feat(setup-go): opt-in private-modules for unvendored private Go fetch - #29
Merged
Conversation
Add a `private-modules` input (default false) to the setup-go composite. When true it mints a short-lived, read-only pinpredict-argocd App token (from private-modules-app-id / private-modules-app-private-key) and configures git — a scheme-scoped `insteadOf` for github.com/pinpredict/ — plus GOPRIVATE, so `go`, `golangci-lint`, and `goreleaser` fetch a private pinpredict module (e.g. github.com/pinpredict/ppkit) over HTTPS instead of failing on the public proxy. This is the non-Docker analogue of docker-release.yml's `private-modules` BuildKit secret, for standalone Go repos (k4a) that build binaries rather than images and don't want to commit a vendor/ tree. Default false keeps this a no-op for every existing caller — the token step is skipped and no git rewrite happens. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
private-modulesopt-in to the setup-go composite — the non-Docker analogue of theprivate-modulesBuildKit secret added todocker-release.ymlin #26. For standalone Go repos (e.g. k4a) that build binaries, not images, and want to fetch a private pinpredict module (github.com/pinpredict/ppkit,tuikit) in CI instead of committing avendor/tree.When
private-modules: true, the composite:pinpredict-argocdApp token (actions/create-github-app-token@v1,owner: pinpredict,permission-contents: read) from theBOOTSTRAP_APP_ID/BOOTSTRAP_APP_PRIVATE_KEYinputs;git config --global url."…@github.com/pinpredict/".insteadOf "https://github.com/pinpredict/"andGOPRIVATE=github.com/pinpredict/*, sogo/golangci-lint/goreleaserfetch privately over HTTPS.Default false → no-op for every existing caller (covenant, service-template, …): the token step is skipped and no git rewrite happens.
First consumer will be k4a (un-vendoring ppkit+tuikit) in a follow-up PR pinned to
@main.🤖 Generated with Claude Code