feat: add go-download-base-url input for custom Go distributions (#721)

* feat: add go-download-base-url input for custom Go distributions

Add support for downloading Go from custom sources such as Microsoft Go
(aka.ms). Users can specify a custom download base URL via the
`go-download-base-url` input or the `GO_DOWNLOAD_BASE_URL` environment
variable (input takes precedence).

When a custom URL is provided, the action skips the GitHub-hosted
manifest and attempts to resolve versions from the custom URL's JSON
listing. If the listing is unavailable (as with aka.ms redirect links),
it falls back to constructing the download URL directly from the
version, platform, and architecture.

Usage:
  - uses: actions/setup-go@v6
    with:
      go-version: '1.25'
      go-download-base-url: 'https://aka.ms/golang/release/latest'

Changes:
- action.yml: add go-download-base-url optional input
- installer.ts: add getInfoFromDirectDownload() for URL construction
  fallback, thread custom URL through getGo/getInfoFromDist/findMatch
- main.ts: read new input and GO_DOWNLOAD_BASE_URL env var
- setup-go.test.ts: add 12 unit tests for custom URL behavior
- microsoft-validation.yml: add E2E workflow testing Microsoft build of Go
  across ubuntu/windows/macos with versions 1.24 and 1.25
- README.md: document new input with Microsoft build of Go examples

* run prettier

* fixup PR review

* revert cache-save

* fixup

* handle distinct cache

* skip json for known URL

* fix bug in JSON with custom URL

.github/workflows/microsoft-validation.yml

@@ -0,0 +1,143 @@
+name: Validate Microsoft build of Go
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+jobs:
+  microsoft-basic:
+    name: 'Microsoft build of Go ${{ matrix.go-version }} on ${{ matrix.os }}'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        go-version: ['1.25', '1.24']
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Microsoft build of Go ${{ matrix.go-version }}
+        uses: ./
+        with:
+          go-version: ${{ matrix.go-version }}
+          go-download-base-url: 'https://aka.ms/golang/release/latest'
+          cache: false
+
+      - name: Verify Go installation
+        run: go version
+
+      - name: Verify Go env
+        run: go env
+
+      - name: Verify Go is functional
+        shell: bash
+        run: |
+          # Create a simple Go program and run it
+          mkdir -p /tmp/test-go && cd /tmp/test-go
+          cat > main.go << 'EOF'
+          package main
+          import "fmt"
+          func main() {
+            fmt.Println("Hello from Microsoft build of Go!")
+          }
+          EOF
+          go run main.go
+
+  microsoft-env-var:
+    name: 'Microsoft build of Go via env var on ${{ matrix.os }}'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    env:
+      GO_DOWNLOAD_BASE_URL: 'https://aka.ms/golang/release/latest'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Microsoft build of Go via environment variable
+        uses: ./
+        with:
+          go-version: '1.25'
+          cache: false
+
+      - name: Verify Go installation
+        run: go version
+
+      - name: Verify Go is functional
+        shell: bash
+        run: |
+          mkdir -p /tmp/test-go && cd /tmp/test-go
+          cat > main.go << 'EOF'
+          package main
+          import "fmt"
+          func main() {
+            fmt.Println("Hello from Microsoft build of Go via env var!")
+          }
+          EOF
+          go run main.go
+
+  microsoft-architecture:
+    name: 'Microsoft build of Go arch ${{ matrix.architecture }} on ${{ matrix.os }}'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        architecture: [x64]
+        include:
+          - os: macos-latest
+            architecture: arm64
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Microsoft build of Go with architecture
+        uses: ./
+        with:
+          go-version: '1.25'
+          go-download-base-url: 'https://aka.ms/golang/release/latest'
+          architecture: ${{ matrix.architecture }}
+          cache: false
+
+      - name: Verify Go installation
+        run: go version
+
+  microsoft-with-cache:
+    name: 'Microsoft build of Go with caching on ${{ matrix.os }}'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Microsoft build of Go with caching
+        uses: ./
+        with:
+          go-version: '1.25'
+          go-download-base-url: 'https://aka.ms/golang/release/latest'
+          cache: true
+
+      - name: Verify Go installation
+        run: go version
+
+      - name: Verify Go is functional
+        shell: bash
+        run: |
+          mkdir -p /tmp/test-go && cd /tmp/test-go
+          go mod init test
+          cat > main.go << 'EOF'
+          package main
+          import "fmt"
+          func main() {
+            fmt.Println("Hello from cached Microsoft build of Go!")
+          }
+          EOF
+          go run main.go

.licensed.yml

@@ -13,3 +13,4 @@ allowed:
 
 reviewed:
   npm:
+     - "@actions/http-client"

.licenses/npm/@actions/http-client-3.0.2.dep.yml

@@ -1,10 +1,10 @@
 ---
 name: "@actions/http-client"
-version: 3.0.0
+version: 3.0.2
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
-license: mit
+license: other
 licenses:
 - sources: LICENSE
   text: |

.licenses/npm/fast-xml-builder.dep.yml

@@ -0,0 +1,32 @@
+---
+name: fast-xml-builder
+version: 1.0.0
+type: npm
+summary: Build XML from JSON without C/C++ based libraries
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2026 Natural Intelligence
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.3.3
+version: 5.4.1
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:

.licenses/npm/minimatch.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: minimatch
-version: 3.1.2
+version: 3.1.5
 type: npm
 summary: a glob matcher in javascript
 homepage:

.licenses/npm/undici-6.23.0.dep.yml

@@ -0,0 +1,34 @@
+---
+name: undici
+version: 6.23.0
+type: npm
+summary: An HTTP/1.1 client, written from scratch for Node.js
+homepage: https://undici.nodejs.org
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) Matteo Collina and Undici contributors
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
+notices: []

README.md

@@ -5,415 +5,29 @@
 
 This action sets up a Go environment for use in GitHub Actions by:
 
-- Optionally downloading and caching a version of Go by version and adding to PATH
+- Optionally downloading and caching a version of Go by version and adding it to the PATH
+- Optionally caching Go modules and build outputs
 - Registering problem matchers for error output
-- Providing intelligent caching for Go modules and build outputs
 
-## Quick Start
+## Breaking changes in V6
 
-```yaml
+The V6 edition of the action includes:
-steps:
+- **Upgraded Node.js runtime from node20 to node24**
-  - uses: actions/checkout@v6
+  > Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See [Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1)
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '1.23'
-  - run: go version
-```
 
-## Breaking Changes
+- **Go toolchain**
+  - Supports both `go` and `toolchain` directives in `go.mod`. If the `toolchain` directive is present, its version is used; otherwise, the action falls back to the `go` directive.
 
-### V6 Changes
+- **Cache key update**
+  - By default, the cache key for Go modules is based on `go.mod`. To use `go.sum`, configure the `cache-dependency-path` input.
 
-**Node Runtime Upgrade**
+See full release notes on the [releases page](https://github.com/actions/setup-go/releases).
-- **Upgraded from Node 20 to Node 24**
-- ⚠️ **Action Required**: Ensure your runner is on version v2.327.1 or later for compatibility
-- See [Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1) for more details
-
-**Enhanced Go Toolchain Management**
-
-V6 introduces significant improvements for reliable and consistent Go version selection. Supports both `go` and `toolchain` directives in `go.mod`. If the `toolchain` directive is present, its version is used; otherwise, the action falls back to the go directive.
-   
-**Cache Key Update**
-
-By default, caching for Go modules now relies on `go.mod`. To use `go.sum`, configure the `cache-dependency-path` input.
-
-For more details, see the [full release notes](https://github.com/actions/setup-go/releases/tag/v6.0.0).
-
-### V5 Changes
-
-- **Upgraded Node.js runtime from node16 to node20**
-- See [full release notes](https://github.com/actions/setup-go/releases) for complete details
-
-## Version Resolution Behavior
-
-The action follows this resolution order:
-1. **Local cache** - Checks for a cached version match
-2. **go-versions repository** - Pulls from the main branch of the [go-versions repository](https://github.com/actions/go-versions/blob/main/versions-manifest.json)
-3. **Direct download** - Falls back to downloading directly from [go.dev](https://go.dev/dl)
-
-To change the default behavior, use the `check-latest` input.
-
-> **Note**: The setup-go action uses executable binaries built by the Golang team. The action does not build golang from source code.
 
