Skip to content

Conversation

@kolyshkin
Copy link
Contributor

This was added by dependabot in commit 0b53626. Seems there is a bug about it: dependabot/dependabot-core#11933.

Having "toolchain" means instead of using installed go version to build/test, the version specified in toolchain is [downloaded and] used, which might not be what we actually want.

For more details on toolchain directive, see
https://go.dev/doc/toolchain.

This was added by dependabot in commit 0b53626. Seems there is a bug
about it: dependabot/dependabot-core#11933.

Having "toolchain" means instead of using installed go version to
build/test, the version specified in toolchain is [downloaded and] used,
which might not be what we actually want.

For more details on toolchain directive, see
https://go.dev/doc/toolchain.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Copy link
Member

@rata rata left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@rata
Copy link
Member

rata commented Apr 9, 2025

Let's hope this doesn't cause dependabot to add it again later. Let's see :)

@rata rata merged commit 636eb4b into opencontainers:main Apr 9, 2025
34 checks passed
@cyphar
Copy link
Member

cyphar commented Apr 9, 2025

I saw other people complaining about it being added automatically. Hopefully this gets fixed (maybe we should add a CI lint to block it, just to be sure).

@kolyshkin
Copy link
Contributor Author

I saw other people complaining about it being added automatically. Hopefully this gets fixed (maybe we should add a CI lint to block it, just to be sure).

Sometimes it is useful, for example, see commit 319e133 / PR #4407, but unless we come across something like #4233 again, we should not use toolchain. I'll add a check.

@kolyshkin
Copy link
Contributor Author

Sometimes it is useful, for example, see commit 319e133 / PR #4407, but unless we come across something like #4233 again, we should not use toolchain.

Hmm, maybe we don't actually need toolchain even in cases like this, since we can say e.g. go 1.30.2.

I'll add a check.

See #4721.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants