setup-go does not pick up recent Go version leading to create vulnerable builds about setup-go

[dusan-trickovic]

Hello, @szuecs! Thank you for creating this issue, we will investigate it further and see what can be done :)

[dmitry-shibanov]

Hello everyone. For now I'm going to close the issue because the behaviour of the action was described in the comment. The toolcache directory is updated during new images rollout and you can use check-latest: true to install Go from go-versions repository.

[dsame]

hello @szuecs ,

This is expected behaviour. According to the README

The action will first check the local cache for a version match. If a version is not found locally ...

Checking for the other path versions would have unacceptably slowed down the builds. However, if it is critical to check setup-go for the most recent version, use the check-latest input.

Alternatively, it is possible to set the desired version with the go-version input.

Did it help?

[szuecs]

@dsame the unexpected thing is the ttl. I would expect that either on change caches are invalidated or every time duration like every hour or every day.

My example showed 1.21 and recent version was 1.23 so there are weeks in between....

[adamdecaf]

Is there something we could do to help get go-versions updated more often? We see this with every release.

Example: actions/go-versions#94 is g2g but hasn't been merged yet.

[adamdecaf]

Is there anything we can do to help merge PR's to go-versions? At $day_job we've had build failures for a few hours while waiting on a merge to go-versions. go-versions also does not have an issue tracker, so that's why I'm replying here.