 ## Usage
 
-### Basic Setup
+See [action.yml](action.yml).
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '1.23'
-  - run: go run hello.go
-```
-
-### Version Specifications
-
-#### Semantic Versioning
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '^1.23.1' # The Go version to download (if necessary) and use.
-  - run: go version
-```
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '>=1.22.0'
-  - run: go version
-```
-
-> **Important**: Due to YAML parsing behavior, always wrap version numbers in single quotes:
-> ```yaml
-> go-version: '1.22'  # Correct
-> go-version: 1.22    # Incorrect - YAML parser interprets as 1.2
-> ```
-
-#### Pre-release Versions
-
-```yaml
-# RC version
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-       go-version: '1.24.0-rc.1' # The Go version to download (if necessary) and use
-  - run: go version
-```
-
-```yaml
-# Beta version
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '1.23.0-beta.1' # The Go version to download (if necessary) and use
-  - run: go version
-```
-
-#### Version Aliases
-
-**Stable Release**
-
-If `stable` is provided, action will get the latest stable version from the [go-versions](https://github.com/actions/go-versions/blob/main/versions-manifest.json) repository manifest.
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: 'stable' # Latest stable version
-  - run: go version
-```
-
-**Previous Stable Release**
-
-If `oldstable` is provided, when the current release is 1.23.x, the action will resolve version as 1.22.x, where x is the latest patch release.
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: 'oldstable' # Previous stable version
-  - run: go version
-```
-
-> **Note**: Using aliases is equivalent to using the corresponding minor release with `check-latest: true`
-
-### go-version-file
-
-The action can automatically detect the Go version from various project files using the `go-version-file` input. This parameter supports `go.mod`, `go.work`, `.go-version`, and `.tool-versions` files.
-
-> **Note**: If both `go-version` and `go-version-file` are provided, `go-version` takes precedence.
-
-#### go.mod File
-
-Automatically detect the Go version from your project's `go.mod` file:
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version-file: 'go.mod'
-  - run: go version
-```
-
-**Version Resolution from go.mod:**
-1. Uses the `toolchain` directive version if present
-2. Falls back to the `go` directive version
-3. If no patch version is specified, uses the latest available patch
-
-#### go.work File
-
-Use the Go version specified in your `go.work` file:
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version-file: 'go.work'
-  - run: go version
-```
-
-#### .go-version File
-
-Read the Go version from a `.go-version` file:
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version-file: '.go-version'
-  - run: go version
-```
-
-#### .tool-versions File
-
-Use the Go version from an [`.tool-versions`](https://asdf-vm.com/manage/configuration.html#tool-versions) file:
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version-file: '.tool-versions'
-  - run: go version
-```
-
-#### Custom File Paths
-
-The action searches for version files relative to the repository root by default. You can specify a custom path:
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version-file: 'path/to/.go-version'
-  - run: go version
-```
-
-**Supported Version Formats:**
-- Major and minor only: `1.25` (action will use the latest patch version, e.g., `1.25.4`)
-- Major, minor, and patch: `1.25.4` (exact version)
-
-### Check Latest Version
-
-The check-latest flag defaults to false for stability. This ensures your workflow uses a specific, predictable Go version.
-When `check-latest: true`, the action verifies if your cached Go version is the latest available. If not, it downloads and uses the newest version.
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '1.23'
-      check-latest: true # Always check for the latest patch release
-  - run: go version
-```
-
-**Performance Considerations:**
-- `check-latest: false` (default) - Uses cached versions for faster builds
-- `check-latest: true` - Downloads the latest version, slower but ensures up-to-date releases
-
-### Caching
-
-The action features integrated caching for Go modules and build outputs. Built on [toolkit/cache](https://github.com/actions/toolkit/tree/main/packages/cache), it simplifies the caching process by requiring fewer configuration options. The cache input is optional, and caching is turned on by default.
-
-#### Automatic Caching
-
-Default behavior: Searches for `go.mod` in the repository root and uses its hash for the cache key.
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '1.23'
-      # cache: true (default)
-  - run: go run hello.go
-```
-
-#### Advanced Caching Scenarios
-
-For advanced scenarios, use `cache-dependency-path` to specify:
-- **Multiple dependency files**: When your project has dependencies in different directories
-- **Custom locations**: When your `go.sum` files are not in the repository root
-- **Monorepos**: When managing multiple Go modules in a single repository
-- **Glob patterns**: For flexible file matching
-
-```yaml
-# Example: Monorepo with multiple go.sum files
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '1.23'
-      check-latest: true
-      cache-dependency-path: |
-        subdir/go.sum
-        tools/go.sum
-  - run: go run hello.go
-```
-
-```yaml
-# Example: Using glob patterns to match all go.sum files
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '1.23'
-      cache-dependency-path: "**/*.sum"
-  - run: go run hello.go
-```
-
-#### Disable Caching
-
-```yaml
-steps:
-  - uses: actions/checkout@v6
-  - uses: actions/setup-go@v6
-    with:
-      go-version: '1.23'
-      cache: false
-  - run: go run hello.go
-```
-
-> **Note**: If caching fails, the action logs a warning but continues execution without interrupting your workflow.
-
-**Restore-Only Cache**
-
-```yaml
-# In some workflows, you may want to restore a cache without saving it. This can help reduce cache writes and storage usage in workflows that only need to read from cache
-jobs:
-    build:
-      runs-on: ${{ matrix.os }}
-      strategy:
-        matrix:
-          os: [ubuntu-latest, macos-latest, windows-latest]
-      steps:
-        - uses: actions/checkout@v6
-        - name: Setup Go
-          id: setup-go
-          uses: actions/setup-go@v6
-          with:
-            go-version: '1.24.10'
-            cache: false
-        # Capture Go cache locations
-        - name: Set Go cache variables (Linux/macOS)
-          if: runner.os != 'Windows'
-          run: |
-            echo "GO_MOD_CACHE=$(go env GOMODCACHE)" >> $GITHUB_ENV
-            echo "GO_BUILD_CACHE=$(go env GOCACHE)" >> $GITHUB_ENV
-        - name: Set Go cache variables (Windows)
-          if: runner.os == 'Windows'
-          shell: pwsh
-          run: |
-            echo "GO_MOD_CACHE=$(go env GOMODCACHE)" | Out-File $env:GITHUB_ENV -Append
-            echo "GO_BUILD_CACHE=$(go env GOCACHE)"   | Out-File $env:GITHUB_ENV -Append
-        # Normalize runner.arch to lowercase to ensure consistent cache keys
-        - name: Normalize runner architecture (Linux/macOS)
-          if: runner.os != 'Windows'
-          shell: bash
-          run: echo "ARCH=$(echo '${{ runner.arch }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
-        - name: Normalize runner architecture (Windows)
-          if: runner.os == 'Windows'
-          shell: pwsh
-          run: |
-            $arch = "${{ runner.arch }}".ToLower()
-            echo "ARCH=$arch" | Out-File $env:GITHUB_ENV -Append
-        - name: Set cache OS suffix for Linux
-          if: runner.os == 'Linux'
-          shell: bash
-          run: echo "CACHE_OS_SUFFIX=$ImageOS-" >> $GITHUB_ENV    
-        - name: Restore Go cache
-          id: go-cache
-          uses: actions/cache/restore@v5
-          with:
-            path: |
-              ${{ env.GO_MOD_CACHE }}
-              ${{ env.GO_BUILD_CACHE }}
-            key: setup-go-${{ runner.os }}-${{ env.ARCH }}-${{ env.CACHE_OS_SUFFIX }}go-${{ steps.setup-go.outputs.go-version }}-${{ hashFiles('**/go.mod') }}
-        - name: Download modules
-          run: go mod download
-        - name: Build
-          run: go build ./...
-```
-> If there are several builds on the same repo it might make sense to create a cache in one build and use it in the
-others. The action [actions/cache/restore](https://github.com/actions/cache/tree/main/restore#only-restore-cache)
-should be used in this case.
-
-### Matrix Testing
-
-Test across multiple Go versions:
-
-```yaml
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        go-version: ['1.21', '1.22', '1.23']
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
-        with:
-          go-version: ${{ matrix.go-version }}
-      - run: go test ./...
-```
-
-## Advanced Configuration
-
-### Supported Version Syntax
-
-The `go-version` input supports the following syntax:
-
-| Syntax Type | Example | Description |
-|-------------|---------|-------------|
-| Specific version | `1.23.2` | Installs this exact version |
-| Semantic range (caret) | `^1.23.0` | Allows newer minor/patch versions (1.24.x, 1.25.x, etc.) |
-| Semantic range (tilde) | `~1.23.0` | Allows newer patch versions only (1.23.1, 1.23.2, etc.) |
-| Comparison (gte) | `>=1.22.0` | Any version equal to or newer than specified |
-| Comparison (lt) | `<1.24.0` | Any version older than specified |
-| Comparison range | `>=1.22.0 <1.24.0` | Any version within the specified range |
-| Wildcard (patch) | `1.23.x` | Latest patch version of the specified minor release |
-| Wildcard (minor) | `1.*` | Latest available version in the major version |
-| Pre-release | `1.24.0-rc.1` | Beta/RC versions for testing upcoming releases |
-| Aliases | `stable`, `oldstable` | Latest stable or previous stable release |
-
-For more information about semantic versioning, see the [semver documentation](https://semver.org/).
-
-### Complete Input Reference
 
