersionDist(
   versionSpec: string,
   arch: Architecture

src/main.ts

@@ -173,6 +173,21 @@ function resolveVersionInput(): string {
       );
     }
     version = installer.parseGoVersionFile(versionFilePath);
+
+    const behavior = core.getInput('go-version-file-behavior') || 'exact';
+    if (behavior === 'latest-patch') {
+      const spec = installer.latestPatchSpec(version);
+      if (spec !== version) {
+        core.info(
+          `Using latest patch release satisfying ${spec} (version file specifies ${version})`
+        );
+        version = spec;
+      }
+    } else if (behavior !== 'exact') {
+      throw new Error(
+        `Invalid go-version-file-behavior: '${behavior}'. Supported values: 'exact', 'latest-patch'`
+      );
+    }
   }
 
   return version;