setup-go@v5 installs newer go than requested

[anderbubble]

Description:

Since upgrading from setup-go@v3 to setup-go@v5, our matrix strategy workflows are failing due to a go version mismatch. Versions of the tests that are attempting to use previous versions of go are running with later-version libraries, causing failures.

Example: https://github.com/warewulf/warewulf/actions/runs/12079627670/job/33685781604?pr=1556

Logs indicate that after setup-go installs the requested version of go, it then installs 1.23.3. This causes tests to run against golang.org/[email protected], which is incompatible with requested golang versions 1.21 and 1.22.

Action version:
v5

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:

1.21 and 1.22 (erroneously installs 1.23).

Repro steps:

inputs:
  go-version:
    description: "go version"
    required: true
runs:
  using: "composite"
  steps:
[...]
    - name: Setup go ${{ inputs.go-version }}
      uses: actions/setup-go@v5
      with:
        go-version: ${{ inputs.go-version }}
        cache: false
        check-latest: false
[...]

See also: https://github.com/warewulf/warewulf/blob/main/.github/actions/prepare/action.yml

Expected behavior:

Should install the requested golang version, and only that version.

Actual behavior:

Installs the requested golang version and then a newer golang version.

Run actions/setup-go@v5
Setup go version spec 1.22
Found in cache @ /opt/hostedtoolcache/go/1.22.9/x64
Added go to the path
Successfully set up Go version 1.22
go: downloading go1.23.3 (linux/amd64)
go version go1.23.3 linux/amd64

[anderbubble]

Disabling the cache did not appear to resolve this behavior: https://github.com/warewulf/warewulf/actions/runs/12080202374/job/33687202383?pr=1570

[mahalakshmi-rekadi]

Hi @anderbubble 👋,
Thank you for your report. We'll investigate the issue and get back to you with the details!

[anderbubble]

Thanks for looking into it, @mahalakshmi-rekadi. Let me know if we're just doing something wrong.

[matthewhughes-uw]

This looks related to #457, you should be able to use the workaround mentioned there, setting the env var GOTOOLCHAIN=local:

env:
  GOTOOLCHAIN: local

[anderbubble]

Thanks for pointing us in the right direction! This identified for me that we had a mismatched toolchain directive in our go.mod which was causing it to be installed. I think the better fix for us right now is to just remove the toolchain directive from our go.mod, which appears to have resolved our issue (as seen in warewulf/warewulf#1577).

Thanks again!