build(deps): bump actions/setup-go from 6 to 7 by dependabot[bot] · Pull Request #751 · codeready-toolchain/member-operator

dependabot · 2026-07-16T15:03:13Z

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-go#763

chore(deps): bump @actions/cache to 6.2.0 by @philip-gai in actions/setup-go#771

New Contributors

@philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

Upgrade actions dependencies by @priyagupta108 with @Copilot in actions/setup-go#744

Upgrade @types/node and typescript-eslint dependencies to resolve npm audit findings by @HarithaVattikuti in actions/setup-go#755

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-go#758

Upgrade version to 6.5.0 in package.json and package-lock.json by @HarithaVattikuti in actions/setup-go#762

New Contributors

@priyagupta108 with @Copilot made their first contribution in actions/setup-go#744

@jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

Add go-download-base-url input for custom Go distributions by @gdams in actions/setup-go#721

Dependency update

Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in actions/setup-go#727

Documentation update

Rearrange README.md, add advanced-usage.md by @priyagupta108 in actions/setup-go#724

Fix Microsoft build of Go link by @gdams in actions/setup-go#734

New Contributors

@gdams made their first contribution in actions/setup-go#721

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

Update default Go module caching to use go.mod by @priyagupta108 in actions/setup-go#705

Fix golang download url to go.dev by @178inaba in actions/setup-go#469

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

b7ad1da chore(deps): bump @actions/cache to 6.2.0 (#771)
0778a10 Migrate to ESM and upgrade dependencies (#763)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

Chores
- Updated automated build, testing, linting, publishing, and deployment workflows to use the latest Go setup action version.
- No changes to application functionality or workflow behavior.

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

openshift-ci · 2026-07-16T15:03:23Z

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a codeready-toolchain member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai · 2026-07-16T15:03:30Z

Walkthrough

Four GitHub Actions workflows update their Go toolchain setup steps from actions/setup-go@v6 to actions/setup-go@v7.

Changes

Go Action Version Updates

Layer / File(s)	Summary
Update Go setup actions `.github/workflows/ci-golang-sbom.yml`, `.github/workflows/operator-cd.yml`, `.github/workflows/publish-components-for-e2e-tests.yml`, `.github/workflows/test-with-coverage.yml`	Go installation steps now use `actions/setup-go@v7` instead of `actions/setup-go@v6`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: matousjobanek

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: upgrading actions/setup-go from v6 to v7.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dependabot/github_actions/actions/setup-go-7

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-07-16T15:03:38Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

rajivnathan · 2026-07-16T15:04:25Z

/ok-to-test

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-components-for-e2e-tests.yml:
- Around line 54-56: Update the actions/setup-go configuration in the
publish-components workflow to set its cache option to false. Keep the existing
go-version-file setting and separate actions/cache step unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 2c36e3d1-9555-469c-8aea-cd8bd9249d35

📥 Commits

Reviewing files that changed from the base of the PR and between 96b779e and b56ad0e.

📒 Files selected for processing (4)

.github/workflows/ci-golang-sbom.yml
.github/workflows/operator-cd.yml
.github/workflows/publish-components-for-e2e-tests.yml
.github/workflows/test-with-coverage.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

codeready-toolchain/api (manual)
codeready-toolchain/toolchain-common (manual) → reviewed against open PR #538 dependabot/github_actions/actions/setup-go-7 instead of the default branch
codeready-toolchain/host-operator (manual) → reviewed against open PR #1277 dependabot/github_actions/actions/setup-go-7 instead of the default branch
codeready-toolchain/toolchain-e2e (manual) → reviewed against open PR #1299 dependabot/github_actions/actions/setup-go-7 instead of the default branch

📜 Review details

⏰ Context from checks skipped due to timeout. (3)

GitHub Check: test
GitHub Check: GolangCI Lint
GitHub Check: Build & push operator bundles & dashboard image for e2e tests

🧰 Additional context used

🪛 zizmor (1.26.1)

.github/workflows/test-with-coverage.yml

[error] 22-22: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

.github/workflows/operator-cd.yml

[error] 24-24: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

.github/workflows/ci-golang-sbom.yml

[error] 21-21: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🔀 Multi-repo context codeready-toolchain/api, codeready-toolchain/toolchain-common, codeready-toolchain/host-operator, codeready-toolchain/toolchain-e2e

Linked repositories findings

`codeready-toolchain/api`

.github/workflows/ci-build.yml:21 and .github/workflows/verify-dependencies.yml:17 still use actions/setup-go@v6, unlike the reviewed change and the other repositories. This is a workflow-version inconsistency only; both workflows use go-version-file: go.mod. [::codeready-toolchain/api::]

