Bump semver and @types/semver

Bumps [semver](https://github.com/npm/node-semver) and [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver). These dependencies needed to be updated together. Updates `semver` from 7.7.1 to 7.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](https://github.com/npm/node-semver/compare/v7.7.1...v7.7.2) Updates `@types/semver` from 7.5.8 to 7.7.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver) --- updated-dependencies: - dependency-name: semver dependency-version: 7.7.2 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: "@types/semver" dependency-version: 7.7.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2025-10-30 23:10:30 +00:00 · 2025-09-22 17:06:06 +00:00
10 changed files with 32 additions and 80 deletions
--- a/.github/workflows/versions.yml
+++ b/.github/workflows/versions.yml
@@ -18,7 +18,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
    steps:
      - uses: actions/checkout@v5
      - name: Setup Go Stable
@@ -33,7 +33,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
    steps:
      - uses: actions/checkout@v5
      - name: Setup Go oldStable
@@ -48,13 +48,13 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
        version: [stable, oldstable]
        architecture: [x64, x32]
        exclude:
          - os: macos-latest
            architecture: x32
-          - os: macos-latest-large
+          - os: macos-13
            architecture: x32
    steps:
      - uses: actions/checkout@v5
@@ -72,7 +72,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest, macos-latest-large]
+        os: [macos-latest, windows-latest, ubuntu-latest, macos-13]
        go: [1.21.13, 1.22.8, 1.23.2]
        include:
          - os: windows-latest
@@ -98,7 +98,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
        go-version: ['1.20', '1.21', '1.22', '1.23']
    steps:
      - uses: actions/checkout@v5
@@ -115,7 +115,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
    steps:
      - uses: actions/checkout@v5
      - name: Setup Go and check latest
@@ -131,7 +131,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
    steps:
      - uses: actions/checkout@v5
      - name: Setup Go and check latest
@@ -142,28 +142,12 @@ jobs:
        run: __tests__/verify-go.sh 1.21
        shell: bash

-  go-version-file-with-tool-versions:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
-    steps:
-      - uses: actions/checkout@v5
-      - name: Setup Go and check latest
-        uses: ./
-        with:
-          go-version-file: __tests__/data/.tool-versions
-      - name: verify go
-        run: __tests__/verify-go.sh 1.23.2
-        shell: bash
-
  setup-versions-from-manifest:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest, macos-latest-large]
+        os: [macos-latest, windows-latest, ubuntu-latest, macos-13]
        go: [1.20.14, 1.21.10, 1.22.8, 1.23.2]
    steps:
      - name: Checkout
@@ -183,7 +167,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [windows-latest, ubuntu-latest, macos-latest-large]
+        os: [windows-latest, ubuntu-latest, macos-13]
        go: [1.11.12]
    steps:
      - name: Checkout
@@ -203,7 +187,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
        go-version: [1.20.14, 1.21, 1.22, 1.23]
        include:
          - os: macos-latest
@@ -212,7 +196,7 @@ jobs:
            architecture: x64
          - os: windows-latest
            architecture: x64
-          - os: macos-latest-large
+          - os: macos-13
            architecture: x64
    steps:
      - uses: actions/checkout@v5
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ See full release notes on the [releases page](https://github.com/actions/setup-g
 The action will first check the local cache for a version match. If a version is not found locally, it will pull it from
 the `main` branch of the [go-versions](https://github.com/actions/go-versions/blob/main/versions-manifest.json)
 repository. On miss or failure, it will fall back to downloading directly
-from [go dist](https://go.dev/dl). To change the default behavior, please use
+from [go dist](https://storage.googleapis.com/golang). To change the default behavior, please use
 the [check-latest input](#check-latest-version).

 **Note:** The `setup-go` action uses executable binaries which are built by Golang side. The action does not build
@@ -178,7 +178,7 @@ steps:

 ## Getting go version from the go.mod file

-The `go-version-file` input accepts a path to a `go.mod` file, `.tool-versions` file or a `go.work`
+The `go-version-file` input accepts a path to a `go.mod` file or a `go.work`
 file that contains the version of Go to be used by a project. The version taken
 from thils file will be:

