Create go.yml#1782
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: blccopyrigth7-creator The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
📝 WalkthroughWalkthroughAdds Go dependency normalization commands and a GitHub Actions workflow using Go 1.20 to build and test the project on ChangesGo tooling and CI
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)go.ymlTraceback (most recent call last): Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/go.yml:
- Around line 12-17: Harden the build job’s actions/checkout step by disabling
persisted credentials and configure the workflow permissions so the GITHUB_TOKEN
has only read-only contents access. Apply these changes to the checkout
configuration and job/workflow permissions without altering the remaining build
steps.
- Around line 19-22: Update the “Set up Go” workflow step to use
actions/setup-go@v6 instead of `@v4`, and replace the hardcoded go-version value
with go-version-file pointing to go.mod so the workflow uses the repository’s
declared Go version.
- Around line 19-22: Update the “Set up Go” workflow step to use the Go version
declared by go.mod via go-version-file, replacing the hard-coded go-version
value so CI builds and tests run with the module’s required version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| jobs: | ||
|
|
||
| build: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Prevent checkout credentials from reaching repository code.
actions/checkout persists the token by default. Since the following steps execute repository-controlled Go code, disable credential persistence and explicitly limit the workflow token to read-only contents access. (github.com)
Proposed hardening
+permissions:
+ contents: read
+
jobs:
build:
@@
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go.yml around lines 12 - 17, Harden the build job’s
actions/checkout step by disabling persisted credentials and configure the
workflow permissions so the GITHUB_TOKEN has only read-only contents access.
Apply these changes to the checkout configuration and job/workflow permissions
without altering the remaining build steps.
Source: Linters/SAST tools
| - name: Set up Go | ||
| uses: actions/setup-go@v4 | ||
| with: | ||
| go-version: '1.20' |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
grep -n 'actions/setup-go@' .github/workflows/go.yml
grep -nE '^(go|toolchain) ' go.modRepository: devfile/api
Length of output: 194
🌐 Web query:
actions/setup-go v4 supported runtime GitHub Actions actionlint runtime too old v6 go.mod documentation
💡 Result:
The error message from actionlint stating that the "runner of actions/setup-go@v4 action is too old" indicates that the specific version of the action you are using relies on a Node.js runtime (typically Node 16 or Node 20) that is being deprecated or is no longer compatible with the updated environment requirements of GitHub-hosted runners [1][2][3]. To resolve this, you should update to the latest major version of the action, which is currently v6 [4][5]. The newer versions of actions/setup-go have been upgraded to support current Node.js runtimes (e.g., Node 24) [4]. Recommended Actions: 1. Update your workflow YAML files to use actions/setup-go@v6 [4][2]. 2. If you are unable to update the action version immediately, actionlint allows you to suppress this specific warning using its configuration file [6][7]. You can add the following to your .github/actionlint.yml (or .yaml) to ignore the runner version check for your workflows [6][7]: paths:.github/workflows//*.yml: ignore: - 'the runner of ".+" action is too old to run on GitHub Actions' Note that while suppressing the warning allows actionlint to pass, it does not fix the underlying runtime compatibility issue, which may still cause your CI jobs to fail on newer GitHub-hosted runner images [2][3]. Upgrading to v6 is the standard and recommended solution [1][2].
Citations:
- 1: update dev release file to pinpoit py version EternisAI/enchanted-twin#612
- 2: Release tooling update ahoy-cli/ahoy#159
- 3: https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md
- 4: https://github.com/actions/setup-go
- 5: https://github.com/actions/setup-go?tab=readme-ov-file
- 6: https://github.com/rhysd/actionlint/releases
- 7: Unable to ignore errors by
pathsconfig rhysd/actionlint#481
Upgrade actions/setup-go and source the Go version from go.mod. actions/setup-go@v4 uses an unsupported runtime; switch to @v6, and replace the hardcoded 1.20 with go-version-file: go.mod (this repo declares Go 1.24).
