[bug] The specified go version file at: go.mod does not exist

[ianlewis]

The go-version-file input to the Go builder passes the value to setup-go but since the project is checked out to a different directory than the GITHUB_WORKSPACE setup-go will fail to find the file.

The path given to setup-go needs to be joined with inputs.path where the project is checked out in secure-project-checkout.

slsa-github-generator/.github/actions/secure-project-checkout-go/action.yml

Line 62 in 7e31fad

go-version-file: ${{ inputs.go-version-file }}

[laurentsimon]

@raghavkaul is this the problem you encountered on scorecard a couple weeks back?

Let's create e2e test for this one, if we don't have one already. I can squeeze this fix in the next release (this week)

[OpenWaygate]

I still encounter this bug with v1.9.0, even if I have go.mod in project root.

    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.9.0
    with:
      go-version-file: go.mod

[OpenWaygate]

Seems that the fixing code is not contained in v1.9.0

[ianlewis]

Seems that the fixing code is not contained in v1.9.0

Yes, this still hasn't been released :(

[laurentsimon]

We plan to release very soon. /cc @ramonpetgrave64 We have one or two more issues to address