`go-version-file` treats go.tool.mod contents as version string

[dwisiswant0]

When you point go-version-file at a separate tools modfile like go.tool.mod, setup-go grabs the whole file content as the version spec instead of pulling out the go or toolchain directive.

That leads to version resolution blowing up with something like:

Unable to find Go version 'module ...' for platform linux and architecture x64.

Separate tools modfiles are becoming more common with Go 1.24+. They have a module line, a go directive, and a tool block, and they should get parsed for version info the same way as go.mod or go.work.

There's this good article¹ that explains Go 1.24+ tool dependency management, including how to use a separate modfile with -modfile=go.tool.mod for tools. It's a practical approach that setup-go should support through go-version-file.

Repro:

Here's a workflow snippet that fails:

- uses: actions/setup-go@v6
  with:
    go-version-file: go.tool.mod
    check-latest: true
    cache: true
    cache-dependency-path: go.tool.sum

And the go.tool.mod file:

module nuclei-tools

go 1.26.1

tool (
	github.com/dvyukov/go-fuzz/go-fuzz
	github.com/dvyukov/go-fuzz/go-fuzz-build
	golang.org/x/vuln/cmd/govulncheck
)

Check out the full logs from a failing run here: https://github.com/projectdiscovery/nuclei/actions/runs/23991084237

(backed up the raw logs just in case the link expires)

