Add golang builder to gemnasium and sbomgen-golang [gemnasium only] [sbomgen-golang only]

Oscar Tovarrequested to merge
fix-go-modules-resolution-4 into master

What does this MR do?

This MR registers the builder for the cmd/gemnasium and cmd/sbomgen-golang main packages. This is the final change required for the sbomgen-golang and gemnasium CLIs to utilize the new module resolution strategy.

The test fixtures now include a small main.go that calls some of the functionality from modules listed in the respective go.mod. This is required so that the builder returns a list of modules. If the builder runs and there is no code or no dependency usage, it will return an empty list and non-fatal error. This is a result of the way the go build tool works since it will prune the build list of any unused packages, and as a result unused modules (if no packages from the module are used at all).

Note: The qa expectations saw a lot of package removals since the Go builder pruned dependencies that were not in use in the main.go file.

Merge Request Stack

This MR is a member of a merge request stack. A merge request stack groups changes that are related.

  1. Add go toolchain required for go builder [gemna... (!389 - merged)
  2. Create go builder [gemnasium only] (!390 - merged)
  3. Handle go-project-modules.json file parsing [ge... (!391 - merged)
  4. Add golang builder to gemnasium and sbomgen-gol... (!392 - merged) ⬅ You are currently viewing this entry

What are the relevant issue numbers?

Incorrect usage of go.sum in go dependency scan... (gitlab-org/gitlab#321081 - closed)

Does this MR meet the acceptance criteria?

Edited by Oscar Tovar

Merge request reports