chore(ci): add workflow to automate Go version updates #1924
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add GitHub Actions workflow using StefMa/Upgrade-Go-Action to automatically check for new Go releases and create PRs to update the go directive in go.mod. This addresses the limitation that Dependabot cannot update the Go version itself (only module dependencies), which means stdlib CVEs that are fixed in newer Go patch releases are not automatically detected. Workflow runs: - Weekly on Mondays at 8am UTC - Manually via workflow_dispatch When a new Go version is available, the action will: 1. Update the go directive in go.mod 2. Run go mod tidy 3. Create a pull request with the changes Related: replicated-collab/git-guardian-kots#287 Dependabot limitation: dependabot/dependabot-core#9527
laverya
reviewed
Nov 20, 2025
Comment on lines
+20
to
+23
| - name: Check for Go updates | ||
| uses: StefMa/Upgrade-Go-Action@v1 | ||
| with: | ||
| base-branch: 'main' |
Member
There was a problem hiding this comment.
this will need a github token or else CI won't run in the generated PRs
laverya
approved these changes
Nov 20, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add automated Go version updates workflow using StefMa/Upgrade-Go-Action.
Problem: Dependabot cannot update the Go version in go.mod (dependabot/dependabot-core#9527).
Solution: Weekly workflow checks for new Go releases and creates PRs.
Related: https://github.com/replicated-collab/git-guardian-kots/issues/287