+<!-- start usage -->
 ```yaml
 - uses: actions/setup-go@v6
   with:
@@ -421,15 +35,18 @@ For more information about semantic versioning, see the [semver documentation](h
     go-version: '1.23'
     
     # Path to go.mod, go.work, .go-version, or .tool-versions file
+    # Note: if both go-version and go-version-file are provided, go-version takes precedence.
     go-version-file: 'go.mod'
     
-    # Check for latest version
+    # Set this option if you want the action to check for the latest available version
+    # Default: false
     check-latest: false
     
     # GitHub token for authentication
     token: ${{ github.token }}
     
-    # Enable/disable caching
+    # Used to specify whether caching is needed.
+    # Default: true
     cache: true
     
     # Path to dependency files for caching
@@ -437,44 +54,96 @@ For more information about semantic versioning, see the [semver documentation](h
     
     # Architecture to install (auto-detected if not specified)
     architecture: 'x64'
+    
+    # Custom base URL for Go downloads (e.g., for mirrors)
+    go-download-base-url: ''
 ```
+<!-- end usage -->
 
-## Using setup-go on GHES
+**Basic:**
-
-setup-go comes pre-installed on GHES when Actions is enabled. For dynamic Go version downloads, the action fetches distributions from the [go-versions repository](https://github.com/actions/go-versions/) on github.com (external to your appliance).
-
-These calls to `actions/go-versions` are made via unauthenticated requests, which are limited to 60 requests per hour per IP. If more requests are made within the time frame, then the action leverages the raw API to retrieve the version-manifest. This approach does not impose a rate limit and hence facilitates unrestricted consumption. This is particularly beneficial for GHES runners, which often share the same IP, to avoid the quick exhaustion of the unauthenticated rate limit. If that fails as well the action will try to download versions directly from [go.dev](https://go.dev/dl).
-
-If that fails as well you can get a higher rate limit with generating a personal access token on github.com and passing it as the token input to the action:
 
 ```yaml
-uses: actions/setup-go@v6
+steps:
-with:
+  - uses: actions/checkout@v6
-  token: ${{ secrets.GH_DOTCOM_TOKEN }}
+  - uses: actions/setup-go@v6
-  go-version: '1.23'
+    with:
+      go-version: '1.25' # The Go version to download (if necessary) and use.
+  - run: go run hello.go
 ```
 
-### Offline Runners
+**Version resolution behavior:**
 
-For runners without github.com access, Go versions must be pre-cached in the runner's tool cache. See "[Setting up the tool cache on self-hosted runners without internet access](https://docs.github.com/en/enterprise-server@3.2/admin/github-actions/managing-access-to-actions-from-githubcom/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access)".
+The action resolves the requested version in the following order:
+1. **Local cache** - Checks the local tool cache for a matching [semver](https://github.com/npm/node-semver#versions) version.
+2. **go-versions repository** - If the requested version isn’t available in the tool cache, it pulls the version manifest from the `main` branch of the [go-versions repository](https://github.com/actions/go-versions/blob/main/versions-manifest.json).
+3. **Direct download** - If that lookup misses or fails, it will fall back to downloading directly from the [official Go distribution site](https://go.dev/dl).
 
-## Recommended Permissions
+To change the default behavior, please use
+the [check-latest input](docs/advanced-usage.md#check-latest-version).
 
-When using the setup-go action in your GitHub Actions workflow, it is recommended to set the following permissions to ensure proper functionality:
+> **Note**: The `setup-go` action uses executable binaries built by the Go team and does not build Go binaries from source code.
+
+## Supported version syntax
+
+The `go-version` input supports the following syntax:
+
+- Specific versions: `1.25`, `1.24.11`, `1.24.0-rc.1`, `1.23.0-beta.1`
+- SemVer version range syntax: `^1.25.1`, `~1.24.1`, `>=1.25.0-rc.1`, `<1.25.0`, `>=1.22.0 <1.24.0`
+- Aliases: `stable`, `oldstable`
+- Wildcards: `1.25.x`, `1.x`
+
+For details on Semantic Versioning, see [the semver package documentation](https://github.com/npm/node-semver).
+
+> **Note**: Due to the peculiarities of YAML parsing, it is recommended to wrap the version in single quotation marks:
+>
+> ```yaml
+>   go-version: '1.20'
+> ```
+>
+> The recommendation is based on the YAML parser's behavior, which interprets non-wrapped values as numbers and, in the case of version `1.20`, trims it down to `1.2`, which may not be very obvious.
+
+For more usage examples, please refer to the section: [Using go-version input](docs/advanced-usage.md#using-the-go-version-input) of the [Advanced usage](docs/advanced-usage.md) guide.
+
+## Recommended permissions
+
+When using the `setup-go` action in your GitHub Actions workflow, it is recommended to set the following permissions to ensure proper functionality:
 
 ```yaml
 permissions:
-  contents: read # Required to checkout code and install dependencies
+  contents: read # access to check out code and install dependencies
 ```
 
+## Caching dependency files and build outputs
+
+The action includes built-in caching and restoration for Go modules and build outputs. It uses
+[toolkit/cache](https://github.com/actions/toolkit/tree/main/packages/cache) under the hood, but requires less configuration.
+The `cache` input is optional, and caching is enabled by default. To disable caching, set `cache: false`.
+
+By default, the action looks for `go.mod` in the repository root and uses its hash as part of the cache key. Use the `cache-dependency-path` input when you have multiple dependency files, or when they’re located in different subdirectories. This input supports glob patterns.
+
+If caching cannot be performed for any reason, the action logs a warning and continues workflow execution.
+
+For examples of using `cache-dependency-path`, see the [Caching](docs/advanced-usage.md#caching) section of the [Advanced usage](docs/advanced-usage.md) guide.
+
+
+## Advanced usage
+
+- [Using the go-version input](docs/advanced-usage.md#using-the-go-version-input)
+- [Using the go-version-file input](docs/advanced-usage.md#using-the-go-version-file-input)
+- [Check latest version](docs/advanced-usage.md#check-latest-version)
+- [Caching](docs/advanced-usage.md#caching)
+- [Outputs](docs/advanced-usage.md#outputs)
+- [Custom download URL](docs/advanced-usage.md#custom-download-url)
+- [Using `setup-go` on GHES](docs/advanced-usage.md#using-setup-go-on-ghes)
+
 ## License
 
 The scripts and documentation in this project are released under the [MIT License](LICENSE).
 
 ## Contributions
 
-Contributions are welcome! See our [Contributor's Guide](docs/contributors.md) for details.
+Contributions are welcome! See our [Contributor's Guide](docs/contributors.md).
 
 ## Code of Conduct
 
-👋 Be nice. See our [Code of Conduct](CODE_OF_CONDUCT.md).
+:wave: Be nice. See [our code of conduct](CODE_OF_CONDUCT.md)

__tests__/setup-go.test.ts

@@ -45,6 +45,7 @@ describe('setup-go', () => {
   let mkdirSpy: jest.SpyInstance;
   let symlinkSpy: jest.SpyInstance;
   let execSpy: jest.SpyInstance;
+  let execFileSpy: jest.SpyInstance;
   let getManifestSpy: jest.SpyInstance;
   let getAllVersionsSpy: jest.SpyInstance;
   let httpmGetJsonSpy: jest.SpyInstance;
@@ -71,6 +72,10 @@ describe('setup-go', () => {
     archSpy = jest.spyOn(osm, 'arch');
     archSpy.mockImplementation(() => os['arch']);
     execSpy = jest.spyOn(cp, 'execSync');
+    execFileSpy = jest.spyOn(cp, 'execFileSync');
+    execFileSpy.mockImplementation(() => {
+      throw new Error('ENOENT');
+    });
 