🧰 Tools
🪛 actionlint (1.7.12)
[error] 20-20: the runner of "actions/setup-go@v4" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go.yml around lines 19 - 22, Update the “Set up Go”
workflow step to use actions/setup-go@v6 instead of `@v4`, and replace the
hardcoded go-version value with go-version-file pointing to go.mod so the
workflow uses the repository’s declared Go version.
Source: Linters/SAST tools
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## go.mod\n'
if [ -f go.mod ]; then
cat -n go.mod | sed -n '1,40p'
else
echo 'go.mod not found'
fi
printf '\n## .github/workflows/go.yml\n'
if [ -f .github/workflows/go.yml ]; then
cat -n .github/workflows/go.yml | sed -n '1,120p'
else
echo '.github/workflows/go.yml not found'
fiRepository: devfile/api
Length of output: 2666
Use the Go version declared by the module. go.mod requires Go 1.24, but this workflow installs 1.20, so go build and go test will fail. Switch to go-version-file: go.mod to keep CI aligned.
Proposed fix
uses: actions/setup-go@v4
with:
- go-version: '1.20'
+ go-version-file: go.mod📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: '1.20' | |
| - name: Set up Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version-file: go.mod |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 20-20: the runner of "actions/setup-go@v4" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go.yml around lines 19 - 22, Update the “Set up Go”
workflow step to use the Go version declared by go.mod via go-version-file,
replacing the hard-coded go-version value so CI builds and tests run with the
module’s required version.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
go.yml (1)
1-1: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winPin the
golang.org/x/toolsversion instead of using-u.
go get -uupgrades the selected module and can rewritego.mod,go.sum, andvendor/modules.txtwith different direct/indirect selection each run. Use an explicit@version, addgolang.org/x/toolstogo.modif needed, then rungo mod tidyandgo mod vendor.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.yml` at line 1, Update the dependency step using an explicit, pinned golang.org/x/tools `@version` instead of -u, add the module requirement to go.mod when absent, then regenerate dependency metadata with go mod tidy and go mod vendor.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.yml`:
- Around line 1-3: The go.yml content is not a valid GitHub Actions workflow and
will not execute the dependency commands. Convert it into a workflow defining
the required name, trigger, and jobs/run step with the commands in a multiline
run block, or rename it to an executable shell script and invoke that script
from an actual workflow.
---
Nitpick comments:
In `@go.yml`:
- Line 1: Update the dependency step using an explicit, pinned
golang.org/x/tools `@version` instead of -u, add the module requirement to go.mod
when absent, then regenerate dependency metadata with go mod tidy and go mod
vendor.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| go get -u golang.org/x/tools | ||
| go mod tidy | ||
| go mod vendor |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Define an actual workflow or rename this file to a script.
These lines are only a scalar YAML value; they do not define name, on, jobs, or a run step. GitHub Actions will not execute them as dependency-normalization commands. Move them into a workflow run: | block, or rename this to an executable shell script and invoke it from the workflow.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.yml` around lines 1 - 3, The go.yml content is not a valid GitHub Actions
workflow and will not execute the dependency commands. Convert it into a
workflow defining the required name, trigger, and jobs/run step with the
commands in a multiline run block, or rename it to an executable shell script
and invoke that script from an actual workflow.
1 participant
Description of Changes
Summarize the changes you made as part of this pull request.
Related Issue(s)
Link the GitHub/GitLab/JIRA issues that are related to this PR.
Acceptance Criteria
Testing and documentation do not need to be complete in order for this PR to be approved. However, tracking issues must be opened for missing testing/documentation.
New testing and documentation issues can be opened under
devfile/api/issues.You can check the respective criteria below if either of the following is true:
If criteria is left unchecked please provide an explanation why.
Unit/Functional tests
QE Integration test
Documentation
Client Impact
Tests Performed
Explain what tests you personally ran to ensure the changes are functioning as expected.
How To Test
Instructions for the reviewer on how to test your changes.
Notes To Reviewer
Any notes you would like to include for the reviewer.
Summary by CodeRabbit