Bump actions/setup-go from 2 to 7 - #81
Conversation
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 2 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v2...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
WalkthroughThe release workflow updates its Go toolchain setup action from ChangesRelease workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish-release.yaml:
- Around line 27-29: Update the actions/setup-go step in the release workflow to
use an immutable full commit SHA instead of the mutable v7 tag, and set its
cache input to false. Preserve the existing Go version configuration and
release-job behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 76306b07-7668-47c9-9a13-0fadbef4959d
📒 Files selected for processing (1)
.github/workflows/publish-release.yaml
| uses: actions/setup-go@v7 | ||
| with: | ||
| go-version: '1.17' |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .github/workflows/publish-release.yaml
echo "---"
cat -n .github/workflows/publish-release.yaml | sed -n '1,120p'
echo "---"
python3 - <<'PY'
import urllib.request, json
url = "https://api.github.com/repos/actions/setup-go/releases/latest"
req = urllib.request.Request(url, headers={"Accept":"application/vnd.github+json","User-Agent":"code-review"})
with urllib.request.urlopen(req, timeout=20) as r:
data = json.load(r)
print("latest_release_tag:", data.get("tag_name"))
PYRepository: openshift-online/ocm-support-cli
Length of output: 7192
🌐 Web query:
actions/setup-go v7 cache default documentation
💡 Result:
In actions/setup-go v7, caching is enabled by default [1][2][3]. The action automatically manages the caching and restoration of Go modules and build outputs [1][2]. Key details regarding the default caching behavior: Default Dependency File: By default, the action uses go.mod as the dependency file to calculate the cache key [1][2]. This is a change from earlier versions that defaulted to go.sum [4][5]. Controlling Caching: - To disable caching, you can set the cache input to false (e.g., cache: false) [1][2][3]. - To use a different dependency file or to revert to using go.sum, you can specify the path using the cache-dependency-path input [1][2][3]. This input supports glob patterns if you have multiple dependency files or files located in subdirectories [1][2]. Example configuration: - uses: actions/setup-go@v7 with: go-version: '1.23' # Caching is enabled by default. To disable: # cache: false # To specify a different dependency file: # cache-dependency-path: 'go.sum'
Citations:
- 1: https://github.com/actions/setup-go
- 2: https://github.com/marketplace/actions/setup-go-environment
- 3: https://github.com/actions/setup-go/blob/main/action.yml
- 4: Update default Go module caching to use go.mod actions/setup-go#705
- 5: actions/setup-go@a5f9b05
Pin actions/setup-go and disable cache for this release job.
actions/setup-go@v7 is mutable, and v7 enables Go caching by default. Pin it to a full SHA and set cache: false unless shared cache behavior is intentional here.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 27-27: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish-release.yaml around lines 27 - 29, Update the
actions/setup-go step in the release workflow to use an immutable full commit
SHA instead of the mutable v7 tag, and set its cache input to false. Preserve
the existing Go version configuration and release-job behavior.
Sources: Path instructions, Linters/SAST tools
Bumps actions/setup-go from 2 to 7.
Release notes
Sourced from actions/setup-go's releases.
... (truncated)
Commits
b7ad1dachore(deps): bump@actions/cacheto 6.2.0 (#771)0778a10Migrate to ESM and upgrade dependencies (#763)924ae3achore: bump version to 6.5.0 in package.json and package-lock.json (#762)e91cc3bBump@actions/cacheto 5.1.0, log cache write denied (#758)4a2405echore: update@types/nodeand@typescript-eslintdependencies to latest versi...78961f6chore: update@actionsdependencies and refresh license cache (#744)4a36011docs: fix Microsoft build of Go link (#734)8f19afcfeat: add go-download-base-url input for custom Go distributions (#721)27fdb26Bump minimatch from 3.1.2 to 3.1.5 (#727)def8c39Rearrange README.md, add advanced-usage.md (#724)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit