govulncheck-action: semver tag 'v1' not updated for release v1.0.1

[bplessis-swi]

Hi guys,

The golang/govulncheck README document the use of the "@v1" tag for referencing the action and common practice/expectations for those short tag is to be a floating tag, however when trying to use parameters like go-version-file that are also documented in the README we get a warning like this:

Warning: Unexpected input(s) 'go-version-file', 'repo-checkout', valid inputs are ['go-version-input', 'check-latest', 'cache', 'go-package']

After a short pondering it occured to me to check the tag, and this happens since thoses options are part of release 1.0.1, and v1 is actually really v1.0.0.

It would be great to convert "v1" as a floating tag and create a "v1.0.0" for identification of the old release.
Alternatively maybe update the README.md with the current @v1.0.1 tag but that is not the common expectation around github actions.

Regards,
Benoit

[thanm]

@golang/vulndb

[zpavlinovic]

Is this related to the govulncheck command or the govulncheck Github action?

[bplessis-swi]

it's the govulncheck Github Action sorry

[zpavlinovic]

If I understand correctly, the idea is to always have the floating v1 point to the latest release of v1, which in this case is v1.0.1. This would also imply that the previous v1 version, in this case v1.0.0 should lose the v1 floating tag?

but that is not the common expectation around github actions.

You have a link for this perhaps?

[bplessis-swi]

For example you can see that behavior on the setup-go action:

https://github.com/actions/setup-go/tags

v4.1.0: 93397be
v4: 93397be
v4.0.1: 4d34df0
v3.5.0: 6edd440
v3: 6edd440

[bplessis-swi]

This would also imply that the previous v1 version, in this case v1.0.0 should lose the v1 floating tag?

Yes,a tag can only point to on commit so the update of the 'v1' tag will make it move to the new release (it need some 'force' btw ^^)

[prattmic]

v1 now points to 7da72f730e37eeaad891fcff0a532d27ed737cd4
v1.0.0 was also created to point to dd3ead030e4f2cf713062f7a3395191802364e13