dependabot / dependabot/dependabot-core

dependabot-action for github enterprise is not using the latest docker image for dependabot-updater-gomod

Open
#9,178 8 comments 8 reactions 0 assignees View on GitHub
L: go:modules T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 14h
Merged PRs (30d)
156

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

go

### Package manager version

1.22

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content
```
version: 2

updates:
# Enable version updates for go
- package-ecosystem: "gomod"
# Look for go.mod and go.sum files in the `root` directory
directory: "/monitor/"
# Check the public registry for updates every day (weekdays)
schedule:
interval: "daily"
allow:
# Allow both direct and indirect updates for all packages
- dependency-type: "all"
```
### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Dependabot should be able to run with go 1.22 instead the following error is thrown most likely because the docker image is build with go 1.21.5
`ERROR go: go.mod requires go >= 1.22 (running go 1.21.5; GOTOOLCHAIN=local)`

As seen on the logs the following image is downloaded:
![image](https://github.com/dependabot/dependabot-core/assets/12953702/294b67dc-21ec-4d94-aeb1-1a3a24900775)

Checking the action [repository](https://github.com/github/dependabot-action/blob/ghes-3.9/docker/Dockerfile.gomod), for every tag for ghes-xx the image version is all the same and not updated to the latest one in the [main branch](https://github.com/github/dependabot-action/blob/main/docker/Dockerfile.gomod)

As seen in the dependebot-core repository the Docker image already supports go 1.22:
https://github.com/dependabot/dependabot-core/blob/main/go_modules/Dockerfile

Is it possible to update the tags for github enterprise to use the latest image version? This way go.mod can be updated and managed by dependabot with version 1.22

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.