Skip to content

ci: switch to custom setup-go action in windows #15623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kruskall merged 4 commits into from
Feb 13, 2025
Merged

ci: switch to custom setup-go action in windows #15623

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
71c802f
ci: update GOCACHE vars on windows runner to improve performance
kruskall Feb 7, 2025
e45460c
Update ci.yml
kruskall Feb 10, 2025
841e544
Merge branch 'main' into ci/update-gocache-vars
kruskall Feb 10, 2025
5e318d6
Merge branch 'main' into ci/update-gocache-vars
kruskall Feb 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,13 @@ jobs:
runs-on: ${{ matrix.os }}
steps:
- uses: actions/checkout@v4
- uses: antontroshin/setup-go@bda02de8887c9946189f81e7e59512914aeb9ea4
Copy link
Member

@v1v v1v Feb 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To play safe, this is a fork commit, and somehow I feel we could raise the fix to the upstream maybe, instead of using the fork from someone else.

I understand the benefits, but I'm a bit concerned about opening this

Copy link
Member

@v1v v1v Feb 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OTOH, we are using permissions: contents: read by default. But according to our guideline, we need to be cautious to use third-party actions.

Copy link
Member Author

@kruskall kruskall Feb 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there's already a PR open for it upstream, the action is from that PR 😭

See actions/setup-go#515

OTOH, we are using permissions: contents: read by default. But according to our guideline, we need to be cautious to use third-party actions.

fully agree with this. I pinned the action to a commit to avoid tampering. It should be enough to avoid such issues. WDYT ?

Copy link
Member

@v1v v1v Feb 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can give a go; the only thing could be the one whether the commit vanished

if: runner.os == 'Windows'
with:
go-version-file: go.mod
cache: true
- uses: actions/setup-go@v5
if: runner.os != 'Windows'
with:
go-version-file: go.mod
cache: true
Expand Down
Loading