Add go 1.16 support and limit GOPATH shimming to projects not using go modules
What does this MR do?
feat: Limit GOPATH shimming to projects not using go modules
Previously we copied all projects and deps into the GOPATH unconditionally, but we should limit this shimming to only projects which aren't using go modules.
Since go1.16 changes the default behavior to GO111MODULE=on we must explicitly set to off when no modules are detected.
This should be backwards compatible.
Tested against browserker which relies on embed (introduced in 1.16):
-
❌ previous failing test https://gitlab.com/gitlab-org/security-products/analyzers/browserker/-/commits/test-go-1.16-gosec -
✅ passing test using this branch https://gitlab.com/gitlab-org/security-products/analyzers/browserker/-/commits/theoretick-main-patch-57483
What are the relevant issue numbers?
Relates to gitlab-org/gitlab#327735 (closed)
Does this MR meet the acceptance criteria?
-
Changelog entry added -
Documentation created/updated for GitLab EE, if necessary -
Documentation created/updated for this project, if necessary -
Documentation reviewed by technical writer or follow-up review issue created -
Tests added for this feature/bug -
Job definition updated, if necessary -
Conforms to the code review guidelines -
Conforms to the Go guidelines -
Security reports checked/validated by reviewer
Edited by Zach Rice