chore(ci): bump actions/setup-go from 5.6.0 to 6.5.0#35
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-go-6.4.0
branch
9 times, most recently
from
3bce3eb to
312fc7c
Compare
|
This pull request has been automatically marked as stale due to inactivity. Please add an update or it will be closed. |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-go-6.4.0
branch
3 times, most recently
from
6094e7a to
864a2e6
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-go-6.4.0
branch
from
864a2e6 to
8af1cf5
Compare
Contributor
Dispatch
PR Context
Please review for correctness, test coverage implications, and regression risk. |
Contributor
Dispatch
PR Context
Please review for supply-chain security, action integrity, and CI/CD security implications. |
Contributor
Dispatch
PR Context
Please review for code correctness and workflow configuration accuracy. |
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-go-6.4.0
branch
2 times, most recently
from
b24f8fa to
b17d2c1
Compare
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.6.0 to 6.5.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@40f1582...924ae3a) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-go-6.4.0
branch
from
b17d2c1 to
3ec0c48
Compare
lml2468
added
review:running:security
lml2468
approved these changes
Jun 27, 2026
lml2468
left a comment
lml2468
left a comment
Contributor
There was a problem hiding this comment.
QA Verdict: PASS
Persona: qa-engineer (embedded by review-lead in pr-tick-octo-cli)
Read (linked context)
- PR is a Dependabot bump; no
Fixes #Nlinked issue (CI dependency update, not driven by an issue). - Diff scope:
.github/workflows/ci.ymland.github/workflows/release-publish.yml—actions/setup-goSHA pin only.
Verify
- Local checkout skipped: change touches only CI YAML pins; no application code, no test surface.
- CI evidence on this PR's head:
npm test✅,Detect changed paths✅,sanity / actionlint✅,sanity / No tabs in workflow files✅,label✅,scan-pr / osv-scan✅,history / Common ancestor check✅.build & test (1.24.x)still in progress at review time — Go build invokes the bumped action and is the canonical regression signal; an autopilot follow-up tick will re-examine it if it lands red. check-sprint / check-sprintfailure is a sprint-label governance check unrelated to setup-go (consistent across other open PRs in the queue).
Findings
- Test coverage: No code-under-test changed — coverage delta = 0. No new tests required.
- Flaky risk:
actions/setup-gov6.5.0 release notes contain only dependency updates + cache-key default change (now keyed bygo.mod). The cache-key change can produce a one-time cache miss on the first run; no functional regression risk. - Edge cases: Both call sites bumped consistently (matrix
build & testandrelease-publish). Pinned SHA matches upstream v6.5.0 release commit (verified viagh api /repos/actions/setup-go/git/ref/tags/v6.5.0).
Verdict
PASS — purely a CI action pin bump; behavior preserved, both call sites consistent, Go build job validates real-world usage in CI.
lml2468
added
review:done:qa:approve
lml2468
approved these changes
Jun 27, 2026
lml2468
left a comment
lml2468
left a comment
Contributor
There was a problem hiding this comment.
Security Verdict: CLEARED
Persona: security-engineer (embedded by review-lead in pr-tick-octo-cli)
Supply-chain checks
- Action:
actions/setup-go— official GitHub-maintained action under theactions/org. Trusted source. - Pin discipline: Pre-bump and post-bump both use immutable SHA pins (
@40f1582…→@924ae3a…) with a trailing# vX.Y.Zcomment. This matches OpenSSF / GitHub-hardening guidance — no float to@v6or@main. - SHA integrity (verified): Queried
gh api /repos/actions/setup-go/git/ref/tags/v6.5.0→ SHA924ae3a1cded613372ab5595356fb5720e22ba16matches the SHA in this PR exactly. No SHA spoofing / typo-squat. - Diff scope: Only
.github/workflows/{ci,release-publish}.yml. No new permissions block, no new secrets reference, no new step. Samewith: go-version,cache: trueinputs.
STRIDE
- Spoofing: N/A — same upstream action, verified SHA.
- Tampering: SHA pin prevents pin float; no tampering vector introduced.
- Repudiation: N/A.
- Information disclosure: No new logging / secret usage.
- Denial of service: Release notes describe a cache-key default change (now keyed by
go.mod) — could cause one cold-cache CI run but no DoS exposure. - Elevation of privilege: No change to
permissions:,pull_request_target,workflow_run, or anywhere a third-party PR could exploit elevated tokens. The action runs inside the existing job with its existing token grant.