2026-04-05T00:51:32.2903135Z Current runner version: '2.333.1'
2026-04-05T00:51:32.2928177Z ##[group]Runner Image Provisioner
2026-04-05T00:51:32.2929032Z Hosted Compute Agent
2026-04-05T00:51:32.2929654Z Version: 20260213.493
2026-04-05T00:51:32.2930233Z Commit: 5c115507f6dd24b8de37d8bbe0bb4509d0cc0fa3
2026-04-05T00:51:32.2930911Z Build Date: 2026-02-13T00:28:41Z
2026-04-05T00:51:32.2931510Z Worker ID: {0cbf60f5-9c69-4cc9-882f-aa3c8f5d119b}
2026-04-05T00:51:32.2932264Z Azure Region: westcentralus
2026-04-05T00:51:32.2932828Z ##[endgroup]
2026-04-05T00:51:32.2934269Z ##[group]Operating System
2026-04-05T00:51:32.2935213Z Ubuntu
2026-04-05T00:51:32.2935642Z 24.04.4
2026-04-05T00:51:32.2936094Z LTS
2026-04-05T00:51:32.2936569Z ##[endgroup]
2026-04-05T00:51:32.2937107Z ##[group]Runner Image
2026-04-05T00:51:32.2937605Z Image: ubuntu-24.04
2026-04-05T00:51:32.2938140Z Version: 20260329.72.1
2026-04-05T00:51:32.2939267Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260329.72/images/ubuntu/Ubuntu2404-Readme.md
2026-04-05T00:51:32.2940768Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260329.72
2026-04-05T00:51:32.2941616Z ##[endgroup]
2026-04-05T00:51:32.2942806Z ##[group]GITHUB_TOKEN Permissions
2026-04-05T00:51:32.2945300Z Actions: read
2026-04-05T00:51:32.2945820Z Contents: read
2026-04-05T00:51:32.2946381Z Metadata: read
2026-04-05T00:51:32.2946929Z SecurityEvents: write
2026-04-05T00:51:32.2947405Z ##[endgroup]
2026-04-05T00:51:32.2950050Z Secret source: Actions
2026-04-05T00:51:32.2950736Z Prepare workflow directory
2026-04-05T00:51:32.3370198Z Prepare all required actions
2026-04-05T00:51:32.3408312Z Getting action download info
2026-04-05T00:51:32.7888073Z Download action repository 'actions/checkout@v6' (SHA:de0fac2e4500dabe0009e67214ff5f5447ce83dd)
2026-04-05T00:51:32.9247159Z Download action repository 'projectdiscovery/actions@v1' (SHA:24a582201fca4fbe677786c6e8c2416778ab33c5)
2026-04-05T00:51:33.4551502Z Download action repository 'github/codeql-action@v4' (SHA:c10b8064de6f491fea524254123dbe5e09572f13)
2026-04-05T00:51:35.3621090Z Getting action download info
2026-04-05T00:51:35.5205238Z Download action repository 'actions/setup-go@v6' (SHA:4a3601121dd01d1626a1e23e37211e3254c1c06c)
2026-04-05T00:51:36.7211978Z Complete job name: govulncheck
2026-04-05T00:51:36.7861794Z ##[group]Run actions/checkout@v6
2026-04-05T00:51:36.7862413Z with:
2026-04-05T00:51:36.7862672Z   repository: projectdiscovery/nuclei
2026-04-05T00:51:36.7863154Z   token: ***
2026-04-05T00:51:36.7863379Z   ssh-strict: true
2026-04-05T00:51:36.7863616Z   ssh-user: git
2026-04-05T00:51:36.7863852Z   persist-credentials: true
2026-04-05T00:51:36.7864116Z   clean: true
2026-04-05T00:51:36.7864348Z   sparse-checkout-cone-mode: true
2026-04-05T00:51:36.7864918Z   fetch-depth: 1
2026-04-05T00:51:36.7865182Z   fetch-tags: false
2026-04-05T00:51:36.7865425Z   show-progress: true
2026-04-05T00:51:36.7865664Z   lfs: false
2026-04-05T00:51:36.7865879Z   submodules: false
2026-04-05T00:51:36.7866116Z   set-safe-directory: true
2026-04-05T00:51:36.7866657Z env:
2026-04-05T00:51:36.7866896Z   OUTPUT: /tmp/results.sarif
2026-04-05T00:51:36.7867158Z ##[endgroup]
2026-04-05T00:51:36.8780738Z Syncing repository: projectdiscovery/nuclei
