Create go builder [gemnasium only]

Oscar Tovarrequested to merge
fix-go-modules-resolution-2 into master

What does this MR do?

This MR adds the Go builder that calls packages.Load and generates a list of modules in use by the target main module. Additionally, it introduces a new NonFatalError type to the gitlab.com/gitlab-org/security-products/analyzers/gemnasium/v2/builder package. This error type is returned by the Go builder to signify that the error should not terminate the scan. Since the Go parser can parse a go.sum file, the scan will still return results even if they're not as accurate.

Merge Request Stack

This MR is a member of a merge request stack. A merge request stack groups changes that are related.

  1. Add go toolchain required for go builder [gemna... (!389 - merged)
  2. Create go builder [gemnasium only] (!390 - merged) ⬅ You are currently viewing this entry
  3. Handle go-project-modules.json file parsing [ge... (!391 - merged)
  4. Add golang builder to gemnasium and sbomgen-gol... (!392 - merged)

What are the relevant issue numbers?

Incorrect usage of go.sum in go dependency scan... (gitlab-org/gitlab#321081 - closed)

Does this MR meet the acceptance criteria?

Edited by Oscar Tovar

Merge request reports