in setup-go, why hardcode the Go version default?

[miparnisari]

https://github.com/authzed/actions/blame/1342b8141c9b75b0a4a67fc4520a66d54432995d/setup-go/action.yaml#L7

why do we hardcode the version default there? why not pick it up from the go.mod? that's how the original setup-go action does it: https://github.com/actions/setup-go/blob/main/action.yml#L5-L8

[jzelinskie]

This was to centralize the version of Go used for all of our projects so that when govulncheck runs, we only need to update one thing instead of every file everywhere.

go.mod is supposed to contain the lowest supported version of Go for that codebase. It was only recently that they added the toolchain directive where now you can say "this is the version you should use".

I would confirm whether or not setting those two directives correctly in go.mod does the right behavior for the action, but even if it does, you still have to make the decision as to whether or not you're going to update the toolchain across every module for every Go release.