feat: Support go-version-file

.github/actions/secure-project-checkout-go/action.yml

@@ -12,7 +12,10 @@ inputs:
     default: ${{ github.token }}
   go-version:
     description: "The Go version to use, as expected by https://github.com/actions/setup-go."
-    required: true
+    required: false
+  go-version-file:
+    description: "Path to the go.mod or go.work file."
+    required: false
 
 runs:
   using: "composite"
@@ -26,7 +29,19 @@ runs:
         token: ${{ inputs.token }}
         path: ${{ inputs.path }}
 
+    - name: Validate Go version.
+      env:
+        GO_VERSION: ${{ inputs.go-version }}
+        GO_VERSION_FILE: ${{ inputs.go-version-file }}
+      run: |
+        set -euo pipefail
+        if [ "${GO_VERSION}" == "" ] && [ "${GO_VERSION_FILE}" == "" ]; then
+            echo "::error::One of go-version or go-version-file should be specified."
+            exit 1
+        fi
+
     - name: Set up Go environment
       uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
       with:
         go-version: ${{ inputs.go-version }}
+        go-version-file: ${{ inputs.go-version-file }}

.github/workflows/builder_go_slsa3.yml

@@ -37,7 +37,11 @@ on:
     inputs:
       go-version:
         description: "The go version to use."
-        required: true
+        required: false
+        type: string
+      go-version-file:
+        description: "The go version to use."
+        required: false
         type: string
       upload-assets:
         description: >
@@ -184,6 +188,7 @@ jobs:
         with:
           path: __PROJECT_CHECKOUT_DIR__
           go-version: ${{ inputs.go-version }}
+          go-version-file: ${{ inputs.go-version-file }}
 
       - name: Download builder
         uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-download-artifact
@@ -230,6 +235,7 @@ jobs:
         with:
           path: __PROJECT_CHECKOUT_DIR__
           go-version: ${{ inputs.go-version }}
+          go-version-file: ${{ inputs.go-version-file }}
 
       - name: Download builder
         uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-download-artifact

CHANGELOG.md

@@ -1,9 +1,16 @@
 # CHANGELOG
 
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
 <!-- markdown-toc --bullets="-" -i CHANGELOG.md -->
 
 <!-- toc -->
 
+- [Unreleased](#unreleased)
+  - [X.Y.Z: Go builder](#xyz-go-builder)
 - [v1.6.0](#v160)
   - [Summary of changes](#summary-of-changes)
     - [Go builder](#go-builder)
@@ -71,7 +78,21 @@
 
 <!-- tocstop -->
 
-<!-- Information on the next release will be added here. -->
+## Unreleased
+
+<!--
+Information on the next release will be added here.
+
+Use the format "X.Y.Z: Go builder" etc. for format headers to avoid header name
+duplication."
+-->
+
+### X.Y.Z: Go builder
+
+- **Added**: A new
+  [go-version-file](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/go/README.md#workflow-inputs)
+  input was added. This allows you to specify a go.mod file in order to track
+  which version of Go is used for your project.
 
 ## v1.6.0