From c97756fd4e8442bdfd0881c0f347b63f43cf9e5a Mon Sep 17 00:00:00 2001
From: htjulia <htjulia1@gmail.com>
Date: Sun, 5 Jul 2026 21:33:06 +0900
Subject: [PATCH] ci(govulncheck): set GOTOOLCHAIN=auto for the vuln scan

- setup-go v6 defaults GOTOOLCHAIN to "local", which blocks installing
  govulncheck@latest (needs go >= 1.25) against the go1.24.6 toolchain
- pinning GOTOOLCHAIN=auto restores the pre-v6 behavior so the tool
  install can pull the newer toolchain it requires

#ci #govulncheck

Co-Authored-By: htjulia <htjulia1@gmail.com>
---
 .github/workflows/ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index acee154..f90b38b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,6 +76,11 @@ jobs:
           go-version-file: go.mod
           cache: true
       - name: govulncheck
+        env:
+          # govulncheck@latest requires a newer Go than go.mod pins; allow the
+          # toolchain to auto-upgrade for the tool install. setup-go v6 defaults
+          # GOTOOLCHAIN to "local", which otherwise blocks this.
+          GOTOOLCHAIN: auto
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...