storage.googleapis.com/golang GCS anonymous access revocation causing 403 errors in `actions/setup-go`

[nicholasngai]

We recently starting seeing this error show up when using actions/setup-go@v4:

Falling back to download directly from Go
Install from dist
Acquiring go1.24.9 from https://storage.googleapis.com/golang/go1.24.9.linux-amd64.tar.gz
Error: Failed to download version 1.24: Error: Unexpected HTTP response: 403

This appears to be due to the fact that anonymous access to this GCS bucket has been revoked:

We know that the root cause of this issue is actions/setup-go, not Golang. We have already filed actions/setup-go#664 and several PRs (actions/setup-go#665 actions/setup-go#666 actions/setup-go#667 actions/setup-go#668) against the same repo to point to the new CDN URL that is now used to serve Golang binaries.

Sadly, they have been slow to respond to/address the issue and we are seeing widespread failures in our GHAs using Golang as a result. We aren’t asking for anonymous access to be permanently restored, but is it possible to temporarily restore access at least until actions/setup-go updates the URLs that it is pointing to to download the Go binary?

[seankhliao]

I believe this is standard GCS rate limiting, there's nothing project can do to increase it.

[nicholasngai]

Hey! Sorry, I might have been unclear. This is not rate limiting—the rate limit in the message has to do with pulling the Golang binary from GitHub rather than GCS. actions/setup-go only falls back to GCS when it is rate limited by the GitHub—in other words, the rate limit is a red herring for what this issue is about.

GCS no longer exposes anonymous access to the bucket so it 403s. It looks like someone changed the anonymous permissions to this bucket sometime over the weekend or this week. Is this something that could be looked into further?

[seankhliao]

GCS uses 403 for when the file doesn't exist (if you don't have bucket list permissions).
https://cloud.google.com/storage/docs/hosting-static-website-http

As I understand, using a non official download link has never been supported, and this release was never added to the bucket to begin with.

https://groups.google.com/g/golang-nuts/c/xL-B4XggX04

[seankhliao]

This response is from a Go team member as well actions/setup-go#664 (comment) .

[nicholasngai]

Yeah, as far as we can tell, the file definitely exists but the same download is just 403ing whereas it was previously working (this was working until sometime today AFAICT). We were just seeing if the team would be open to helping loosen the bucket permissions temporarily and/or help validate the existence of the file while we get the GHA fixed to stop the widespread failures of actions/setup-go.

[nicholasngai]

Not sure if you or someone else did something, but GCS is once again no longer returning 403, so it appears that anonymous access to the GCS bucket has been restored. Either way, thanks! We are still waiting for a response on actions/setup-go#664 to fix this upstream.