     // switch path join behaviour based on set os.platform
     joinSpy = jest.spyOn(path, 'join');
@@ -129,8 +134,9 @@ describe('setup-go', () => {
   });
 
   afterEach(() => {
-    // clear out env var set during 'run'
+    // clear out env vars set during 'run'
     delete process.env[im.GOTOOLCHAIN_ENV_VAR];
+    delete process.env['GO_DOWNLOAD_BASE_URL'];
 
     //jest.resetAllMocks();
     jest.clearAllMocks();
@@ -1105,4 +1111,456 @@ use .
     expect(vars).toStrictEqual({GOTOOLCHAIN: 'local'});
     expect(process.env).toHaveProperty('GOTOOLCHAIN', 'local');
   });
+
+  describe('go-download-base-url', () => {
+    it('downloads a version from custom base URL using version listing', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.13.1';
+      const customBaseUrl = 'https://example.com/golang';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      const toolPath = path.normalize('/cache/go/1.13.1/x64');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      const expPath = path.join(toolPath, 'bin');
+      expect(logSpy).toHaveBeenCalledWith(
+        `Using custom Go download base URL: ${customBaseUrl}`
+      );
+      expect(logSpy).toHaveBeenCalledWith('Install from custom download URL');
+      // Version listing should use custom base URL, not go.dev
+      expect(getSpy).toHaveBeenCalledWith(
+        `${customBaseUrl}/?mode=json&include=all`
+      );
+      expect(dlSpy).toHaveBeenCalled();
+      expect(extractTarSpy).toHaveBeenCalled();
+      expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    });
+
+    it('skips version listing for known direct-download URL (aka.ms)', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.25.0';
+      const customBaseUrl = 'https://aka.ms/golang/release/latest';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      const toolPath = path.normalize('/cache/go/1.25.0/x64');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      const expPath = path.join(toolPath, 'bin');
+      expect(logSpy).toHaveBeenCalledWith(
+        'Skipping version listing for known direct-download URL. Constructing download URL directly.'
+      );
+      expect(logSpy).toHaveBeenCalledWith(
+        `Constructed direct download URL: ${customBaseUrl}/go1.25.0.linux-amd64.tar.gz`
+      );
+      expect(logSpy).toHaveBeenCalledWith('Install from custom download URL');
+      expect(getSpy).not.toHaveBeenCalled();
+      expect(dlSpy).toHaveBeenCalled();
+      expect(cnSpy).toHaveBeenCalledWith(`::add-path::${expPath}${osm.EOL}`);
+    });
+
+    it('constructs correct direct download URL for windows (aka.ms)', async () => {
+      os.platform = 'win32';
+      os.arch = 'x64';
+
+      const versionSpec = '1.25.0';
+      const customBaseUrl = 'https://aka.ms/golang/release/latest';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+      process.env['RUNNER_TEMP'] = 'C:\\temp\\';
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => 'C:\\temp\\some\\path');
+      extractZipSpy.mockImplementation(() => 'C:\\temp\\some\\other\\path');
+      const toolPath = path.normalize('C:\\cache\\go\\1.25.0\\x64');
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      expect(getSpy).not.toHaveBeenCalled();
+      expect(dlSpy).toHaveBeenCalledWith(
+        `${customBaseUrl}/go1.25.0.windows-amd64.zip`,
+        'C:\\temp\\go1.25.0.windows-amd64.zip',
+        undefined
+      );
+    });
+
+    it('skips manifest and downloads directly from custom URL', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.12.16';
+      const customBaseUrl = 'https://example.com/golang';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+      inputs['token'] = 'faketoken';
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      const toolPath = path.normalize('/cache/go/1.12.16/x64');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      // Should not try to use the manifest at all
+      expect(logSpy).not.toHaveBeenCalledWith(
+        expect.stringContaining('Not found in manifest')
+      );
+      expect(logSpy).toHaveBeenCalledWith('Install from custom download URL');
+    });
+
+    it('strips trailing slashes from custom base URL', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.13.1';
+      const customBaseUrl = 'https://example.com/golang/';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      const toolPath = path.normalize('/cache/go/1.13.1/x64');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      expect(logSpy).toHaveBeenCalledWith(
+        `Acquiring go1.13.1 from https://example.com/golang/go1.13.1.linux-amd64.tar.gz`
+      );
+    });
+
+    it('reads custom base URL from environment variable', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.13.1';
+      const customBaseUrl = 'https://example.com/golang';
+
+      inputs['go-version'] = versionSpec;
+      process.env['GO_DOWNLOAD_BASE_URL'] = customBaseUrl;
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      const toolPath = path.normalize('/cache/go/1.13.1/x64');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      expect(logSpy).toHaveBeenCalledWith(
+        `Using custom Go download base URL: ${customBaseUrl}`
+      );
+      expect(logSpy).toHaveBeenCalledWith('Install from custom download URL');
+    });
+
+    it('input takes precedence over environment variable', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.13.1';
+      const inputUrl = 'https://input.example.com/golang';
+      const envUrl = 'https://env.example.com/golang';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = inputUrl;
+      process.env['GO_DOWNLOAD_BASE_URL'] = envUrl;
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      const toolPath = path.normalize('/cache/go/1.13.1/x64');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      expect(logSpy).toHaveBeenCalledWith(
+        `Using custom Go download base URL: ${inputUrl}`
+      );
+      expect(logSpy).toHaveBeenCalledWith(
+        `Acquiring go1.13.1 from ${inputUrl}/go1.13.1.linux-amd64.tar.gz`
+      );
+    });
+
+    it('errors when stable alias is used with custom URL', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      inputs['go-version'] = 'stable';
+      inputs['go-download-base-url'] = 'https://example.com/golang';
+
+      findSpy.mockImplementation(() => '');
+      await main.run();
+
+      expect(cnSpy).toHaveBeenCalledWith(
+        `::error::Version aliases 'stable' are not supported with a custom download base URL. Please specify an exact Go version.${osm.EOL}`
+      );
+    });
+
+    it('logs info when check-latest is used with custom URL', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.13.1';
+      const customBaseUrl = 'https://example.com/golang';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+      inputs['check-latest'] = true;
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      const toolPath = path.normalize('/cache/go/1.13.1/x64');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      expect(logSpy).toHaveBeenCalledWith(
+        'check-latest is not supported with a custom download base URL. Using the provided version spec directly.'
+      );
+    });
+
+    it('constructs direct download info correctly', () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const info = im.getInfoFromDirectDownload(
+        '1.25.0',
+        'x64',
+        'https://aka.ms/golang/release/latest'
+      );
+
+      expect(info.type).toBe('dist');
+      expect(info.downloadUrl).toBe(
+        'https://aka.ms/golang/release/latest/go1.25.0.linux-amd64.tar.gz'
+      );
+      expect(info.fileName).toBe('go1.25.0.linux-amd64.tar.gz');
+      expect(info.resolvedVersion).toBe('1.25.0');
+    });
+
+    it('constructs direct download info for windows', () => {
+      os.platform = 'win32';
+      os.arch = 'x64';
+
+      const info = im.getInfoFromDirectDownload(
+        '1.25.0',
+        'x64',
+        'https://aka.ms/golang/release/latest'
+      );
+
+      expect(info.type).toBe('dist');
+      expect(info.downloadUrl).toBe(
+        'https://aka.ms/golang/release/latest/go1.25.0.windows-amd64.zip'
+      );
+      expect(info.fileName).toBe('go1.25.0.windows-amd64.zip');
+    });
+
+    it('constructs direct download info for arm64', () => {
+      os.platform = 'darwin';
+      os.arch = 'arm64';
+
+      const info = im.getInfoFromDirectDownload(
+        '1.25.0',
+        'arm64',
+        'https://aka.ms/golang/release/latest'
+      );
+
+      expect(info.type).toBe('dist');
+      expect(info.downloadUrl).toBe(
+        'https://aka.ms/golang/release/latest/go1.25.0.darwin-arm64.tar.gz'
+      );
+      expect(info.fileName).toBe('go1.25.0.darwin-arm64.tar.gz');
+    });
+
+    it('caches under actual installed version when it differs from input spec', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.20';
+      const customBaseUrl = 'https://aka.ms/golang/release/latest';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+
+      // Mock the installed Go binary reporting a different patch version
+      execFileSpy.mockImplementation(() => 'go version go1.20.14 linux/amd64');
+
+      const expectedToolName = im.customToolCacheName(customBaseUrl);
+      const toolPath = path.normalize(`/cache/${expectedToolName}/1.20.14/x64`);
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      expect(logSpy).toHaveBeenCalledWith(
+        "Requested version '1.20' resolved to installed version '1.20.14'"
+      );
+      // Cache key should use actual version, not the input spec
+      expect(cacheSpy).toHaveBeenCalledWith(
+        expect.any(String),
+        expectedToolName,
+        '1.20.14',
+        'x64'
+      );
+    });
+
+    it('shows clear error with platform/arch and URL on 404', async () => {
+      os.platform = 'linux';
+      os.arch = 'arm64';
+
+      const versionSpec = '1.25.0';
+      const customBaseUrl = 'https://example.com/golang';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+
+      getSpy.mockImplementationOnce(() => {
+        throw new Error('Not a JSON endpoint');
+      });
+
+      findSpy.mockImplementation(() => '');
+      const httpError = new tc.HTTPError(404);
+      dlSpy.mockImplementation(() => {
+        throw httpError;
+      });
+
+      await main.run();
+
+      expect(cnSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          'The requested Go version 1.25.0 is not available for platform linux/arm64'
+        )
+      );
+      expect(cnSpy).toHaveBeenCalledWith(expect.stringContaining('HTTP 404'));
+    });
+
+    it('shows clear error with platform/arch and URL on download failure', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.25.0';
+      const customBaseUrl = 'https://example.com/golang';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+
+      getSpy.mockImplementationOnce(() => {
+        throw new Error('Not a JSON endpoint');
+      });
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(() => {
+        throw new Error('connection refused');
+      });
+
+      await main.run();
+
+      expect(cnSpy).toHaveBeenCalledWith(
+        expect.stringContaining(
+          'Failed to download Go 1.25.0 for platform linux/x64'
+        )
+      );
+      expect(cnSpy).toHaveBeenCalledWith(
+        expect.stringContaining(customBaseUrl)
+      );
+    });
+
+    it.each(['^1.25.0', '~1.25', '>=1.25.0', '<1.26.0', '1.25.x', '1.x'])(
+      'errors on version range "%s" when version listing is unavailable',
+      async versionSpec => {
+        os.platform = 'linux';
+        os.arch = 'x64';
+
+        inputs['go-version'] = versionSpec;
+        inputs['go-download-base-url'] = 'https://example.com/golang';
+
+        // Simulate version listing not available
+        getSpy.mockImplementationOnce(() => {
+          throw new Error('Not a JSON endpoint');
+        });
+
+        findSpy.mockImplementation(() => '');
+
+        await main.run();
+
+        expect(cnSpy).toHaveBeenCalledWith(
+          expect.stringContaining(
+            `Version range '${versionSpec}' is not supported with a custom download base URL`
+          )
+        );
+      }
+    );
+
+    it('rejects version range in getInfoFromDirectDownload', () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      expect(() =>
+        im.getInfoFromDirectDownload(
+          '^1.25.0',
+          'x64',
+          'https://example.com/golang'
+        )
+      ).toThrow(
+        "Version range '^1.25.0' is not supported with a custom download base URL"
+      );
+    });
+
+    it('passes token as auth header for custom URL downloads', async () => {
+      os.platform = 'linux';
+      os.arch = 'x64';
+
+      const versionSpec = '1.25.0';
+      const customBaseUrl = 'https://private-mirror.example.com/golang';
+
+      inputs['go-version'] = versionSpec;
+      inputs['go-download-base-url'] = customBaseUrl;
+      inputs['token'] = 'ghp_testtoken123';
+
+      getSpy.mockImplementationOnce(() => {
+        throw new Error('Not a JSON endpoint');
+      });
+
+      findSpy.mockImplementation(() => '');
+      dlSpy.mockImplementation(async () => '/some/temp/path');
+      extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
+      const expectedToolName = im.customToolCacheName(customBaseUrl);
+      const toolPath = path.normalize(`/cache/${expectedToolName}/1.25.0/x64`);
+      cacheSpy.mockImplementation(async () => toolPath);
+
+      await main.run();
+
+      expect(dlSpy).toHaveBeenCalledWith(
+        `${customBaseUrl}/go1.25.0.linux-amd64.tar.gz`,
+        undefined,
+        'token ghp_testtoken123'
+      );
+    });
+  });
 });

