Add Go toolset to PATH in our internal pipelines to allow Component Governance to use it

Question

Add Go toolset to PATH in our internal pipelines to allow Component Governance to use it

dagood opened this issue 10 months ago · comments

CG wants to use go to examine go.mod files for dependencies.

We could either add the Go we build or the bootstrap Go to PATH to satisfy CG.

I think we should only add it to PATH near the end of our build, to continue making sure it is not in PATH during "our" part of the pipeline (in case it is accidentally used, which should result in a failure).

Davis Goodin · Answer 1 · Thu Sep 28 2023 07:06:15 GMT+0800 (China Standard Time)

We could either add the Go we build or the bootstrap Go to PATH to satisfy CG.

I prefer adding the bootstrap, in case microsoft/main (or one of the release branches, for that matter) gets an upstream change that CG can't handle yet.