2026-04-05T00:51:36.8782606Z ##[group]Getting Git version info
2026-04-05T00:51:36.8783077Z Working directory is '/home/runner/work/nuclei/nuclei'
2026-04-05T00:51:36.8783858Z [command]/usr/bin/git version
2026-04-05T00:51:36.8813946Z git version 2.53.0
2026-04-05T00:51:36.8869381Z ##[endgroup]
2026-04-05T00:51:36.8886167Z Temporarily overriding HOME='/home/runner/work/_temp/d3b250cf-9444-4aa1-8a55-a1bd96b9aa33' before making global git config changes
2026-04-05T00:51:36.8887746Z Adding repository directory to the temporary git global config as a safe directory
2026-04-05T00:51:36.8892324Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/nuclei/nuclei
2026-04-05T00:51:36.8927233Z Deleting the contents of '/home/runner/work/nuclei/nuclei'
2026-04-05T00:51:36.8931797Z ##[group]Initializing the repository
2026-04-05T00:51:36.8937201Z [command]/usr/bin/git init /home/runner/work/nuclei/nuclei
2026-04-05T00:51:36.9016346Z hint: Using 'master' as the name for the initial branch. This default branch name
2026-04-05T00:51:36.9017470Z hint: will change to "main" in Git 3.0. To configure the initial branch name
2026-04-05T00:51:36.9018383Z hint: to use in all of your new repositories, which will suppress this warning,
2026-04-05T00:51:36.9019114Z hint: call:
2026-04-05T00:51:36.9019501Z hint:
2026-04-05T00:51:36.9019884Z hint: 	git config --global init.defaultBranch <name>
2026-04-05T00:51:36.9020486Z hint:
2026-04-05T00:51:36.9021107Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
2026-04-05T00:51:36.9021850Z hint: 'development'. The just-created branch can be renamed via this command:
2026-04-05T00:51:36.9022647Z hint:
2026-04-05T00:51:36.9022926Z hint: 	git branch -m <name>
2026-04-05T00:51:36.9023188Z hint:
2026-04-05T00:51:36.9023587Z hint: Disable this message with "git config set advice.defaultBranchName false"
2026-04-05T00:51:36.9024190Z Initialized empty Git repository in /home/runner/work/nuclei/nuclei/.git/
2026-04-05T00:51:36.9028294Z [command]/usr/bin/git remote add origin https://github.com/projectdiscovery/nuclei
2026-04-05T00:51:36.9058713Z ##[endgroup]
2026-04-05T00:51:36.9059211Z ##[group]Disabling automatic garbage collection
2026-04-05T00:51:36.9062831Z [command]/usr/bin/git config --local gc.auto 0
2026-04-05T00:51:36.9090450Z ##[endgroup]
2026-04-05T00:51:36.9090891Z ##[group]Setting up auth
2026-04-05T00:51:36.9092126Z Removing SSH command configuration
2026-04-05T00:51:36.9098042Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
2026-04-05T00:51:36.9128140Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
2026-04-05T00:51:36.9407775Z Removing HTTP extra header
2026-04-05T00:51:36.9412601Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
2026-04-05T00:51:36.9442166Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
2026-04-05T00:51:36.9654991Z Removing includeIf entries pointing to credentials config files
2026-04-05T00:51:36.9661579Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
2026-04-05T00:51:36.9695265Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
2026-04-05T00:51:36.9916368Z [command]/usr/bin/git config --file /home/runner/work/_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config http.https://github.com/.extraheader AUTHORIZATION: basic ***
