fixes toolchain directive getting into go.mod

go_modules/Dockerfile

@@ -26,3 +26,11 @@ USER dependabot
 COPY --chown=dependabot:dependabot go_modules $DEPENDABOT_HOME/go_modules
 COPY --chown=dependabot:dependabot common $DEPENDABOT_HOME/common
 COPY --chown=dependabot:dependabot updater $DEPENDABOT_HOME/dependabot-updater
+
+# See https://tip.golang.org/doc/toolchain#select
+# By specifying go1.20, we use 1.20 for any go.mod with go directive <=1.20.
+# By specifying auto, it automatically downloads the correct version if the go.mod is > 1.20,
+# unless it's already downloaded, like Go 1.21.0 above.
+ENV GOTOOLCHAIN="go1.20+auto"
+# This pre-installs go 1.20 so that each job doesn't have to do it.
+RUN go version

go_modules/spec/dependabot/go_modules/file_updater_spec.rb

@@ -127,6 +127,15 @@ module declares its path as: go.etcd.io/bbolt
       end
     end
 
+    context "pre 1.21 go.mod that uses a 1.21 dependency" do
+      let(:project_name) { "toolchain" }
+      let(:files) { [go_mod] }
+
+      it "doesn't add a toolchain directive" do
+        expect(updated_files.first&.content).to_not include("toolchain")
+      end
+    end
+
     context "without a clone of the repository" do
       before do
         # We don't have git configured in prod, so simulate the same setup here

go_modules/spec/fixtures/projects/toolchain/go.mod

@@ -0,0 +1,7 @@
+module github.com/dependabot/vgotest
+
+go 1.20
+
+require (
+	tailscale.com v1.48.1
+)

go_modules/spec/fixtures/projects/toolchain/main.go

@@ -0,0 +1,3 @@
+package toolchain
+
+import _ "tailscale.com/log/sockstatlog"