action.yml

@@ -19,6 +19,8 @@ inputs:
     description: 'Used to specify the path to a dependency file (e.g., go.mod, go.sum)'
   architecture:
     description: 'Target architecture for Go to use. Examples: x86, x64. Will use system architecture by default.'
+  go-download-base-url:
+    description: 'Custom base URL for downloading Go distributions. Use this to download Go from a mirror or custom source. Defaults to "https://go.dev/dl". Can also be set via the GO_DOWNLOAD_BASE_URL environment variable. The input takes precedence over the environment variable.'
 outputs:
   go-version:
     description: 'The installed Go version. Useful when given a version range as input.'

docs/advanced-usage.md

@@ -0,0 +1,498 @@
+# Advanced Usage
+- [Using the go-version input](advanced-usage.md#using-the-go-version-input)
+  - [Specifying a go version](advanced-usage.md#specifying-a-go-version)
+  - [Matrix testing](advanced-usage.md#matrix-testing)
+- [Using the go-version-file input](advanced-usage.md#using-the-go-version-file-input)
+- [Check latest version](advanced-usage.md#check-latest-version)
+- [Caching](advanced-usage.md#caching)
+  - [Caching in monorepos](advanced-usage.md#caching-in-monorepos)
+  - [Caching in multi-module repositories](advanced-usage.md#caching-in-multi-module-repositories)
+  - [Multi-target builds](advanced-usage.md#multi-target-builds)
+  - [Cache invalidation on source changes](advanced-usage.md#cache-invalidation-on-source-changes)
+  - [Restore-only caches](advanced-usage.md#restore-only-caches)
+  - [Parallel builds](advanced-usage.md#parallel-builds)
+- [Outputs](advanced-usage.md#outputs)
+- [Custom download URL](advanced-usage.md#custom-download-url)
+- [Using `setup-go` on GHES](advanced-usage.md#using-setup-go-on-ghes)
+
+## Using the `go-version` input
+
+### Specifying a Go version
+
+For repeatable builds, specify the **exact major, minor, and patch version** (such as `1.25.5`):
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25.5'
+  - run: go run hello.go
+```
+
+- The only downside is that setup may take a little longer. If the exact version is not already installed on the runner due to more recent versions, the exact version will have to be downloaded.
+
+You can specify **only a major and minor version** if you are okay with the most recent patch version being used:
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+  - run: go run hello.go
+```
+
+- There will be a single patch version already installed on each runner for every minor version of Go that is supported.
+- The preinstalled patch version is generally the latest available. When a new patch is released, it replaces the previously preinstalled version on the runner.
+- Using the most recent patch version speeds up setup because the required Go version is already installed on the runner and no download is needed.
+
+To try a **pre-release**:
+Download and use beta or RC Go versions as needed.
+
+```yaml
+# RC version
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25.0-rc.2'
+  - run: go version
+```
+
+```yaml
+# Beta version
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.19.0-beta.1'
+  - run: go version
+```
+
+Using **stable/oldstable aliases**:
+
+If `stable` is provided, the action will get the latest stable version from the [`go-versions`](https://github.com/actions/go-versions/blob/main/versions-manifest.json) repository manifest.
+
+If `oldstable` is provided, the action resolves it to the latest patch release of the previous stable Go minor version (for example, if the latest stable is `1.25.x`, `oldstable` resolves to `1.24.x`, where `x` is the latest patch release).
+
+**Note:** Using these aliases will result in the same version as when using the corresponding minor release with the `check-latest` input set to `true`.  
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: 'stable'
+  - run: go run hello.go
+```
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: 'oldstable'
+  - run: go run hello.go
+```
+
+You can also use **SemVer's version range syntax**, for instance:
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '^1.25.1'
+  - run: go version
+```
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '>=1.24.0-rc.1'
+  - run: go version
+```
+
+### Matrix testing
+
+Using `setup-go` it's possible to use the [matrix syntax](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstrategymatrix) to install several versions of Go:
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        go: [ '1.24', '1.25' ]
+    name: Go ${{ matrix.go }} sample
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ matrix.go }}
+      - run: go run hello.go
+```
+
+Exclude a specific Go version:
+
+```yaml
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        go: [ '1.22', '1.24', '1.25']
+        exclude:
+          - os: macos-latest
+            go: '1.22'
+          - os: windows-latest
+            go: '1.25'
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ matrix.go }}
+      - run: go run hello.go
+```
+
+## Using the `go-version-file` input
+
+`setup-go` action can read the Go version from a version file. `go-version-file` input is used for specifying the path to the version file. If the file supplied to the `go-version-file` input doesn't exist, the action will fail with an error. This input supports go.mod, go.work, .go-version, and .tool-versions files.
+
+If both the `go-version` and the `go-version-file` inputs are provided then the `go-version` input is used. The `.tool-versions` file supports version specifications in accordance with asdf standards, adhering to Semantic Versioning ([semver](https://semver.org)).
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version-file: 'path/to/go.mod'  # Read Go version from go.mod
+  - run: go version
+```
+
+- Uses the `toolchain` directive if present, otherwise the action falls back to the `go` directive.
+
+- The `go` directive in `go.mod` can specify a patch version or omit it altogether (e.g., `go 1.25.0` or `go 1.25`). If a patch version is specified, that specific patch version will be used. If no patch version is specified, it will search for the latest available patch version in the cache,
+[versions-manifest.json](https://github.com/actions/go-versions/blob/main/versions-manifest.json), and the
+[official Go language website](https://go.dev/dl/?mode=json&include=all), in that order.
+
+> The action will search for the `go.mod` file relative to the repository root.
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version-file: '.go-version' # Read Go version from .go-version
+  - run: go version
+```
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version-file: '.tool-versions' # Read Go version from .tool-versions
+  - run: go version
+```
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version-file: 'go.work' # Read Go version from go.work
+  - run: go version
+```
+
+## Check latest version
+
+The `check-latest` flag defaults to `false`. Use the default or set `check-latest` to `false` if you prefer stability
+and if you want to ensure a specific Go version is always used.
+
+If `check-latest` is set to `true`, the action first checks if the cached version is the latest one. If the locally
+cached version is not the most up-to-date, a Go version will then be downloaded. Set `check-latest` to `true` if you
+want the most up-to-date Go version to always be used. It supports major (e.g., "1") and major.minor (e.g., "1.25") version selectors, always resolving to the latest matching patch release.
+
+> Setting `check-latest` to `true` has performance implications as downloading Go versions is slower than using cached
+> versions.
+>
+> `check-latest` is ignored when `go-download-base-url` is set. See [Custom download URL](#custom-download-url) for details.
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+      check-latest: true
+  - run: go run hello.go
+```
+
+## Caching
+ 
+### Caching in monorepos
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+      cache-dependency-path: subdir/go.sum
+  - run: go run hello.go
+```
+
+### Caching in multi-module repositories
+
+`cache-dependency-path` input accepts glob patterns and multi-line values:
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+      cache-dependency-path: '**/go.sum'
+  - run: go run hello.go
+```
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+      cache-dependency-path: |
+        subdir/go.sum
+        tools/go.sum
+  - run: go run hello.go
+```
+
+### Multi-target builds
+
