`check-latest` doesn't work for `go.mod` file with patch version in `go` line

[DmitriyLewen]

Description:
When the go.mod file uses a patch version in the go line, setup-go installs this version even when the check-latest option is used.
However, the go line only indicates the minimum Go version required for the project.
You can see our tests here - aquasecurity/trivy#7163 (comment)

Action version:
tested with:

• 4dc6199 # v6.1.0
• 7a3fe6c # v6.2.0

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:
go 1.25.4 from go.mod file.

Repro steps:

1. Set go path version in go.mod file
2. Use the following options:
   2.1. go-version-file: go.mod
   2.2. check-latest: true

You can see test run in my test repo - https://github.com/DmitriyLewen/test-setup-go-flags/actions/runs/21582509578/job/62182731321

Expected behavior:
setup latest go version (1.25.6 now).

Actual behavior:
1.25.4 version has been installed

[mahabaleshwars]

Hi @DmitriyLewen,
Thank you for creating this issue. We will investigate it and provide feedback as soon as we have some updates.

[DmitriyLewen]

I investigated yerstarday a bit.
Feel free to ignore my thought.

It looks like problem with _findMatch() function.
versionSpec is patch version (1.25.4 for this case). So this function finds only this version from candidates.

IIUC you can trim patch version when check-latest option is used:

setup-go/src/installer.ts

Lines 76 to 91 in a5f9b05

	if (checkLatest) {
	core.info('Attempting to resolve the latest version from the manifest...');
	const resolvedVersion = await resolveVersionFromManifest(
	versionSpec,
	true,
	auth,
	arch,
	manifest
	);
	if (resolvedVersion) {
	versionSpec = resolvedVersion;
	core.info(`Resolved as '${versionSpec}'`);
	} else {
	core.info(`Failed to resolve version ${versionSpec} from manifest`);
	}
	}

[priya-kinthali]

Hello @DmitriyLewen👋,
Thanks for the detailed report and for sharing the repro steps!
As per the current design in the setup-go repository, when the go-version or go-version-file input is provided in major.minor format, and check-latest is set to true, the action first checks whether the cached version is the latest available. If the cached version is not up to date, it resolves the latest version by pulling from the main branch of the go-versions repository, and if needed it falls back to downloading directly from go.dev, as described in the actions/setup-go version resolution behaviour.
However, when a specific patch version is provided (for example 1.25.4), the action treats it as a pinned version and will install exactly that patch version, even if a newer patch release exists.
To have the action automatically pick up the latest patch release, please provide the version in major.minor format (for example 1.25) when using check-latest.
Hope this helps clarify the current behaviour. Thank you again!

[DmitriyLewen]

Hello @priya-kinthali
Thanks for your answer!

Unfortunately, we can't set a major.minor version because Go sets the patch version from one of the child dependencies...

However, the behaviour for Go and setup-go is different (because the version from the go line in the go.mod file is the minimal required version) - perhaps it makes sense to add information in README.md that the check-latest flag doesn't work for major.minor.patch versions.