Repository navigation
chore(deps): bump actions/setup-go from 4 to 6 - #717
Merged
Merged
Conversation
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 6. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v4...v6) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
- verdict.jq: if each PR finding of a list check (actionlint, golangci-lint, prettier, actions-pinning, npm ls) also occurs on base, the failure is pre-existing. Before, a PR that removed one actionlint finding got a block (#717, #721). - golangci-lint: run with --allow-parallel-runners. A non-zero exit with no finding is incomplete, not a failure with 0 findings. - ui-npm-ci: take the conflict from npm error lines only. An npm warn line named the wrong peer on #729. - deps.py: a package that already had an install script on base adds no new script (esbuild on #779). - ui-dep-usage: join package names with "and". - pr-state: for a conflicting PR, do not say that the checks ran on the PR merged into main. - verify.sh: save the baseline profile. --phase generated and --phase render use it instead of the default profile. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
- classify.sh: when workflows pin an action at several old refs, record each ref that the PR replaces. The old version is the lowest of them. Before, #718 compared release-secrets v1.2.0 with itself, and #717 compared only setup-go v5 with v6. - actions_analysis.py: compare each replaced ref with the new ref. An output or input counts as removed only if an old action.yml declared it. release-please-action declares no outputs and sets them at run time, which gave a false block on #722. - actions-coverage.sh: read fields with the unit separator. Tab is IFS whitespace, so empty fields collapsed and shifted the runtime into the wrong field (#717, #721). Show a missing default as "none". Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
New fixtures: #717 safe-to-merge (setup-go from v4 and v5), #718 compares release-secrets v1.0.1 with v1.2.0, #721 needs-human with the python-version question, #722 needs-human (not block), and #779 block with the undisclosed updates and no esbuild question. The #831 fixture expects the new wording. The impact-review copies drop notes about the old verifier bugs. replay.sh supports pr_meta, decisions_exclude, and updates expectations. run.sh adds 16 unit tests with stub tools: the findings subset rule, golangci-lint lock contention, npm warn lines, install scripts on base, pr-disclosure, pr-state wording, classify with mixed refs, and actions-coverage with a stub gh. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
2 of 3 tasks
Dependency verification: SAFE TO MERGERisk tier high · ecosystems: github-actions · head Every required check ran and passed. No decision is necessary. Updates
What the verifier checked
Already failing on
|
| Check | Kind | Base | PR | Outcome |
|---|---|---|---|---|
| setup-go selects Go only from the go directive in go.mod | guard | pass | pass | holds on both |
Impact review
actions/setup-go moves from v4 (go.yml) and v5 (dependency-scan.yml) to v6. v5 moved to the node20 runtime, changed the cache service, and added the architecture to the cache key. v6 moves to node24, needs runner v2.327.1 or later, and prefers a go.mod toolchain directive when it selects Go. ldcli passes only go-version-file: go.mod, and go.mod has 'go 1.25' with no toolchain directive, so v6 selects the same Go. Both workflows run on PR CI on ubuntu-latest, and all 9 CI checks pass on the PR head.
- actions/setup-go v4..v6: v5.0.0: node20 runtime. v5.1.0: architecture in the cache key (old cache keys stop matching). v5.3.0: new cache service (
@actions/cache4). v6.0.0: improved toolchain selection (Improve toolchain handling actions/setup-go#460, breaking), node24 runtime, runner v2.327.1 or later. (breaking) (source) - Used in:
.github/workflows/go.yml,.github/workflows/dependency-scan.yml - Upstream behavior changes that reach ldcli: no
- Note: The breaking toolchain change (Improve toolchain handling actions/setup-go#460) has no effect: go.mod has no toolchain directive, and each setup-go step passes only go-version-file: go.mod (guard). The cache-key change invalidates the Go cache one time. (Improve toolchain handling actions/setup-go#460, generated/setup-go-inputs-resolve-same-go.sh)
- Note: PR CI runs both workflows. GitHub-hosted ubuntu-latest runners meet the v2.327.1 minimum, and the 9 CI checks on the PR head pass with v6. No composite action in .github/actions uses setup-go. (state/checks/ci-status, state/checks/actions-coverage)
Check details
pr-state
- Branch is 51 commit(s) behind
main. The checks ran on the PR merged into the currentmain.
ci-status
- CI results are for the PR head
c3c375aas pushed, which may be behind the base branch.
upstream-changes
actions/setup-gov4 → v6: actions/setup-go, 75 commits, 102 files, notes: release notes, full range, mentions: breaking (1), security (1), deprecation (1), requirements (4)
actionlint
.github/workflows/go.yml:29:13: the runner of "actions/setup-python@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue [action]
.github/workflows/release-please.yml:60:14: label "ubuntu-22.04-8core-32gb" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file [runner-label]
actions-coverage
| Action | Change | Used in | Runs on PR CI? | Upstream action.yml |
|---|---|---|---|---|
actions/setup-go |
v4, v5 → v6 | .github/workflows/dependency-scan.yml, .github/workflows/go.yml | yes | inputs used: go-version-file; outputs read: none; runtime node16, node20 → node24 |
generated: setup-go-inputs-resolve-same-go
go.mod: go 1.25, no toolchain directive. Every setup-go step passes only go-version-file: go.mod.
Generated by scripts/dependency-pr/verify.sh (profile full) at 2026-10-06T22:07:41Z. The verifier does not approve or merge.
ld-ahartmann
approved these changes
Oct 8, 2026
cursor Bot
pushed a commit
that referenced
this pull request
Oct 13, 2026
… head The status-check rollup does not show a workflow run that failed before any job started, or a run that waits in the queue. On #717, ci-status counted only Bugbot, Semgrep, and the bot-oversight check, and passed. The Go and dev-server UI runs had failed with 0 jobs, and Dependency Scan was still queued. ci-status now finds the workflows whose triggers match the PR (event, branch, activity types, and path filters). It compares them with the runs on the head commit. A missing, queued, in-progress, startup-failure, or 0-job run is incomplete. A result for another commit counts as not run. ci-status is now a required check, so incomplete CI gives an incomplete verdict. Co-authored-by: rniebla <rniebla@launchdarkly.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/setup-go from 4 to 6.
Release notes
Sourced from actions/setup-go's releases.
... (truncated)
Commits
4a36011docs: fix Microsoft build of Go link (#734)8f19afcfeat: add go-download-base-url input for custom Go distributions (#721)27fdb26Bump minimatch from 3.1.2 to 3.1.5 (#727)def8c39Rearrange README.md, add advanced-usage.md (#724)4b73464Fix golang download url to go.dev (#469)a5f9b05Update default Go module caching to use go.mod (#705)7a3fe6cBump qs from 6.14.0 to 6.14.1 (#703)b9adafdBump actions/checkout from 5 to 6 (#686)d73f6bcREADME.md: correct to actions/checkout@v6 (#683)ae252eeBump@actions/cacheto v5 (#695)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Overview
Updates GitHub Actions to use
actions/setup-go@v6in the Dependency Scan (generate-go-sbom) and Go build jobs, replacing v5 and v4 respectively.go-version-file: go.modis unchanged, so the Go version installed in CI should still follow the module pin; the main effect is adopting setup-go v6’s toolchain and runner behavior (including its Node 24 runtime and stricter toolchain handling per upstream release notes).Reviewed by Cursor Bugbot for commit f79c4a0. Bugbot is set up for automated code reviews on this repo. Configure here.