+`cache-dependency-path` isn’t limited to dependency files (like `go.sum`). It can also include files that capture build settings (for example, `GOOS`/`GOARCH`). This allows separate caches per target platform (OS/architecture) and helps avoid reusing caches across incompatible builds.
+
+```yaml
+env:
+  GOOS: ...
+  GOARCH: ...
+
+steps:
+  - run: echo "$GOOS $GOARCH" > env.txt
+
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+      cache-dependency-path: |
+        go.sum
+        env.txt
+  - run: go run hello.go    
+```
+
+### Cache invalidation on source changes
+
+Besides dependencies, the action can also cache build outputs (the [`GOCACHE`](https://pkg.go.dev/cmd/go#hdr-Build_and_test_caching) directory). By default, this cache is not updated based on source changes to help avoid unpredictable and frequent cache invalidation. To invalidate the cache when source files change, include source files in the `cache-dependency-path` input.
+
+> **Note:** Including patterns like `**/*.go` can create new caches on many commits, increasing cache storage and potentially slowing workflows due to more frequent uploads/downloads.
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+      cache-dependency-path: |
+        go.sum
+        **/*.go
+  - run: go run hello.go
+```
+
+### Restore-only caches
+
+Restore caches without saving new entries. This can help reduce cache writes and storage usage in workflows that only need to read from the cache:
+
+```yaml
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v6
+      - name: Setup go
+        id: setup-go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.25.5'
+          cache: false
+      # Capture Go cache locations
+      - name: Set Go cache variables (Linux/macOS)
+        if: runner.os != 'Windows'
+        run: |
+          echo "GO_MOD_CACHE=$(go env GOMODCACHE)" >> $GITHUB_ENV
+          echo "GO_BUILD_CACHE=$(go env GOCACHE)" >> $GITHUB_ENV
+      - name: Set Go cache variables (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          echo "GO_MOD_CACHE=$(go env GOMODCACHE)" | Out-File $env:GITHUB_ENV -Append
+          echo "GO_BUILD_CACHE=$(go env GOCACHE)"   | Out-File $env:GITHUB_ENV -Append
+      # Normalize runner.arch to lowercase to ensure consistent cache keys
+      - name: Normalize runner architecture (Linux/macOS)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: echo "ARCH=$(echo '${{ runner.arch }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
+      - name: Normalize runner architecture (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $arch = "${{ runner.arch }}".ToLower()
+          echo "ARCH=$arch" | Out-File $env:GITHUB_ENV -Append
+      - name: Set cache OS suffix for Linux
+        if: runner.os == 'Linux'
+        shell: bash
+        run: echo "CACHE_OS_SUFFIX=$ImageOS-" >> $GITHUB_ENV
+      - name: Restore Go cache
+        id: go-cache
+        uses: actions/cache/restore@v5
+        with:
+          path: |
+            ${{ env.GO_MOD_CACHE }}
+            ${{ env.GO_BUILD_CACHE }}
+          key: setup-go-${{ runner.os }}-${{ env.ARCH }}-${{ env.CACHE_OS_SUFFIX }}go-${{ steps.setup-go.outputs.go-version }}-${{ hashFiles('**/go.mod') }}
+      - name: Download modules
+        run: go mod download
+      - name: Build
+        run: go build ./...
+```
+
+> If there are several builds on the same repo, it may make sense to create a cache in one build and use it in others. The action [actions/cache/restore](https://github.com/actions/cache/tree/main/restore#only-restore-cache)
+should be used in this case.
+
+### Parallel builds
+
+To avoid race conditions during parallel builds, either use distinct cache keys with [actions/cache](https://github.com/actions/cache/blob/main/examples.md#go---modules), or create the cache in only one build and [restore](#restore-only-caches) it in the other builds.
+
+## Outputs
+
+### `go-version`
+
+Using **go-version** output, it's possible to get the precise Go version installed by the action. This output is useful when the input `go-version` is given as a range, but down the line you need to operate (such as in an `if:` statement) with the exact installed version (e.g. 1.24.11). 
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        id: go124
+        with:
+          go-version: '^1.24'
+      - run: echo "Installed Go version: ${{ steps.go124.outputs.go-version }}"
+```
+
+### `cache-hit`
+
+**cache-hit** output is available with a boolean value that indicates whether a cache hit occurred on the primary key:
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        id: go124
+        with:
+          go-version: '1.24'
+          cache: true
+      - run: echo "Was the Go cache restored? ${{ steps.go124.outputs.cache-hit }}" # true if cache-hit occurred
+```
+
+## Custom download URL
+
+The `go-download-base-url` input lets you download Go from a mirror or alternative source instead of the default `https://go.dev/dl`. This can also be set via the `GO_DOWNLOAD_BASE_URL` environment variable; the input takes precedence over the environment variable.
+
+When a custom base URL is provided, the action skips the `actions/go-versions` manifest lookup and downloads directly from the specified URL.
+
+**Using the [Microsoft build of Go](https://github.com/nicholasgasior/microsoft-go):**
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+      go-download-base-url: 'https://aka.ms/golang/release/latest'
+  - run: go version
+```
+
+**Using an environment variable:**
+
+```yaml
+env:
+  GO_DOWNLOAD_BASE_URL: 'https://aka.ms/golang/release/latest'
+
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+  - run: go version
+```
+
+> **Note:** Version range syntax (`^1.25`, `~1.24`, `>=1.25.0`) and aliases (`stable`, `oldstable`) are not supported with custom download URLs. Use exact versions such as `1.25`, `1.25.0`, or `1.25.0-1` (for sources that use revision numbers). If the custom server provides a version listing endpoint (`/?mode=json&include=all`), semver ranges will work; otherwise only exact versions are accepted.
+
+> **Note:** The `check-latest` option is ignored when a custom download base URL is set. The action cannot query the custom server for the latest version, so it uses the version you specify directly. If you provide a partial version like `1.25`, the server determines which patch release to serve.
+
+**Authenticated downloads:**
+
+If your custom download source requires authentication, the `token` input is forwarded as an `Authorization` header. For example, to download from a private mirror:
+
+```yaml
+steps:
+  - uses: actions/checkout@v6
+  - uses: actions/setup-go@v6
+    with:
+      go-version: '1.25'
+      go-download-base-url: 'https://private-mirror.example.com/golang'
+      token: ${{ secrets.MIRROR_TOKEN }}
+  - run: go version
+```
+
+## Using `setup-go` on GHES
+
+### Avoiding rate limit issues
+
+`setup-go` comes pre-installed on the appliance with GHES if Actions is enabled.
+When dynamically downloading Go distributions, `setup-go` downloads distributions from [`actions/go-versions`](https://github.com/actions/go-versions) on github.com (outside of the appliance).
+
+These calls to `actions/go-versions` are made via unauthenticated requests, which are limited to [60 requests per hour per IP](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting).
+If more requests are made within the time frame, then the action leverages the `raw API` to retrieve the version-manifest. This approach does not impose a rate limit and hence facilitates unrestricted consumption. This is particularly beneficial for GHES runners, which often share the same IP, to avoid the quick exhaustion of the unauthenticated rate limit.
+If that fails as well the action will try to download versions directly from [go.dev](https://go.dev/dl).
+
+If that fails as well you can get a higher rate limit with [generating a personal access token on github.com](https://github.com/settings/tokens/new) and passing it as the `token` input to the action:
+
+```yaml
+uses: actions/setup-go@v6
+with:
+  token: ${{ secrets.GH_DOTCOM_TOKEN }}
+  go-version: '1.25'
+```
+
+### No access to github.com
+
+If the runner is not able to access github.com, any Go versions requested during a workflow run must come from the runner's tool cache.
+See "[Setting up the tool cache on self-hosted runners without internet access](https://docs.github.com/en/enterprise-server@3.2/admin/github-actions/managing-access-to-actions-from-githubcom/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access)"
+for more information.

