Use Go module proxy for downloading toolchains as per official documentation #678
Description
Overview
#665 changed the URL used for downloading toolchains. This action should use the same method as the go tool itself instead.
Description
This GHA action should download Go toolchains using the Go module proxy which is the method used by the go tool instead of hard-coding a specific download URL.
The official Go documentation provides that Go toolchains are packaged like pseudo-modules and are distributed using the Go module proxy (proxy.golang.org) with checksums available in the Go checksum database (sum.golang.org). Specifically, that documentation states:
These toolchains are packaged as special modules with module path golang.org/toolchain and version v0.0.1-goVERSION.GOOS-GOARCH. Toolchains are downloaded like any other module, meaning that toolchain downloads can be proxied by setting GOPROXY and have their checksums checked by the Go checksum database.
For example, a list of all toolchain versions can be retrieved from https://proxy.golang.org/golang.org/toolchain/@v/list and the toolchain for go 1.25.3 on macOS ARM can be downloaded from http://proxy.golang.org/golang.org/toolchain/@v/v0.0.1-go1.25.3.darwin-arm64.zip. The checksum to use can be retrieved from https://sum.golang.org/lookup/golang.org/toolchain@v0.0.1-go1.25.3.darwin-arm64 (with appropriate verification of the log signatures).
Relevant documentation:
Justification:
The official Go documentation states what to do and the go tool implements that method. This action should not deviate from the official method.
Other benefits:
- This action gets the performance benefits from using the Go module proxy and any CDN it uses.
- Any one running a private Go module proxy (e.g., in an enterprise) would be able to serve toolchains with no Internet access. (This assumes another PR for this action to support changing the URL of the Go module proxy.)
- It should be more future-proof since it replicates what the
gotool does.
Are you willing to submit a PR?
Maybe.