This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-3-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-3-test by this push:
new d69e74460b3 [v3-3-test] Pin the Go SDK CI toolchain to the patched Go
release (#71582) (#71585)
d69e74460b3 is described below
commit d69e74460b3811e3c7297ccaaf9add61bd783203
Author: Jason(Zhe-You) Liu <[email protected]>
AuthorDate: Sat Aug 15 05:14:09 2026 +0800
[v3-3-test] Pin the Go SDK CI toolchain to the patched Go release (#71582)
(#71585)
(cherry picked from commit 2aef6b1)
Co-authored-by: Stefan Wang <[email protected]>
---
.github/workflows/ci-amd.yml | 5 ++++-
.github/workflows/ci-arm.yml | 5 ++++-
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/ci-amd.yml b/.github/workflows/ci-amd.yml
index a4bee446280..0855afae6e2 100644
--- a/.github/workflows/ci-amd.yml
+++ b/.github/workflows/ci-amd.yml
@@ -946,7 +946,10 @@ jobs:
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #
v7.0.0
with:
- go-version: 1.25
+ # Pinned to the patch: actions/go-versions trails Go security
releases by weeks, and
+ # setup-go resolves from that manifest whenever it can match, so a
bare 1.25 lands on a
+ # toolchain whose standard library still carries advisories the scan
below fails on.
+ go-version: '1.25.13'
cache-dependency-path: go-sdk/go.sum
# keep this in sync with go.mod in go-sdk/
- name: Setup Gotestsum
diff --git a/.github/workflows/ci-arm.yml b/.github/workflows/ci-arm.yml
index 2d83625527b..02ce460df9b 100644
--- a/.github/workflows/ci-arm.yml
+++ b/.github/workflows/ci-arm.yml
@@ -939,7 +939,10 @@ jobs:
- name: Setup Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #
v7.0.0
with:
- go-version: 1.25
+ # Pinned to the patch: actions/go-versions trails Go security
releases by weeks, and
+ # setup-go resolves from that manifest whenever it can match, so a
bare 1.25 lands on a
+ # toolchain whose standard library still carries advisories the scan
below fails on.
+ go-version: '1.25.13'
cache-dependency-path: go-sdk/go.sum
# keep this in sync with go.mod in go-sdk/
- name: Setup Gotestsum
