From 539079117478b1fe64b6c3f71f55aec9969baff7 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Fri, 2 Oct 2026 02:43:13 +0100
Subject: [PATCH] fix(go-autoupdate): fall back to direct dependencies when a
 full update breaks the build

go get -u updates indirect modules past the versions their parents
support. For Kubernetes projects the build then fails and the daily
update has failed since early September. The step now builds after a
full update. On failure it restores go.mod and go.sum and updates the
direct dependencies only.

The Go toolchain also uses check-latest so a range such as >=1.24
resolves to the newest release.
---
 .github/workflows/go-autoupdate.yaml | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/go-autoupdate.yaml b/.github/workflows/go-autoupdate.yaml
index 371e399..c30c828 100644
--- a/.github/workflows/go-autoupdate.yaml
+++ b/.github/workflows/go-autoupdate.yaml
@@ -54,12 +54,26 @@ jobs:
         uses: actions/setup-go@v6
         with:
           go-version: ${{ inputs.go-version }}
+          check-latest: true
           cache: true
 
       - name: Update dependencies
+        shell: bash
         run: |
-          go get -u ./...
-          go mod tidy
+          # Indirect modules can move ahead of their parents (for example
+          # kube-openapi ahead of apimachinery), which breaks the build.
+          update_all() { go get -u ./... && go mod tidy && go build ./...; }
+          update_direct() {
+            local mods=()
+            while IFS= read -r m; do mods+=("$m"); done < <(go list -m -f '{{if and (not .Indirect) (not .Main)}}{{.Path}}@latest{{end}}' all)
+            if [ "${#mods[@]}" -gt 0 ]; then go get "${mods[@]}"; fi
+            go mod tidy
+          }
+          if ! update_all; then
+            echo "::warning title=Full update failed::Falling back to direct dependencies only"
+            git checkout -- go.mod go.sum
+            update_direct
+          fi
 
       - name: Run tests
         run: go test -race -cover ./...