2026-04-05T00:51:36.9951866Z [command]/usr/bin/git config --local includeIf.gitdir:/home/runner/work/nuclei/nuclei/.git.path /home/runner/work/_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:36.9980723Z [command]/usr/bin/git config --local includeIf.gitdir:/home/runner/work/nuclei/nuclei/.git/worktrees/*.path /home/runner/work/_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:37.0009690Z [command]/usr/bin/git config --local includeIf.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:37.0039026Z [command]/usr/bin/git config --local includeIf.gitdir:/github/workspace/.git/worktrees/*.path /github/runner_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:37.0065447Z ##[endgroup]
2026-04-05T00:51:37.0065909Z ##[group]Fetching the repository
2026-04-05T00:51:37.0073295Z [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +c6fb1ae486185320199e9020897dc5846c1a8fef:refs/remotes/origin/dev
2026-04-05T00:51:38.4212559Z From https://github.com/projectdiscovery/nuclei
2026-04-05T00:51:38.4213610Z  * [new ref]         c6fb1ae486185320199e9020897dc5846c1a8fef -> origin/dev
2026-04-05T00:51:38.4249439Z [command]/usr/bin/git branch --list --remote origin/dev
2026-04-05T00:51:38.4281946Z   origin/dev
2026-04-05T00:51:38.4290763Z [command]/usr/bin/git rev-parse refs/remotes/origin/dev
2026-04-05T00:51:38.4316052Z c6fb1ae486185320199e9020897dc5846c1a8fef
2026-04-05T00:51:38.4320431Z ##[endgroup]
2026-04-05T00:51:38.4321177Z ##[group]Determining the checkout info
2026-04-05T00:51:38.4323607Z ##[endgroup]
2026-04-05T00:51:38.4327610Z [command]/usr/bin/git sparse-checkout disable
2026-04-05T00:51:38.4369361Z [command]/usr/bin/git config --local --unset-all extensions.worktreeConfig
2026-04-05T00:51:38.4397845Z ##[group]Checking out the ref
2026-04-05T00:51:38.4402100Z [command]/usr/bin/git checkout --progress --force -B dev refs/remotes/origin/dev
2026-04-05T00:51:38.5575852Z Switched to a new branch 'dev'
2026-04-05T00:51:38.5579121Z branch 'dev' set up to track 'origin/dev'.
2026-04-05T00:51:38.5589837Z ##[endgroup]
2026-04-05T00:51:38.5632687Z [command]/usr/bin/git log -1 --format=%H
2026-04-05T00:51:38.5657508Z c6fb1ae486185320199e9020897dc5846c1a8fef
2026-04-05T00:51:38.5899938Z ##[group]Run projectdiscovery/actions/setup/go@v1
2026-04-05T00:51:38.5900291Z with:
2026-04-05T00:51:38.5900488Z   go-version-file: go.tool.mod
2026-04-05T00:51:38.5900746Z   cache-dependency-path: go.tool.sum
2026-04-05T00:51:38.5900994Z   check-latest: true
2026-04-05T00:51:38.5901329Z   token: ***
2026-04-05T00:51:38.5901501Z   cache: true
2026-04-05T00:51:38.5901677Z env:
2026-04-05T00:51:38.5901847Z   OUTPUT: /tmp/results.sarif
2026-04-05T00:51:38.5902072Z ##[endgroup]
2026-04-05T00:51:38.6075149Z ##[group]Run actions/setup-go@v6
2026-04-05T00:51:38.6075617Z with:
2026-04-05T00:51:38.6075984Z   go-version-file: go.tool.mod
2026-04-05T00:51:38.6076398Z   check-latest: true
2026-04-05T00:51:38.6077022Z   token: ***
2026-04-05T00:51:38.6077337Z   cache: true
2026-04-05T00:51:38.6077699Z   cache-dependency-path: go.tool.sum
2026-04-05T00:51:38.6078143Z env:
2026-04-05T00:51:38.6078465Z   OUTPUT: /tmp/results.sarif
