Skip to content

ci: source the Go version from go.mod in copilot-setup-steps#93

Merged
devantler merged 1 commit into
mainfrom
claude/ci-copilot-go-version-from-gomod
Jun 7, 2026
Merged

ci: source the Go version from go.mod in copilot-setup-steps#93
devantler merged 1 commit into
mainfrom
claude/ci-copilot-go-version-from-gomod

Conversation

@devantler

@devantler devantler commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

🤖 Generated by the Daily AI Assistant

Problem

.github/workflows/copilot-setup-steps.yml hardcodes the Go toolchain:

      - name: Set up Go
        uses: actions/setup-go@… # v6.4.0
        with:
          go-version: "1.25.1"

…but go.mod declares go 1.25.10, so the Copilot setup environment runs an
older Go than the module floor. AGENTS.md is explicit that go.mod is "the
single source of truth, so it never drifts" — yet this workflow has drifted
(1.25.1 < 1.25.10), and as a template the stale pin propagates to every
scaffolded project's Copilot environment.

cd.yaml already does this correctly and documents exactly why:

          # Track the go.mod floor so the release toolchain never drifts below it
          go-version-file: go.mod

Fix

Use go-version-file: go.mod in copilot-setup-steps.yml, matching cd.yaml.
The Copilot toolchain now tracks the module floor automatically and can never
drift again. One-line change (plus a short comment).

Validation

  • actionlint .github/workflows/copilot-setup-steps.yml → clean.
  • go-version-file is supported by actions/setup-go v6 (already relied on in
    cd.yaml).

@devantler @claude
ci: source the Go version from go.mod in copilot-setup-steps
b8e8d02 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented Jun 7, 2026

Copy link
Copy Markdown

✅MegaLinter analysis: Success

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 6 0 0 0.31s
✅ ACTION zizmor 6 0 0 0 1.2s
✅ COPYPASTE jscpd yes no no 0.86s
✅ EDITORCONFIG editorconfig-checker 28 0 0 0.06s
✅ GO golangci-lint yes yes no no 19.98s
✅ JSON jsonlint 1 0 0 0.42s
✅ JSON prettier 1 0 0 0 0.54s
✅ JSON v8r 1 0 0 2.32s
✅ MARKDOWN markdownlint 5 0 0 0 1.18s
✅ MARKDOWN markdown-table-formatter 5 0 0 0 0.29s
✅ REPOSITORY checkov yes no no 27.18s
✅ REPOSITORY gitleaks yes no no 0.12s
✅ REPOSITORY git_diff yes no no 0.01s
✅ REPOSITORY grype yes no no 58.38s
✅ REPOSITORY osv-scanner yes no no 1.9s
✅ REPOSITORY secretlint yes no no 1.27s
✅ REPOSITORY syft yes no no 2.36s
✅ REPOSITORY trivy yes no no 11.79s
✅ REPOSITORY trivy-sbom yes no no 0.18s
✅ REPOSITORY trufflehog yes no no 3.38s
✅ SPELL lychee 16 0 0 0.9s
✅ YAML prettier 10 0 0 0 0.64s
✅ YAML v8r 10 0 0 12.68s
✅ YAML yamllint 10 0 0 0.65s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

@devantler

devantler commented Jun 7, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Daily AI Assistant

CI note (not caused by this change): the copilot-setup-steps check is red
on an upstream golangci-lint issue, unrelated to this one-line go-version
edit. The failing step is Install golangci-lint
(curl … golangci-lint/install.sh | sh -s -- latest), where the install
script's expected checksum no longer matches the actual golangci-lint v2.12.2 linux-amd64 asset:

err hash_sha256_verify checksum for 'golangci-lint-2.12.2-linux-amd64.tar.gz' did not verify
fd3a137c…  vs  8df580d2…   (expected)

The mismatch is deterministic (identical hashes across two runs), so it is
not transient CDN corruption — it's an upstream packaging/checksum problem in
the golangci-lint latest install path, and it would fail on main (or any PR
touching this workflow) regardless of this change.

The step this PR actually affects — Set up Go — succeeds with
go-version-file: go.mod. The required CI - Required Checks aggregator is
green (the required golangci-lint lint runs via the reusable validate workflow,
not this install.sh latest path).

Recommend tracking the golangci-lint install-checksum failure separately
(pin a known-good golangci-lint version in copilot-setup-steps.yml, or wait
for upstream to republish v2.12.2). This PR stands on its own.

@devantler devantler marked this pull request as ready for review June 7, 2026 14:54
@devantler devantler merged commit d9906d0 into main Jun 7, 2026
17 of 20 checks passed
@devantler devantler deleted the claude/ci-copilot-go-version-from-gomod branch June 7, 2026 16:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@devantler