govulncheck-action: Support Go 1.22

[1366613]

Go version

go version go1.22rc1 darwin/arm64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='arm64'
GOBIN=''
GOCACHE='/Users/aurora/Library/Caches/go-build'
GOENV='/Users/aurora/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMODCACHE='/Users/aurora/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/aurora/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.22rc1'
GCCGO='gccgo'
AR='ar'
CC='clang'
CXX='clang++'
CGO_ENABLED='0'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -arch arm64 -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/tb/zwvbx7v51gz7lbj4x4fhn3wr0000gn/T/go-build2929267714=/tmp/go-build -gno-record-gcc-switches -fno-common'

What did you do?

Try to run govulncheck GitHub Action

What did you see happen?

Encountered error: Command failed: go env GOPATH go: downloading go1.22 (linux/amd64) go: download go1.22 for linux/amd64: toolchain not available

What did you expect to see?

govulncheck able to run with Go 1.22

[mauri870]

This is not a govulncheck issue, it has to do with how go tool handle development versions.

Please see #62278 (comment) and #62278 (comment)

[dmitshur]

CC @golang/vulndb.

[hyangah]

This is WAI.
There is no official, stable go1.22 (i.e. go1.22.0) yet. The prerelease go1.22rc1 is out but needs to be manually selected. If your project requires go1.22+, I think it makes more sense to configure your workflow to use go1.22+. Or wait until go1.22 is released.

Looking at https://github.com/golang/govulncheck-action/blob/master/action.yml, this github action is just a wrapper of actions/setup-go, go install govulncheck, and then run govulncheck command, and nothing more. Assuming most users already setup go in their workflow, can't this be achieved one extra command on top of their existing workflow?

go run golang.org/x/vuln/cmd/govulncheck@latest <whatever args....>

[zpavlinovic]

govulncheck-action also supports go-version-input (which is passed to setup-go under the hood). Closing this.