@@ -203,15 +203,6 @@ steps:
      go-version-file: 'path/to/go.mod'
  - run: go version
 ```
-```yaml
-steps:
-  - uses: actions/checkout@v5
-  - uses: actions/setup-go@v6
-    with:
-      go-version-file: '.tool-versions'
-  - run: go version
-```
-> The [.tool-versions file](https://asdf-vm.com/manage/configuration.html#tool-versions) supports version specifications in accordance with asdf standards, adhering to Semantic Versioning ([semver](https://semver.org)).

 ## Matrix testing

@@ -249,7 +240,7 @@ When dynamically downloading Go distributions, `setup-go` downloads distribution

 These calls to `actions/go-versions` are made via unauthenticated requests, which are limited to [60 requests per hour per IP](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting).
 If more requests are made within the time frame, then the action leverages the `raw API` to retrieve the version-manifest. This approach does not impose a rate limit and hence facilitates unrestricted consumption. This is particularly beneficial for GHES runners, which often share the same IP, to avoid the quick exhaustion of the unauthenticated rate limit.
-If that fails as well the action will try to download versions directly from https://go.dev/dl.
+If that fails as well the action will try to download versions directly from https://storage.googleapis.com/golang.

 If that fails as well you can get a higher rate limit with [generating a personal access token on github.com](https://github.com/settings/tokens/new) and passing it as the `token` input to the action:

--- a/tests/data/.tool-versions
+++ b/tests/data/.tool-versions
@@ -1 +0,0 @@
-golang 1.23.2
--- a/tests/setup-go.test.ts
+++ b/tests/setup-go.test.ts
@@ -389,7 +389,7 @@ describe('setup-go', () => {

    const expPath = path.win32.join(toolPath, 'bin');
    expect(dlSpy).toHaveBeenCalledWith(
-      'https://go.dev/dl/go1.13.1.windows-amd64.zip',
+      'https://storage.googleapis.com/golang/go1.13.1.windows-amd64.zip',
      'C:\\temp\\go1.13.1.windows-amd64.zip',
      undefined
    );
@@ -866,9 +866,6 @@ exclude example.com/thismodule v1.3.0

 use .

-`;
-
-    const toolVersionsContents = `golang 1.23
 `;

    it('reads version from go.mod', async () => {
@@ -895,18 +892,6 @@ use .
      expect(logSpy).toHaveBeenCalledWith('matching 1.19...');
    });

-    it('reads version from .tool-versions', async () => {
-      inputs['go-version-file'] = '.tool-versions';
-      existsSpy.mockImplementation(() => true);
-      readFileSpy.mockImplementation(() => Buffer.from(toolVersionsContents));
-
-      await main.run();
-
-      expect(logSpy).toHaveBeenCalledWith('Setup go version spec 1.23');
-      expect(logSpy).toHaveBeenCalledWith('Attempting to download 1.23...');
-      expect(logSpy).toHaveBeenCalledWith('matching 1.23...');
-    });
-
    it('reads version from .go-version', async () => {
      inputs['go-version-file'] = '.go-version';
      existsSpy.mockImplementation(() => true);
@@ -961,7 +946,7 @@ use .
        const expectedUrl =
          platform === 'win32'
            ? `https://github.com/actions/go-versions/releases/download/${version}/go-${version}-${platform}-${arch}.${fileExtension}`
-            : `https://go.dev/dl/go${version}.${osSpec}-${arch}.${fileExtension}`;
+            : `https://storage.googleapis.com/golang/go${version}.${osSpec}-${arch}.${fileExtension}`;

        // ... but not in the local cache
        findSpy.mockImplementation(() => '');
--- a/action.yml
+++ b/action.yml
@@ -5,7 +5,7 @@ inputs:
  go-version:
    description: 'The Go version to download (if necessary) and use. Supports semver spec and ranges. Be sure to enclose this option in single quotation marks.'
  go-version-file:
-    description: 'Path to the go.mod, .tool-versions, or go.work file.'
+    description: 'Path to the go.mod or go.work file.'
  check-latest:
    description: 'Set this option to true if you want the action to always check for the latest available version that satisfies the version spec'
    default: false
--- a/dist/setup/index.js
+++ b/dist/setup/index.js