2026-04-05T00:51:38.6078866Z ##[endgroup]
2026-04-05T00:51:38.7471064Z Setup go version spec module nuclei-tools
2026-04-05T00:51:38.7471484Z 
2026-04-05T00:51:38.7471581Z go 1.26.1
2026-04-05T00:51:38.7471718Z 
2026-04-05T00:51:38.7471815Z tool (
2026-04-05T00:51:38.7472048Z 	github.com/dvyukov/go-fuzz/go-fuzz
2026-04-05T00:51:38.7472393Z 	github.com/dvyukov/go-fuzz/go-fuzz-build
2026-04-05T00:51:38.7472742Z 	golang.org/x/vuln/cmd/govulncheck
2026-04-05T00:51:38.7473027Z )
2026-04-05T00:51:38.7473152Z 
2026-04-05T00:51:38.7473271Z require (
2026-04-05T00:51:38.7473786Z 	github.com/dvyukov/go-fuzz v0.0.0-20240924070022-e577bee5275c // indirect
2026-04-05T00:51:38.7474878Z 	github.com/elazarl/go-bindata-assetfs v1.0.1 // indirect
2026-04-05T00:51:38.7475596Z 	github.com/stephens2424/writerset v1.0.2 // indirect
2026-04-05T00:51:38.7476234Z 	golang.org/x/mod v0.34.0 // indirect
2026-04-05T00:51:38.7476755Z 	golang.org/x/sync v0.20.0 // indirect
2026-04-05T00:51:38.7477256Z 	golang.org/x/sys v0.42.0 // indirect
2026-04-05T00:51:38.7477932Z 	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
2026-04-05T00:51:38.7478668Z 	golang.org/x/tools v0.43.0 // indirect
2026-04-05T00:51:38.7479198Z 	golang.org/x/vuln v1.1.4 // indirect
2026-04-05T00:51:38.7479682Z )
2026-04-05T00:51:38.7480171Z Attempting to resolve the latest version from the manifest...
2026-04-05T00:51:39.4909659Z matching module nuclei-tools
2026-04-05T00:51:39.4910025Z 
2026-04-05T00:51:39.4910145Z go 1.26.1
2026-04-05T00:51:39.4910323Z 
2026-04-05T00:51:39.4910452Z tool (
2026-04-05T00:51:39.4910770Z 	github.com/dvyukov/go-fuzz/go-fuzz
2026-04-05T00:51:39.4911260Z 	github.com/dvyukov/go-fuzz/go-fuzz-build
2026-04-05T00:51:39.4911769Z 	golang.org/x/vuln/cmd/govulncheck
2026-04-05T00:51:39.4912191Z )
2026-04-05T00:51:39.4912818Z 
2026-04-05T00:51:39.4912955Z require (
2026-04-05T00:51:39.4913448Z 	github.com/dvyukov/go-fuzz v0.0.0-20240924070022-e577bee5275c // indirect
2026-04-05T00:51:39.4914248Z 	github.com/elazarl/go-bindata-assetfs v1.0.1 // indirect
2026-04-05T00:51:39.4915165Z 	github.com/stephens2424/writerset v1.0.2 // indirect
2026-04-05T00:51:39.4915698Z 	golang.org/x/mod v0.34.0 // indirect
2026-04-05T00:51:39.4916141Z 	golang.org/x/sync v0.20.0 // indirect
2026-04-05T00:51:39.4916583Z 	golang.org/x/sys v0.42.0 // indirect
2026-04-05T00:51:39.4917148Z 	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
2026-04-05T00:51:39.4917770Z 	golang.org/x/tools v0.43.0 // indirect
2026-04-05T00:51:39.4918227Z 	golang.org/x/vuln v1.1.4 // indirect
2026-04-05T00:51:39.4918608Z )...
2026-04-05T00:51:39.5391622Z Failed to resolve version module nuclei-tools
2026-04-05T00:51:39.5392041Z 
2026-04-05T00:51:39.5392159Z go 1.26.1
2026-04-05T00:51:39.5392321Z 
2026-04-05T00:51:39.5392439Z tool (
2026-04-05T00:51:39.5392766Z 	github.com/dvyukov/go-fuzz/go-fuzz
2026-04-05T00:51:39.5393144Z 	github.com/dvyukov/go-fuzz/go-fuzz-build
2026-04-05T00:51:39.5393428Z 	golang.org/x/vuln/cmd/govulncheck
2026-04-05T00:51:39.5393709Z )
2026-04-05T00:51:39.5393799Z 
2026-04-05T00:51:39.5393866Z require (
2026-04-05T00:51:39.5394922Z 	github.com/dvyukov/go-fuzz v0.0.0-20240924070022-e577bee5275c // indirect
2026-04-05T00:51:39.5395695Z 	github.com/elazarl/go-bindata-assetfs v1.0.1 // indirect