package-lock.json

@@ -77,13 +77,13 @@
       }
     },
     "node_modules/@actions/cache/node_modules/@actions/http-client": {
-      "version": "3.0.0",
+      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
-      "integrity": "sha512-1s3tXAfVMSz9a4ZEBkXXRQD4QhY3+GAsWSbaYpeknPOKEeyRiU3lH+bHiLMZdo2x/fIeQ/hscL1wCkDLVM2DZQ==",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
-        "undici": "^5.28.5"
+        "undici": "^6.23.0"
       }
     },
     "node_modules/@actions/cache/node_modules/@actions/io": {
@@ -101,6 +101,15 @@
         "semver": "bin/semver.js"
       }
     },
+    "node_modules/@actions/cache/node_modules/undici": {
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
     "node_modules/@actions/core": {
       "version": "1.11.1",
       "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
@@ -1962,13 +1971,13 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "9.0.5",
+      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -2096,9 +2105,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
+      "version": "6.14.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3357,10 +3366,22 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-xml-builder": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.0.0.tgz",
+      "integrity": "sha512-fpZuDogrAgnyt9oDDz+5DBz0zgPdPZz6D4IR7iESxRXElrlGTRkHJ9eEt+SACRJwT0FNFrt71DFQIUFBJfX/uQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/fast-xml-parser": {
-      "version": "5.3.3",
+      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.3.tgz",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.4.1.tgz",
-      "integrity": "sha512-2O3dkPAAC6JavuMm8+4+pgTk+5hoAs+CjZ+sWcQLkX9+/tHRuTkQh/Oaifr8qDmZ8iEHb771Ea6G8CdwkrgvYA==",
+      "integrity": "sha512-BQ30U1mKkvXQXXkAGcuyUA/GA26oEB7NzOtsxCDtyu62sjGw5QraKFhx2Em3WQNjPw9PG6MQ9yuIIgkSDfGu5A==",
       "funding": [
         {
           "type": "github",
@@ -3369,7 +3390,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "strnum": "^2.1.0"
+        "fast-xml-builder": "^1.0.0",
+        "strnum": "^2.1.2"
       },
       "bin": {
         "fxparser": "src/cli/cli.js"
@@ -4840,9 +4862,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
+      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
       "dev": true,
       "license": "MIT"
     },
@@ -4955,9 +4977,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
+      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -5487,9 +5509,9 @@
       "license": "MIT"
     },
     "node_modules/qs": {
-      "version": "6.14.1",
+      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.1.tgz",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
-      "integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
+      "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {

src/installer.ts

@@ -4,6 +4,8 @@ import * as path from 'path';
 import * as semver from 'semver';
 import * as httpm from '@actions/http-client';
 import * as sys from './system';
+import crypto from 'crypto';
+import cp from 'child_process';
 import fs from 'fs';
 import os from 'os';
 import {StableReleaseAlias, isSelfHosted} from './utils';
@@ -15,9 +17,17 @@ const MANIFEST_REPO_OWNER = 'actions';
 const MANIFEST_REPO_NAME = 'go-versions';
 const MANIFEST_REPO_BRANCH = 'main';
 const MANIFEST_URL = `https://raw.githubusercontent.com/${MANIFEST_REPO_OWNER}/${MANIFEST_REPO_NAME}/${MANIFEST_REPO_BRANCH}/versions-manifest.json`;
+const DEFAULT_GO_DOWNLOAD_BASE_URL = 'https://go.dev/dl';
 
 type InstallationType = 'dist' | 'manifest';
 
+const GOLANG_DOWNLOAD_URL = 'https://go.dev/dl/?mode=json&include=all';
+
+// Base URLs known to not serve a version listing JSON endpoint.
+// For these URLs we skip the getInfoFromDist() call entirely and construct
+// the download URL directly, avoiding a guaranteed-404 HTTP request.
+const NO_VERSION_LISTING_BASE_URLS = ['https://aka.ms/golang/release/latest'];
+
 export interface IGoVersionFile {
   filename: string;
   // darwin, linux, windows
@@ -42,15 +52,23 @@ export async function getGo(
   versionSpec: string,
   checkLatest: boolean,
   auth: string | undefined,
-  arch: Architecture = os.arch() as Architecture
+  arch: Architecture = os.arch() as Architecture,
+  goDownloadBaseUrl?: string
 ) {
   let manifest: tc.IToolRelease[] | undefined;
   const osPlat: string = os.platform();
+  const customBaseUrl = goDownloadBaseUrl?.replace(/\/+$/, '');
 
   if (
     versionSpec === StableReleaseAlias.Stable ||
     versionSpec === StableReleaseAlias.OldStable
   ) {
+    if (customBaseUrl) {
+      throw new Error(
+        `Version aliases '${versionSpec}' are not supported with a custom download base URL. Please specify an exact Go version.`
+      );
+    }
+
     manifest = await getManifest(auth);
     let stableVersion = await resolveStableVersionInput(
       versionSpec,
@@ -74,7 +92,14 @@ export async function getGo(
   }
 
   if (checkLatest) {
-    core.info('Attempting to resolve the latest version from the manifest...');
+    if (customBaseUrl) {
+      core.info(
+        'check-latest is not supported with a custom download base URL. Using the provided version spec directly.'
+      );
+    } else {
+      core.info(
+        'Attempting to resolve the latest version from the manifest...'
+      );
       const resolvedVersion = await resolveVersionFromManifest(
         versionSpec,
         true,
@@ -89,9 +114,16 @@ export async function getGo(
         core.info(`Failed to resolve version ${versionSpec} from manifest`);
       }
     }
+  }
+
+  // Use a distinct tool cache name for custom downloads to avoid
+  // colliding with the runner's pre-installed Go
+  const toolCacheName = customBaseUrl
+    ? customToolCacheName(customBaseUrl)
+    : 'go';
 
   // check cache
-  const toolPath = tc.find('go', versionSpec, arch);
+  const toolPath = tc.find(toolCacheName, versionSpec, arch);
   // If not found in cache, download
   if (toolPath) {
     core.info(`Found in cache @ ${toolPath}`);
@@ -101,6 +133,49 @@ export async function getGo(
   let downloadPath = '';
   let info: IGoVersionInfo | null = null;
 
