Go auto remediation support

Why are we doing this work

Go is one of the most widely used languages for cloud-native and infrastructure tooling. Extending auto-remediation to support Go modules lets Go projects benefit from automatic MR creation for vulnerable dependency upgrades, the same way Ruby/Bundler and Java/Maven projects do today.

This is part of &19244 (Auto-remediation with automatic bumping of dependencies - GA).

Relevant links

• Parent epic: &19244
• Auto-remediation docs: https://docs.gitlab.com/ee/user/application_security/remediate/auto_remediation.html
• Updater repo: https://gitlab.com/gitlab-org/security-products/dependency-management/updater
• Orchestrator repo: https://gitlab.com/gitlab-org/security-products/dependency-management/orchestrator

Implementation plan

Package manager: go_modules (go.mod, go.sum). Version bumping is handled by the dependabot-go_modules gem.

Updater

• Add go_modules/Dockerfile - mirrors bundler/Dockerfile/maven/Dockerfile with ARG ECOSYSTEM=go_modules. Base image needs a Go toolchain since dependabot-go_modules invokes go tooling at runtime
• Add a go_modules build target to docker-bake.hcl
• Add a release job in .gitlab/ci/jobs/release-ecosystems.yml
• No Ruby code changes needed - PackageManager enum and EcosystemLoader already support go_modules

Orchestrator

No changes required. schema.json already lists go_modules as a valid package-manager value. Routing to the correct updater image is automatic.

GitLab (Rails)

• scheduler_service.rb - add 'go' to SUPPORTED_PACKAGE_MANAGERS
• job_builder.rb - add a 'go' => 'go_modules' entry to PACKAGE_MANAGER_MAPPING
• doc/user/application_security/remediate/auto_remediation.md - add a Go row to the supported package managers table

Non-functional requirements

• Documentation: update auto_remediation.md to add Go (go.mod, go.sum) to the supported package managers table
• Feature flag: gated behind existing dependency_management_auto_remediation flag - no new flag needed
• Performance: no impact - Go follows the same workload pattern as Bundler/Maven
• Testing:
  • Updater: extend ecosystem_loader_spec.rb load table; add spec/fixtures/go_modules/ fixture project; add Go contexts to file_fetcher_command_spec.rb, file_parser_command_spec.rb, file_updater_command_spec.rb
  • E2e: run the go_modules-updater container against a real GitLab project with a known vulnerable dependency and verify output.json and MR creation end-to-end

Verification steps

1. Enable dependency_management_auto_remediation feature flag on a test project using Go modules
2. Ensure dependency scanning is enabled and producing results with at least one vulnerability that has a known fix version
3. Run a pipeline and confirm an auto-remediation MR is created that bumps the vulnerable dependency in go.mod/go.sum
4. Confirm the MR title, description, and branch name follow the same format as Bundler/Maven MRs
5. Merge the MR and confirm the vulnerability is resolved in the next pipeline scan