Fix the required field for go version

[naveensrinivasan]

slsa-github-generator-go/.github/workflows/builder.yml

Line 37 in 87c137e

required: true

Signed-off-by: naveensrinivasan [email protected]

[laurentsimon]

I suggest we don't force users to set this and mark it as optional as for the default actions/setup-go action.
All we need is to have two steps, where one is conditional on this value being set or not:

if: ${{ inputs.go-version != ""}}
uses: actions/setup-go@... # v2.1.3
   with:
   go-version: ${{ inputs.go-version }}

if: ${{ inputs.go-version == ""}}
uses: actions/setup-go@... # v2.1.3

(please verify this code work, I've not tested it)

What do you think?

/cc @asraa @joshuagl any opinion on this?

[joshuagl]

I tend to err towards setting versions explicitly (though don't want users to have to configure that in multiple places).

If we don't require an explicit go version be set, we should capture which version is used for reproducibility.

[laurentsimon]

I agree that it may help us and is good practice for users to define it. Note though, that the go-version field of the underlying action can various form, e.g., >=1.17.0 - see https://github.com/actions/setup-go

Let's require it then. If we change our mind it will be easy to do so without breaking backward compatibility. The other way round won't be true.