versions: Bump golang to 1.24.11#2706
versions: Bump golang to 1.24.11#2706stevenhorsman merged 2 commits intoconfidential-containers:mainfrom
Conversation
Fixes for the following GO-2025-4155 Signed-off-by: stevenhorsman <steven@uk.ibm.com>
|
The s390x failure is due to the removal of storage.googleapis.com/golang (actions/go-versions#127), so I will have to try and bump the setup-go action to 6.1.0 in alignment which has a fix for this: https://github.com/actions/setup-go/releases/tag/v6.1.0 |
Due to the removal of storage.googleapis.com/golang (actions/go-versions#127), some of the golang installs are failing, so update setup-go action to 6.1.0 which has a fix for this: https://github.com/actions/setup-go/releases/tag/v6.1.0 Signed-off-by: stevenhorsman <steven@uk.ibm.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV" | ||
| - name: Setup Golang version ${{ env.GO_VERSION }} | ||
| uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 | ||
| uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 |
Check failure
Code scanning / zizmor
runtime artifacts potentially vulnerable to a cache poisoning attack Error
There was a problem hiding this comment.
Yes - you can see from https://github.com/actions/setup-go/releases/tag/v6.1.0. The reason is that it's flagged is that we a cache in this action: cache-dependency-path: "**/go.sum", which we need to track and see if the performance penalty is okay.
|
Unfortunately the e2e tests is a |
stevenhorsman
merged commit d33f5cd
into
confidential-containers:main
Bump the builder image created in confidential-containers#2706 and bump the go.mod version to actually use the new go version. Signed-off-by: stevenhorsman <steven@uk.ibm.com>
Bump the builder image created in confidential-containers#2706 and bump the go.mod version to actually use the new go version. Signed-off-by: stevenhorsman <steven@uk.ibm.com>
Bump the builder image created in confidential-containers#2706 and bump the go.mod version to actually use the new go version. Signed-off-by: stevenhorsman <steven@uk.ibm.com>
Bump the builder image created in #2706 and bump the go.mod version to actually use the new go version. Signed-off-by: stevenhorsman <steven@uk.ibm.com>
4 participants
Fixes for the following GO-2025-4155