2026-04-05T00:51:39.5396170Z 	github.com/stephens2424/writerset v1.0.2 // indirect
2026-04-05T00:51:39.5396480Z 	golang.org/x/mod v0.34.0 // indirect
2026-04-05T00:51:39.5396740Z 	golang.org/x/sync v0.20.0 // indirect
2026-04-05T00:51:39.5397223Z 	golang.org/x/sys v0.42.0 // indirect
2026-04-05T00:51:39.5397770Z 	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
2026-04-05T00:51:39.5398215Z 	golang.org/x/tools v0.43.0 // indirect
2026-04-05T00:51:39.5398466Z 	golang.org/x/vuln v1.1.4 // indirect
2026-04-05T00:51:39.5398712Z ) from manifest
2026-04-05T00:51:39.5560694Z Attempting to download module nuclei-tools
2026-04-05T00:51:39.5561063Z 
2026-04-05T00:51:39.5561198Z go 1.26.1
2026-04-05T00:51:39.5561373Z 
2026-04-05T00:51:39.5561490Z tool (
2026-04-05T00:51:39.5561741Z 	github.com/dvyukov/go-fuzz/go-fuzz
2026-04-05T00:51:39.5562075Z 	github.com/dvyukov/go-fuzz/go-fuzz-build
2026-04-05T00:51:39.5562387Z 	golang.org/x/vuln/cmd/govulncheck
2026-04-05T00:51:39.5562667Z )
2026-04-05T00:51:39.5562860Z 
2026-04-05T00:51:39.5562995Z require (
2026-04-05T00:51:39.5563479Z 	github.com/dvyukov/go-fuzz v0.0.0-20240924070022-e577bee5275c // indirect
2026-04-05T00:51:39.5564319Z 	github.com/elazarl/go-bindata-assetfs v1.0.1 // indirect
2026-04-05T00:51:39.5565075Z 	github.com/stephens2424/writerset v1.0.2 // indirect
2026-04-05T00:51:39.5565445Z 	golang.org/x/mod v0.34.0 // indirect
2026-04-05T00:51:39.5565734Z 	golang.org/x/sync v0.20.0 // indirect
2026-04-05T00:51:39.5566025Z 	golang.org/x/sys v0.42.0 // indirect
2026-04-05T00:51:39.5566411Z 	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
2026-04-05T00:51:39.5566840Z 	golang.org/x/tools v0.43.0 // indirect
2026-04-05T00:51:39.5567135Z 	golang.org/x/vuln v1.1.4 // indirect
2026-04-05T00:51:39.5567396Z )...
2026-04-05T00:51:40.2308170Z matching module nuclei-tools
2026-04-05T00:51:40.2308603Z 
2026-04-05T00:51:40.2308746Z go 1.26.1
2026-04-05T00:51:40.2308948Z 
2026-04-05T00:51:40.2309088Z tool (
2026-04-05T00:51:40.2309454Z 	github.com/dvyukov/go-fuzz/go-fuzz
2026-04-05T00:51:40.2310026Z 	github.com/dvyukov/go-fuzz/go-fuzz-build
2026-04-05T00:51:40.2310590Z 	golang.org/x/vuln/cmd/govulncheck
2026-04-05T00:51:40.2311068Z )
2026-04-05T00:51:40.2311243Z 
2026-04-05T00:51:40.2311383Z require (
2026-04-05T00:51:40.2311866Z 	github.com/dvyukov/go-fuzz v0.0.0-20240924070022-e577bee5275c // indirect
2026-04-05T00:51:40.2312595Z 	github.com/elazarl/go-bindata-assetfs v1.0.1 // indirect
2026-04-05T00:51:40.2313210Z 	github.com/stephens2424/writerset v1.0.2 // indirect
2026-04-05T00:51:40.2314154Z 	golang.org/x/mod v0.34.0 // indirect
2026-04-05T00:51:40.2314834Z 	golang.org/x/sync v0.20.0 // indirect
2026-04-05T00:51:40.2315264Z 	golang.org/x/sys v0.42.0 // indirect
2026-04-05T00:51:40.2315838Z 	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
2026-04-05T00:51:40.2316444Z 	golang.org/x/tools v0.43.0 // indirect
2026-04-05T00:51:40.2316871Z 	golang.org/x/vuln v1.1.4 // indirect
2026-04-05T00:51:40.2317261Z )...
2026-04-05T00:51:40.2739790Z Not found in manifest.  Falling back to download directly from Go
2026-04-05T00:51:40.9617660Z ##[error]Unable to find Go version 'module nuclei-tools

