From e4b728f72e8c91ac9c54890b4dd66e3989ce8ff8 Mon Sep 17 00:00:00 2001
From: youfak <youfak@126.com>
Date: Fri, 7 Aug 2026 18:08:02 +0800
Subject: [PATCH] ci: pin deployment config validation toolchain

---
 .github/workflows/ci.yml |  4 ++++
 deploy/ci_test.go        | 21 +++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bb15ab9..855f077 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,10 @@ jobs:
       PROVIDER_B_TOKEN: ci-provider-b-token
     steps:
       - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
       - name: Render Compose configuration
         run: docker compose -f deploy/docker-compose.yml config --quiet
       - name: Render Kubernetes base
diff --git a/deploy/ci_test.go b/deploy/ci_test.go
index f75d679..d3f6c80 100644
--- a/deploy/ci_test.go
+++ b/deploy/ci_test.go
@@ -38,4 +38,25 @@ func TestCIValidatesProtocolAndDeploymentAssets(t *testing.T) {
 			t.Errorf("ci workflow does not validate %q", required)
 		}
 	}
+	deployment, ok := jobs["deployment"].(map[string]any)
+	if !ok {
+		t.Fatal("ci deployment job has invalid definition")
+	}
+	steps, ok := deployment["steps"].([]any)
+	if !ok {
+		t.Fatal("ci deployment job has no steps")
+	}
+	for _, step := range steps {
+		definition, ok := step.(map[string]any)
+		if !ok || definition["uses"] != "actions/setup-go@v5" {
+			continue
+		}
+		options, ok := definition["with"].(map[string]any)
+		if !ok || options["go-version-file"] != "go.mod" {
+			t.Error("ci deployment job must pin actions/setup-go to go.mod")
+			return
+		}
+		return
+	}
+	t.Error("ci deployment job must install the Go version declared by go.mod before running configcheck")
 }