`codeready-toolchain/toolchain-common`

On the branch of open PR #538, all observed setup-go usages use actions/setup-go@v7, including verify-dependencies.yml:17, test-with-coverage.yml:22, and linters.yml:21. Each uses go-version-file: go.mod. [::codeready-toolchain/toolchain-common::]

`codeready-toolchain/host-operator`

On the branch of open PR #1277, all observed usages in the workflows—including the four files changed by this PR—use actions/setup-go@v7 and go-version-file: go.mod. [::codeready-toolchain/host-operator::]

`codeready-toolchain/toolchain-e2e`

On the branch of open PR #1299, all observed setup-go usages use actions/setup-go@v7, with go-version-file: go.mod in each occurrence. [::codeready-toolchain/toolchain-e2e::]

🔇 Additional comments (3)

.github/workflows/ci-golang-sbom.yml (1)

21-23: LGTM!

.github/workflows/operator-cd.yml (1)

24-26: LGTM!

.github/workflows/test-with-coverage.yml (1)

22-24: LGTM!

coderabbitai · 2026-07-16T15:08:05Z

+      uses: actions/setup-go@v7
      with:
        go-version-file: go.mod


🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash set -euo pipefail echo "## Workflow trigger and setup-go context" sed -n '1,220p' .github/workflows/publish-components-for-e2e-tests.yml echo echo "## Search for explicit setup-go cache settings in this repo" rg -n "actions/setup-go@v7|actions/setup-go@v6|cache:\s*false|cache:\s*true" .github/workflows -n

Repository: codeready-toolchain/member-operator

Length of output: 4649

🏁 Script executed (no clone):

#!/bin/bash set -euo pipefail curl -Lfs https://raw.githubusercontent.com/actions/setup-go/v7/README.md | \ sed -n '1,220p' | \ rg -n "cache|default|false|true" -n

Length of output: 1503

Disable setup-go caching in this privileged workflow.

This pull_request_target/issue_comment job checks out PR-controlled code and already uses a separate actions/cache step for ~/go/pkg/mod; set cache: false on actions/setup-go so untrusted PR code can’t populate the extra Go module/build cache in a privileged run.

Proposed fix

with: go-version-file: go.mod + cache: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

uses: actions/setup-go@v7

with:

go-version-file: go.mod

uses: actions/setup-go@v7

with:

go-version-file: go.mod

cache: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish-components-for-e2e-tests.yml around lines 54 - 56, Update the actions/setup-go configuration in the publish-components workflow to set its cache option to false. Keep the existing go-version-file setting and separate actions/cache step unchanged.

Source: Linters/SAST tools

openshift-ci · 2026-07-16T20:26:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alexeykazakov, dependabot[bot], rajivnathan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [alexeykazakov,rajivnathan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 16, 2026

openshift-ci Bot requested review from alexeykazakov and rajivnathan July 16, 2026 15:03

openshift-ci Bot added the needs-ok-to-test label Jul 16, 2026

rajivnathan approved these changes Jul 16, 2026

View reviewed changes

openshift-ci Bot added the approved label Jul 16, 2026

openshift-ci Bot added ok-to-test and removed needs-ok-to-test labels Jul 16, 2026

coderabbitai Bot reviewed Jul 16, 2026

View reviewed changes

alexeykazakov approved these changes Jul 16, 2026

View reviewed changes

alexeykazakov merged commit dfa7900 into master Jul 16, 2026
9 of 11 checks passed

alexeykazakov deleted the dependabot/github_actions/actions/setup-go-7 branch July 16, 2026 20:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump actions/setup-go from 6 to 7#751

build(deps): bump actions/setup-go from 6 to 7#751
alexeykazakov merged 1 commit into
masterfrom
dependabot/github_actions/actions/setup-go-7

dependabot Bot commented on behalf of github Jul 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Jul 16, 2026

Uh oh!

rajivnathan commented Jul 16, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Jul 16, 2026

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.0

What's Changed

New Contributors

v6.5.0

What's Changed

Dependency update

New Contributors

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

v6.3.0

What's Changed

v6.2.0

What's Changed

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

coderabbitai Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Jul 16, 2026

Quality Gate passed

Uh oh!

rajivnathan commented Jul 16, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Linked repositories findings

codeready-toolchain/api

codeready-toolchain/toolchain-common

codeready-toolchain/host-operator

codeready-toolchain/toolchain-e2e

Uh oh!

coderabbitai Bot Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Jul 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading

`codeready-toolchain/api`

`codeready-toolchain/toolchain-common`

`codeready-toolchain/host-operator`

`codeready-toolchain/toolchain-e2e`