fix(manager/gomod): perfer to use go version defined as toolchain to update artifacts

lib/modules/manager/gomod/artifacts.spec.ts

@@ -2125,6 +2125,53 @@ describe('modules/manager/gomod/artifacts', () => {
     expect(execSnapshots).toMatchObject(expectedResult);
   });
 
+  it('go.mod file contains go toolchain version', async () => {
+    GlobalConfig.set({ ...adminConfig, binarySource: 'install' });
+    fs.readLocalFile.mockResolvedValueOnce('Current go.sum');
+    fs.readLocalFile.mockResolvedValueOnce(null); // vendor modules filename
+    fs.readLocalFile.mockResolvedValueOnce(
+      'someText\n\ngo 1.13\n\ntoolchain go1.23.6\n\n',
+    );
+    const execSnapshots = mockExecAll();
+    git.getRepoStatus.mockResolvedValueOnce(
+      partial<StatusResult>({
+        modified: ['go.sum'],
+      }),
+    );
+    fs.readLocalFile
+      .mockResolvedValueOnce('New go.sum')
+      .mockResolvedValueOnce('New go.mod');
+    datasource.getPkgReleases.mockResolvedValueOnce({
+      releases: [
+        { version: '1.17.0' },
+        { version: '1.23.6' },
+        { version: '1.24.0' },
+      ],
+    });
+    const res = await gomod.updateArtifacts({
+      packageFileName: 'go.mod',
+      updatedDeps: [{ depName: 'golang.org/x/crypto', newVersion: '0.35.0' }],
+      newPackageFileContent: gomod1,
+      config: {
+        updateType: 'minor',
+      },
+    });
+
+    expect(res).toEqual([
+      { file: { type: 'addition', path: 'go.sum', contents: 'New go.sum' } },
+      { file: { type: 'addition', path: 'go.mod', contents: 'New go.mod' } },
+    ]);
+
+    expect(execSnapshots).toMatchObject([
+      {
+        cmd: 'install-tool golang 1.23.6',
+      },
+      {
+        cmd: 'go get -d -t ./...',
+      },
+    ]);
+  });
+
   it('returns artifact notices', async () => {
     artifactsExtra.getExtraDepsNotice.mockReturnValue('some extra notice');
     GlobalConfig.set({ ...adminConfig, binarySource: 'docker' });

lib/modules/manager/gomod/artifacts.ts

@@ -451,6 +451,16 @@ async function getGoConstraints(
   if (!content) {
     return undefined;
   }
+
+  // prefer toolchain directive when go.mod has one
+  const toolchain = regEx(/^toolchain\s*go(?<gover>\d+\.\d+\.\d+)$/m);
+  const toolchainMatch = toolchain.exec(content);
+  const toolchainVer = toolchainMatch?.groups?.gover;
+  if (toolchainVer) {
+    logger.debug(`Using go version ${toolchainVer} found in toolchain directive`);
+    return toolchainVer;
+  }
+
   const re = regEx(/^go\s*(?<gover>\d+\.\d+)$/m);
   const match = re.exec(content);
   if (!match?.groups?.gover) {