go 1.26.1

tool (
	github.com/dvyukov/go-fuzz/go-fuzz
	github.com/dvyukov/go-fuzz/go-fuzz-build
	golang.org/x/vuln/cmd/govulncheck
)

require (
	github.com/dvyukov/go-fuzz v0.0.0-20240924070022-e577bee5275c // indirect
	github.com/elazarl/go-bindata-assetfs v1.0.1 // indirect
	github.com/stephens2424/writerset v1.0.2 // indirect
	golang.org/x/mod v0.34.0 // indirect
	golang.org/x/sync v0.20.0 // indirect
	golang.org/x/sys v0.42.0 // indirect
	golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c // indirect
	golang.org/x/tools v0.43.0 // indirect
	golang.org/x/vuln v1.1.4 // indirect
)' for platform linux and architecture x64.
2026-04-05T00:51:40.9865874Z Post job cleanup.
2026-04-05T00:51:40.9926189Z Post job cleanup.
2026-04-05T00:51:41.0721127Z [command]/usr/bin/git version
2026-04-05T00:51:41.0758509Z git version 2.53.0
2026-04-05T00:51:41.0799352Z Temporarily overriding HOME='/home/runner/work/_temp/78df566b-6639-4750-9b73-2b3ded86bf63' before making global git config changes
2026-04-05T00:51:41.0800203Z Adding repository directory to the temporary git global config as a safe directory
2026-04-05T00:51:41.0806088Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/nuclei/nuclei
2026-04-05T00:51:41.0838607Z Removing SSH command configuration
2026-04-05T00:51:41.0844725Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
2026-04-05T00:51:41.0880795Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
2026-04-05T00:51:41.1107121Z Removing HTTP extra header
2026-04-05T00:51:41.1112561Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
2026-04-05T00:51:41.1147750Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
2026-04-05T00:51:41.1365522Z Removing includeIf entries pointing to credentials config files
2026-04-05T00:51:41.1372410Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
2026-04-05T00:51:41.1395327Z includeif.gitdir:/home/runner/work/nuclei/nuclei/.git.path
2026-04-05T00:51:41.1396224Z includeif.gitdir:/home/runner/work/nuclei/nuclei/.git/worktrees/*.path
2026-04-05T00:51:41.1397525Z includeif.gitdir:/github/workspace/.git.path
2026-04-05T00:51:41.1398353Z includeif.gitdir:/github/workspace/.git/worktrees/*.path
2026-04-05T00:51:41.1405349Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/nuclei/nuclei/.git.path
2026-04-05T00:51:41.1427141Z /home/runner/work/_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:41.1437772Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/nuclei/nuclei/.git.path /home/runner/work/_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:41.1470249Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/nuclei/nuclei/.git/worktrees/*.path
2026-04-05T00:51:41.1490789Z /home/runner/work/_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:41.1499779Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/nuclei/nuclei/.git/worktrees/*.path /home/runner/work/_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:41.1531052Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git.path
2026-04-05T00:51:41.1552548Z /github/runner_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:41.1560887Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:41.1590541Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git/worktrees/*.path
2026-04-05T00:51:41.1612246Z /github/runner_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:41.1620223Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git/worktrees/*.path /github/runner_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config
2026-04-05T00:51:41.1652984Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
2026-04-05T00:51:41.1869866Z Removing credentials config '/home/runner/work/_temp/git-credentials-f2cbd5de-3d9f-4ba1-91fb-e9727c977cf8.config'
2026-04-05T00:51:41.2004140Z Cleaning up orphan processes

What should happen:

When go-version-file points to go.tool.mod, setup-go needs to parse the file and extract:

• The toolchain directive version, if it's there and makes sense
• Otherwise, just the go directive version

Footnotes

1. A. Edwards, "How to manage tool dependencies in Go 1.24+ - Alex Edwards," Feb. 20, 2025. https://www.alexedwards.net/blog/how-to-manage-tool-dependencies-in-go-1.24-plus ↩

[chiranjib-swain]

Hi @dwisiswant0 ,
Thank you for raising this. We will investigate it and provide feedback as soon as we have some updates.

[dwisiswant0]

@chiranjib-swain - any updates on this?

[dwisiswant0]

@chiranjib-swain - any updates on this?

[HarithaVattikuti]

Hi @dwisiswant0, thanks for the detailed report!

parseGoVersionFile in src/installer.ts only parses the canonical go.mod / go.work filenames; anything else is treated as a plain version file. That's the documented behavior, so this isn't a bug — but supporting Go 1.24+ tools modfiles like go.tool.mod is a reasonable enhancement.

We'll relabel this from bug to enhancement/feature request. We appreciate your feedback and will evaluate this for a future release.

[dwisiswant0]

@HarithaVattikuti - thanks! Btw have you had a chance to check out the prepped patch I put for this over in #747? I'd love to get your eyes on it whenever you have a moment.