ci: bump pinned actions to current majors and go to 1.26.5 - #10
Merged
Conversation
The pinned action versions had drifted apart across the org; this pins each to the major that is current today. go.mod follows the fleet to 1.26.5, which CI picks up through go-version-file.
The upstream install.sh picks the .sbom.json checksum on v2.12.x releases and fails verification; go install resolves through the module checksum database instead, and drops the dependency on a script fetched from a moving branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of an org-wide CI/CD refresh: pinned action versions had drifted apart across repos (checkout on v4/v5/v6, upload-artifact on v4/v6/v7), and the Go pin lagged behind the fleet.
Actions
Each target is the current
latestrelease major, read fromgh api repos/<action>/releases/latestrather than assumed. The exact set bumped here is in the diff.Go
go.mod→ 1.26.5. Every workflow resolves the toolchain throughgo-version-file: go.mod, so this single edit moves CI too.The repo-set
go.workmoves to 1.26.5 in the same sweep (it lives outside any repo, so it is not part of this PR) — a module may not declare a newer Go than the workspace that uses it.Gates
go build ./...andgo test ./...green locally on go1.26.5.