govulncheck-action: Warning: Both go-version and go-version-file inputs are specified, only go-version will be used while only 'go-version-file: go.mod' is specified

[sbp-bvanb]

govulncheck version

golang/[email protected]

Does this issue reproduce at the latest version of golang.org/x/vuln?

• Yes.

Output of go env in your module/workspace:

-

What did you do?

- uses: golang/[email protected]
  with:
    go-version-file: go.mod
    go-package: ./...

What did you see happen?

Warning: Both go-version and go-version-file inputs are specified, only go-version will be used

What did you expect to see?

No warning as go-version-file: go.mod has been defined. If this is the case, then the code should omit go-version and only use the version that is defined in the go.mod file. Now it is using another Golang version, while another version is defined in the go.mod file.

[gabyhelp]

Related Issues and Documentation

• govulncheck-action: support go-version-file: 'go.mod' #61343 (closed)
• x/vuln/cmd/govulncheck: check against toolchain/go directive version #62050
• x/vuln: outdated govulncheck documentation #61152 (closed)
• x/vuln/cmd/govulncheck: v1.1.0: Fatal error when used in a workspace #66863 (closed)
• x/vuln: golang/govulncheck-action@v1 too hard to use #69597 (closed)
• govulncheck-action: allow users to use specific version of govulncheck #67782
• Go Vulnerability Database > Note on Versions
• x/vuln: -v flag is not recognized in v0.2.0 #61144 (closed)
• govulncheck-action: semver tag 'v1' not updated for release v1.0.1 #63281 (closed)
• x/vuln: Binary mode not compatible with golang 1.21.0 #61936 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[cagedmantis]

cc @golang/vulndb

[waliseddiqi]

I am having same issue

reproduction:
I wanted to pass go-version-file which is 1.23.2 in my go.mod project but the action assigned the go version as 1.23.3

Warning: Both go-version and go-version-file inputs are specified, only go-version will be used

[jasonwashburn]

Looks like the issue was likely introduced here. By giving go-version-input a default value, it guarantees that the setup-go action will be provided a 'go-version' input even when the user does not specify one and the a user-specified go-version-file will be ignored by setup-go