Go 1.23 build and analyze failure in 2.18.3

[coryjohnson-flume]

We were utilizing the default init action that downloads the latest bundle available, once 2.18.3 was released our autobuild and analyze steps starting failing with the following error:

2024/09/04 14:10:55 internal error: error "package requires newer Go version go1.23" (*errors.errorString) without position
  2024/09/04 14:10:55 internal error: error "package requires newer Go version go1.23" (*errors.errorString) without position
  2024/09/04 14:10:59 internal error: package "entgo.io/ent/entc/gen" without types was imported from "entgo.io/contrib/entproto"
  2024/09/04 14:10:59 Extraction failed for .: exit status 1
  2024/09/04 14:10:59 Extraction failed for all discovered Go projects.
  Error: We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.18.3/x64/codeql/go/tools/autobuild.sh". Exit code was 1 and last log line was: 2024/09/04 14:10:59 Extraction failed for all discovered Go projects. See the logs for more details.

We do install the correct version of Go using GitHub actions and that does not seem to overwrite the version this is using. When we pin ourselves back to 2.18.2 in the init step everything works as expected.

[mbg]

Hi @coryjohnson-flume 👋🏻

We don't officially support Go 1.23 with CodeQL at the minute, although we expect to ship changes in the next CodeQL release (anticipated for next week) to support Go 1.23.

We updated golang.org/x/tools from v0.23.0 to v0.24.0 in CodeQL 2.18.3. The error you are getting seems to be related to trying to build a project that specifies a version of Go greater than the version of the Go libraries that (in this case) our CodeQL integration for Go was built with.

My main suggestion for you would be to wait until the new CodeQL version is out (likely the end of next week) since I would then expect this error to disappear again.

If this error occurs in a public repo, it would also be useful for us if you could link to it.

[brettcurtis]

Here's one @mbg help that's helpful.

[mbg]

Hi @brettcurtis, thanks for that link. I can see that there are some non-critical errors in that workflow run related to Go 1.23, but generally nothing overly problematic that stops the run from succeeding overall. I have confirmed that there are no errors at all with the changes that we expect to ship in this week's CodeQL release though.