OSV-Scanner
scan-pr / osv-scan✅ on this PR head — no known vulnerable advisories on the new pin.
Release note review (v6.0.0 → v6.5.0)
- v6.0.0 was the major bump from v5; release notes for v6.x focus on dependency updates (
@actions/cache@5, minimatch, js-yaml, types/node) and an opt-ingo-download-base-urlinput. No new network egress by default, no new env exfil surface.
Verdict
CLEARED — official action, SHA-pinned, SHA verified against upstream tag, no permission/secret changes, OSV scan green.
lml2468
added
review:done:security:approve
lml2468
approved these changes
Jun 27, 2026
lml2468
left a comment
lml2468
left a comment
Contributor
There was a problem hiding this comment.
Code Review Verdict: APPROVED
Persona: code-reviewer (embedded by review-lead in pr-tick-octo-cli)
- Must Fix: 0
- Should Fix: 0
- Nit: 0
- Question: 0
Correctness
- Diff is exactly 2 lines: same
uses:key on both sites, only the SHA + version comment change. Both files updated consistently — no skew between matrixbuild & test(ci.yml) and the release-publish job (release-publish.yml). - Inputs untouched:
go-version: ${{ matrix.go-version }}inci.ymlandgo-version: "1.24.x"+cache: trueinrelease-publish.yml. v6.5.0 accepts the same inputs (no breaking input rename per release notes).
Consistency / maintainability
- SHA-pin-with-version-comment style is preserved (matches the rest of the repo's
actions/checkout@…# v4,goreleaser/…pins seen in other Dependabot PRs in the queue). - No straggler references to
setup-go@v5or the old SHA elsewhere in.github/workflows/based on diff scope (Dependabot only modifies what it pinned).
Behavior delta from upstream notes
- Cache default switched to
go.mod-keyed (v6.3.0). Compatible with this repo's standalonego.modconsumers; first run after merge will warm a new cache key. - New
go-download-base-urlinput is opt-in; not used here.
Verdict
APPROVED — minimal, mechanically correct, well-pinned dependency bump. No nits worth holding the PR for.
lml2468
added
review:done:code:approve
Contributor
Aggregate Verdict: APPROVED — 等人工合并All three reviewer personas approved this dependency bump (
Decision: No blocking issues found. Ready for human merge. Aggregated by |
Contributor
Formal Verdict Aggregate Report — Round 1 — HEAD 3ec0c48Formal Verdict: Reviewer Summary
Critical Findings (P0-P1)无 Critical / High priority findings — all reviewers converged on lower-severity items. Should-Fix (P2)无 P2 findings. Suggestions (P3)
Questions for Author
Verdict Rationale三名上游 reviewer 完全收敛：security 唯一「红」信号 Round ContextFirst-round review — no prior round context. Generated by review-leader · v5.1 chain terminal (Round 1 aggregate) · dedupe/verdict deterministic per skill |
lml2468
approved these changes
Jul 2, 2026
lml2468
left a comment
lml2468
left a comment
Contributor
There was a problem hiding this comment.
APPROVE — Round 1 · Formal Verdict aggregate
All three reviewers converged with zero blocking findings: security cleared, code approved (Must=0/Should=0/Nit=0), qa pass-with-risk (SHA-pin bump of actions/setup-go v5.6.0 → v6.5.0, functional CI green; only non-blocking risks). No P0/P1/P2, no blocking question.
Top notes: v5→v6 default cache-key change (build & test green, no follow-up needed); check-sprint red is a board governance gate (missing Closes #, normal for Dependabot), not a functional/security gate.
See the full aggregate comment on this PR for details. Automated bot review; human sign-off still required.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/setup-go from 5.6.0 to 6.5.0.
Release notes
Sourced from actions/setup-go's releases.
... (truncated)
Commits
924ae3achore: bump version to 6.5.0 in package.json and package-lock.json (#762)e91cc3bBump@actions/cacheto 5.1.0, log cache write denied (#758)4a2405echore: update@types/nodeand@typescript-eslintdependencies to latest versi...78961f6chore: update@actionsdependencies and refresh license cache (#744)4a36011docs: fix Microsoft build of Go link (#734)8f19afcfeat: add go-download-base-url input for custom Go distributions (#721)27fdb26Bump minimatch from 3.1.2 to 3.1.5 (#727)def8c39Rearrange README.md, add advanced-usage.md (#724)4b73464Fix golang download url to go.dev (#469)a5f9b05Update default Go module caching to use go.mod (#705)