+  if (customBaseUrl) {
+    //
+    // Download from custom base URL
+    //
+    const skipVersionListing = NO_VERSION_LISTING_BASE_URLS.some(
+      url => customBaseUrl.toLowerCase() === url.toLowerCase()
+    );
+
+    if (skipVersionListing) {
+      core.info(
+        'Skipping version listing for known direct-download URL. Constructing download URL directly.'
+      );
+      info = getInfoFromDirectDownload(versionSpec, arch, customBaseUrl);
+    } else {
+      try {
+        info = await getInfoFromDist(versionSpec, arch, customBaseUrl);
+      } catch {
+        core.info(
+          'Version listing not available from custom URL. Constructing download URL directly.'
+        );
+      }
+      if (!info) {
+        info = getInfoFromDirectDownload(versionSpec, arch, customBaseUrl);
+      }
+    }
+
+    try {
+      core.info('Install from custom download URL');
+      downloadPath = await installGoVersion(info, auth, arch, toolCacheName);
+    } catch (err) {
+      const downloadUrl = info?.downloadUrl || customBaseUrl;
+      if (err instanceof tc.HTTPError && err.httpStatusCode === 404) {
+        throw new Error(
+          `The requested Go version ${versionSpec} is not available for platform ${osPlat}/${arch}. ` +
+            `Download URL returned HTTP 404: ${downloadUrl}`
+        );
+      }
+      throw new Error(
+        `Failed to download Go ${versionSpec} for platform ${osPlat}/${arch} ` +
+          `from ${downloadUrl}: ${err}`
+      );
+    }
+  } else {
     //
     // Try download from internal distribution (popular versions only)
     //
@@ -146,6 +221,7 @@ export async function getGo(
         throw new Error(`Failed to download version ${versionSpec}: ${err}`);
       }
     }
+  }
 
   return downloadPath;
 }
@@ -227,20 +303,26 @@ async function cacheWindowsDir(
 async function addExecutablesToToolCache(
   extPath: string,
   info: IGoVersionInfo,
-  arch: string
+  arch: string,
+  toolName: string = 'go'
 ): Promise<string> {
-  const tool = 'go';
   const version = makeSemver(info.resolvedVersion);
   return (
-    (await cacheWindowsDir(extPath, tool, version, arch)) ||
+    (await cacheWindowsDir(extPath, toolName, version, arch)) ||
-    (await tc.cacheDir(extPath, tool, version, arch))
+    (await tc.cacheDir(extPath, toolName, version, arch))
   );
 }
 
+export function customToolCacheName(baseUrl: string): string {
+  const hash = crypto.createHash('sha256').update(baseUrl).digest('hex');
+  return `go-${hash.substring(0, 8)}`;
+}
+
 async function installGoVersion(
   info: IGoVersionInfo,
   auth: string | undefined,
-  arch: string
+  arch: string,
+  toolName: string = 'go'
 ): Promise<string> {
   core.info(`Acquiring ${info.resolvedVersion} from ${info.downloadUrl}`);
 
@@ -258,13 +340,48 @@ async function installGoVersion(
     extPath = path.join(extPath, 'go');
   }
 
+  // For custom downloads, detect the actual installed version so the cache
+  // key reflects the real patch level (e.g. input "1.20" may install 1.20.14).
+  if (toolName !== 'go') {
+    const actualVersion = detectInstalledGoVersion(extPath);
+    if (actualVersion && actualVersion !== info.resolvedVersion) {
+      core.info(
+        `Requested version '${info.resolvedVersion}' resolved to installed version '${actualVersion}'`
+      );
+      info.resolvedVersion = actualVersion;
+    }
+  }
+
   core.info('Adding to the cache ...');
-  const toolCacheDir = await addExecutablesToToolCache(extPath, info, arch);
+  const toolCacheDir = await addExecutablesToToolCache(
+    extPath,
+    info,
+    arch,
+    toolName
+  );
   core.info(`Successfully cached go to ${toolCacheDir}`);
 
   return toolCacheDir;
 }
 
+function detectInstalledGoVersion(goDir: string): string | null {
+  try {
+    const goBin = path.join(
+      goDir,
+      'bin',
+      os.platform() === 'win32' ? 'go.exe' : 'go'
+    );
+    const output = cp.execFileSync(goBin, ['version'], {encoding: 'utf8'});
+    const match = output.match(/go version go(\S+)/);
+    return match ? match[1] : null;
+  } catch (err) {
+    core.debug(
+      `Failed to detect installed Go version: ${(err as Error).message}`
+    );
+    return null;
+  }
+}
+
 export async function extractGoArchive(archivePath: string): Promise<string> {
   const platform = os.platform();
   let extPath: string;
@@ -382,14 +499,23 @@ export async function getInfoFromManifest(
 
 async function getInfoFromDist(
   versionSpec: string,
-  arch: Architecture
+  arch: Architecture,
+  goDownloadBaseUrl?: string
 ): Promise<IGoVersionInfo | null> {
-  const version: IGoVersion | undefined = await findMatch(versionSpec, arch);
+  const dlUrl = goDownloadBaseUrl
+    ? `${goDownloadBaseUrl}/?mode=json&include=all`
+    : GOLANG_DOWNLOAD_URL;
+  const version: IGoVersion | undefined = await findMatch(
+    versionSpec,
+    arch,
+    dlUrl
+  );
   if (!version) {
     return null;
   }
 
-  const downloadUrl = `https://go.dev/dl/${version.files[0].filename}`;
+  const baseUrl = goDownloadBaseUrl || DEFAULT_GO_DOWNLOAD_BASE_URL;
+  const downloadUrl = `${baseUrl}/${version.files[0].filename}`;
 
   return <IGoVersionInfo>{
     type: 'dist',
@@ -399,9 +525,43 @@ async function getInfoFromDist(
   };
 }
 
+export function getInfoFromDirectDownload(
+  versionSpec: string,
+  arch: Architecture,
+  goDownloadBaseUrl: string
+): IGoVersionInfo {
+  // Reject version specs that can't map to an artifact filename
+  if (/[~^>=<|*x]/.test(versionSpec)) {
+    throw new Error(
+      `Version range '${versionSpec}' is not supported with a custom download base URL ` +
+        `when version listing is unavailable. Please specify an exact version (e.g., '1.25.0').`
+    );
+  }
+
+  const archStr = sys.getArch(arch);
+  const platStr = sys.getPlatform();
+  const extension = platStr === 'windows' ? 'zip' : 'tar.gz';
+  // Ensure version has the 'go' prefix for the filename
+  const goVersion = versionSpec.startsWith('go')
+    ? versionSpec
+    : `go${versionSpec}`;
+  const fileName = `${goVersion}.${platStr}-${archStr}.${extension}`;
+  const downloadUrl = `${goDownloadBaseUrl}/${fileName}`;
+
+  core.info(`Constructed direct download URL: ${downloadUrl}`);
+
+  return <IGoVersionInfo>{
+    type: 'dist',
+    downloadUrl: downloadUrl,
+    resolvedVersion: versionSpec.replace(/^go/, ''),
+    fileName: fileName
+  };
+}
+
 export async function findMatch(
   versionSpec: string,
-  arch: Architecture = os.arch() as Architecture
+  arch: Architecture = os.arch() as Architecture,
+  dlUrl: string = GOLANG_DOWNLOAD_URL
 ): Promise<IGoVersion | undefined> {
   const archFilter = sys.getArch(arch);
   const platFilter = sys.getPlatform();
@@ -409,7 +569,6 @@ export async function findMatch(
   let result: IGoVersion | undefined;
   let match: IGoVersion | undefined;
 
-  const dlUrl = 'https://golang.org/dl/?mode=json&include=all';
   const candidates: IGoVersion[] | null = await module.exports.getVersionsDist(
     dlUrl
   );
@@ -527,9 +686,8 @@ async function resolveStableVersionDist(
 ) {
   const archFilter = sys.getArch(arch);
   const platFilter = sys.getPlatform();
-  const dlUrl = 'https://golang.org/dl/?mode=json&include=all';
   const candidates: IGoVersion[] | null = await module.exports.getVersionsDist(
-    dlUrl
+    GOLANG_DOWNLOAD_URL
   );
   if (!candidates) {
     throw new Error(`golang download url did not return results`);

src/main.ts

@@ -34,11 +34,21 @@ export async function run() {
 
       const checkLatest = core.getBooleanInput('check-latest');
 
+      const goDownloadBaseUrl =
+        core.getInput('go-download-base-url') ||
+        process.env['GO_DOWNLOAD_BASE_URL'] ||
+        undefined;
+
+      if (goDownloadBaseUrl) {
+        core.info(`Using custom Go download base URL: ${goDownloadBaseUrl}`);
+      }
+
       const installDir = await installer.getGo(
         versionSpec,
         checkLatest,
         auth,
-        arch
+        arch,
+        goDownloadBaseUrl
       );
 
       const installDirVersion = path.basename(path.dirname(installDir));