storage.googleapis.com/golang no longer allows anonymous access causing 403 on Golang download fallback

[nicholasngai]

Description:
actions/setup-go falls back to downloading from storage.googleapis.com/golang when the download from golang-versions does not succeed.

Anonymous access to this bucket is no longer allowed, causing 403s:

https://storage.googleapis.com/golang/go1.25.3.linux-amd64.tar.gz

Action version:
actions/setup-go@v4

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:
N/A

Repro steps:

1. Hit the rate limit to go-versions. Fall back to downloading from storage.googleapis.com/golang.
2. Receive 403

Expected behavior:
The fallback to download from Go directly should work.

Actual behavior:

API rate limit exceeded for <ip>. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)
Falling back to download directly from Go
Install from dist
Acquiring go1.25.3 from https://storage.googleapis.com/golang/go1.25.3.linux-amd64.tar.gz
Error: Failed to download version ^1.20.0: Error: Unexpected HTTP response: 403

[nicholasngai]

Opened #665 which theoretically fixes this. Let me know if it works or needs more changes or if I’m missing anything!

[dmitshur]

The official Go downloads page (https://go.dev/dl/) contains the most up-to-date URLs for individual Go release files. They follow the pattern https://go.dev/dl/{file name}, so for example the go1.25.3.linux-arm64.tar.gz file should be downloaded from https://go.dev/dl/go1.25.3.linux-arm64.tar.gz. Note that particular URL happens to redirect to a CDN to serve the downloads more efficiently via dl.google.com/go/, but that CDN is an internal detail that may change in the future, so it's more future-proof to always stick to the canonical go.dev/dl/{file} URLs.

Attempting to download those files from the storage.googleapis.com/golang URL is not supported and won't keep working reliably. The storage.googleapis.com/golang URLs were used before the switch to using a CDN in 2017, and so they're not intended to still be used.

[v-HarithaVattikuti]

Hi @nicholasngai
Thank you for creating this issue. We will investigate it and provide feedback as soon as we have some updates.

[nicholasngai]

Got it. It would be appreciated if we could expedite the fix here since this is causing a lot of GHA failures on our end when we fall back to trying to download from Google.

The PRs to fix are up, across the different release branches:

• Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang #665
• [v5] Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang #666
• [v4] Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang #667
• [v3] Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang #668

[nicholasngai]

Hey @HarithaVattikuti, how quickly can we expect a resolution on this? This bucket is once again reporting a 403 for anonymous access and we are seeing widespread failures on our GitHub Enterprise instance:

Error: Failed to download version 1.24: Error: Unexpected HTTP response: 403

The PRs above are already ready and fairly straightforward. We just need someone to merge them in…

[nicholasngai]

Thanks @HarithaVattikuti! Could we merge in the backported changes to v3, v4, and v5 as well? These will help all the folks who aren’t on v6.

• [v5] Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang #666
• [v4] Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang #667
• [v3] Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang #668