(airflow) branch main updated: Pin the Go SDK CI toolchain to the patched Go release (#71582)

[jasonliu]

This is an automated email from the ASF dual-hosted git repository.

jason810496 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git


The following commit(s) were added to refs/heads/main by this push:
     new 2aef6b1c80c Pin the Go SDK CI toolchain to the patched Go release 
(#71582)
2aef6b1c80c is described below

commit 2aef6b1c80c8c57b83972731090d1e578e613459
Author: Stefan Wang <1fan...@gmail.com>
AuthorDate: Thu Aug 13 18:35:26 2026 -0700

    Pin the Go SDK CI toolchain to the patched Go release (#71582)
---
 .github/workflows/ci-amd.yml | 5 ++++-
 .github/workflows/ci-arm.yml | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-amd.yml b/.github/workflows/ci-amd.yml
index d1dd65c08df..d345fcb8c5c 100644
--- a/.github/workflows/ci-amd.yml
+++ b/.github/workflows/ci-amd.yml
@@ -998,7 +998,10 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # 
v7.0.0
         with:
-          go-version: 1.25
+          # Pinned to the patch: actions/go-versions trails Go security 
releases by weeks, and
+          # setup-go resolves from that manifest whenever it can match, so a 
bare 1.25 lands on a
+          # toolchain whose standard library still carries advisories the scan 
below fails on.
+          go-version: '1.25.13'
           cache-dependency-path: go-sdk/go.sum
       # keep this in sync with go.mod in go-sdk/
       - name: Setup Gotestsum
diff --git a/.github/workflows/ci-arm.yml b/.github/workflows/ci-arm.yml
index a4a4355b556..8389830e958 100644
--- a/.github/workflows/ci-arm.yml
+++ b/.github/workflows/ci-arm.yml
@@ -987,7 +987,10 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # 
v7.0.0
         with:
-          go-version: 1.25
+          # Pinned to the patch: actions/go-versions trails Go security 
releases by weeks, and
+          # setup-go resolves from that manifest whenever it can match, so a 
bare 1.25 lands on a
+          # toolchain whose standard library still carries advisories the scan 
below fails on.
+          go-version: '1.25.13'
           cache-dependency-path: go-sdk/go.sum
       # keep this in sync with go.mod in go-sdk/
       - name: Setup Gotestsum