@@ -94583,7 +94583,7 @@ function getInfoFromDist(versionSpec, arch) {
        if (!version) {
            return null;
        }
-        const downloadUrl = `https://go.dev/dl/${version.files[0].filename}`;
+        const downloadUrl = `https://storage.googleapis.com/golang/${version.files[0].filename}`;
        return {
            type: 'dist',
            downloadUrl: downloadUrl,
@@ -94679,10 +94679,6 @@ function parseGoVersionFile(versionFilePath) {
        const matchGo = contents.match(/^go (\d+(\.\d+)*)/m);
        return matchGo ? matchGo[1] : '';
    }
-    else if (path.basename(versionFilePath) === '.tool-versions') {
-        const match = contents.match(/^golang\s+([^\n#]+)/m);
-        return match ? match[1].trim() : '';
-    }
    return contents.trim();
 }
 function resolveStableVersionDist(versionSpec, arch) {
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,12 +16,12 @@
        "@actions/http-client": "^2.2.1",
        "@actions/io": "^1.0.2",
        "@actions/tool-cache": "^2.0.2",
-        "semver": "^7.6.3"
+        "semver": "^7.7.2"
      },
      "devDependencies": {
        "@types/jest": "^29.5.14",
        "@types/node": "^24.1.0",
-        "@types/semver": "^7.5.8",
+        "@types/semver": "^7.7.1",
        "@typescript-eslint/eslint-plugin": "^8.31.1",
        "@typescript-eslint/parser": "^8.35.1",
        "@vercel/ncc": "^0.38.1",
@@ -1636,10 +1636,11 @@
      }
    },
    "node_modules/@types/semver": {
-      "version": "7.5.8",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.5.8.tgz",
-      "integrity": "sha512-I8EUhyrgfLrcTkzV3TSsGyl1tSuPrEDzr0yd5m90UgNxQkyDXULk3b6MlQqTCpZpNtWe1K0hzclnZkTcLBe2UQ==",
-      "dev": true
+      "version": "7.7.1",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz",
+      "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==",
+      "dev": true,
+      "license": "MIT"
    },
    "node_modules/@types/stack-utils": {
      "version": "2.0.3",
@@ -5555,9 +5556,9 @@
      "integrity": "sha512-0s+oAmw9zLl1V1cS9BtZN7JAd0cW5e0QH4W3LWEK6a4LaLEA2OTpGYWDY+6XasBLtz6wkm3u1xRw95mRuJ59WA=="
    },
    "node_modules/semver": {
-      "version": "7.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
-      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
+      "version": "7.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
+      "integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
      "license": "ISC",
      "bin": {
        "semver": "bin/semver.js"
--- a/package.json
+++ b/package.json
@@ -35,12 +35,12 @@
    "@actions/http-client": "^2.2.1",
    "@actions/io": "^1.0.2",
    "@actions/tool-cache": "^2.0.2",
-    "semver": "^7.6.3"
+    "semver": "^7.7.2"
  },
  "devDependencies": {
    "@types/jest": "^29.5.14",
    "@types/node": "^24.1.0",
-    "@types/semver": "^7.5.8",
+    "@types/semver": "^7.7.1",
    "@typescript-eslint/eslint-plugin": "^8.31.1",
    "@typescript-eslint/parser": "^8.35.1",
    "@vercel/ncc": "^0.38.1",
--- a/src/cache-save.ts
+++ b/src/cache-save.ts
@@ -15,7 +15,6 @@ process.on('uncaughtException', e => {
 // Added early exit to resolve issue with slow post action step:
 // - https://github.com/actions/setup-node/issues/878
 // https://github.com/actions/cache/pull/1217
-
 export async function run(earlyExit?: boolean) {
  try {
    const cacheInput = core.getBooleanInput('cache');
--- a/src/installer.ts
+++ b/src/installer.ts
@@ -389,7 +389,7 @@ async function getInfoFromDist(
    return null;
  }

-  const downloadUrl = `https://go.dev/dl/${version.files[0].filename}`;
+  const downloadUrl = `https://storage.googleapis.com/golang/${version.files[0].filename}`;

  return <IGoVersionInfo>{
    type: 'dist',
@@ -513,9 +513,6 @@ export function parseGoVersionFile(versionFilePath: string): string {
    // go directive: https://go.dev/ref/mod#go-mod-file-go
    const matchGo = contents.match(/^go (\d+(\.\d+)*)/m);
    return matchGo ? matchGo[1] : '';
-  } else if (path.basename(versionFilePath) === '.tool-versions') {
-    const match = contents.match(/^golang\s+([^\n#]+)/m);
-    return match ? match[1].trim() : '';
  }

  return contents.trim();