go get -u updates indirect modules past the versions their parents
support. For Kubernetes projects the build then fails and the daily
update has failed since early September. The step now builds after a
full update. On failure it restores go.mod and go.sum and updates the
direct dependencies only.
The Go toolchain also uses check-latest so a range such as >=1.24
resolves to the newest release.
The && operator bound to the first operand only, so the label branch
returned the bare label before the format call. Parentheses keep the
whole fallback chain on the && branch.
The release, release-cgo and autoupdate workflows must run on a runner
the caller chooses. Each workflow now takes a runner input. It accepts
a label or a JSON object that selects a runner group.
The workflow uses inputs.runner first. It then uses the
SHARED_ACTIONS_RUNNER variable and falls back to ubuntu-latest. Callers
that set nothing keep the old behaviour.
Every job now has a timeout. Release and autoupdate runs use a
concurrency group that never cancels a running job.
create-pull-request and the gh pr merge step both hard-required HOMEBREW_TAP_TOKEN,
so any consumer repo without that secret got 'Input token not supplied' and the
whole Autoupdate run failed. A same-repo PR needs only the caller's
contents/pull-requests write; fall back to the auto-provisioned github.token.
Consumers that do set the tap token keep current behavior.
lukaszraczylo