fix(go-autoupdate): fall back to direct dependencies when a full update breaks the build

go get -u updates indirect modules past the versions their parents
support. For Kubernetes projects the build then fails and the daily
update has failed since early September. The step now builds after a
full update. On failure it restores go.mod and go.sum and updates the
direct dependencies only.

The Go toolchain also uses check-latest so a range such as >=1.24
resolves to the newest release.

.github/workflows/go-autoupdate.yaml

@@ -54,12 +54,26 @@ jobs:
         uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version }}
+          check-latest: true
           cache: true
 
       - name: Update dependencies
+        shell: bash
         run: |
-          go get -u ./...
-          go mod tidy
+          # Indirect modules can move ahead of their parents (for example
+          # kube-openapi ahead of apimachinery), which breaks the build.
+          update_all() { go get -u ./... && go mod tidy && go build ./...; }
+          update_direct() {
+            local mods=()
+            while IFS= read -r m; do mods+=("$m"); done < <(go list -m -f '{{if and (not .Indirect) (not .Main)}}{{.Path}}@latest{{end}}' all)
+            if [ "${#mods[@]}" -gt 0 ]; then go get "${mods[@]}"; fi
+            go mod tidy
+          }
+          if ! update_all; then
+            echo "::warning title=Full update failed::Falling back to direct dependencies only"
+            git checkout -- go.mod go.sum
+            update_direct
+          fi
 
       - name: Run tests
         run: go test -race -cover ./...