There's already a command within the golang cli for this:
go list -u
And some wrappers like:
https://github.com/psampaz/go-mod-outdated
Let's build a Gitlab CI include for this, as we've already done for npm and php/composer.
Update: we'll also want to add support for discovering nested go.mod files, like what had been implemented for the deprecated npm audit CI include, even if that isn't a best practice (because it still happens).
| Title | Reference | Author | Source Branch | Dest Branch | |
|---|---|---|---|---|---|
| Add support for nested go.mod files | repos/security/gitlab-ci-security-templates!25 | sbassett | T309997-add-nested-gomod-support | main | |
| Integrate go-mod-outdated ci template for Golang Dependency Management | repos/security/gitlab-ci-security-templates!24 | mmartorana | go-mod-outdated | main |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | sbassett | T342177 [EPIC] Application Security Pipeline Components for Gitlab - Phase 2 Work | |||
| Resolved | mmartorana | T309997 Implement an outdated modules check for golang |
Using go-mod-outdated, I think either of the following basic solutions should work:
$ apt-get update -yqq && apt-get install -yqq ca-certificates curl git $ curl -L --max-redirs 3 -O -s https://go.dev/dl/go1.21.3.linux-amd64.tar.gz $ echo "1241381b2843fae5a9707eec1f8fb2ef94d827990582c7c7c32f5bdfbfd420c8 go1.21.3.linux-amd64.tar.gz" | sha256sum -c - && tar -C /usr/local -xzf go1.21.3.linux-amd64.tar.gz $ export PATH=$PATH:/usr/local/go/bin $ GOBIN=/usr/local/bin/ go install github.com/psampaz/go-mod-outdated@latest $ go mod download $ go list -u -m -json all | go-mod-outdated
Or...
$ apt-get update -yqq && apt-get install -yqq ca-certificates curl git golang-go $ export PATH=$PATH:/usr/local/go/bin $ GOBIN=/usr/local/bin/ go install github.com/psampaz/go-mod-outdated@latest $ go mod download $ go list -u -m -json all | go-mod-outdated
These work fine testing with bookworm:20231015 and random go.mod files. I'd note that go-mod-outdated seems to fail gracefully with a 0 exit code when no go.mod file is present (so no need to guard against that for now) but it can take a little longer to run than one might expect, e.g. with the buildkit example:
real 1m37.977s user 0m15.711s sys 0m2.445s
mmartorana updated https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/merge_requests/24
Integrate go-mod-outdated ci template for Golang Dependency Management
sbassett merged https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/merge_requests/24
Integrate go-mod-outdated ci template for Golang Dependency Management
sbassett opened https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/merge_requests/25
Add support for nested go.mod files
mmartorana merged https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/merge_requests/25
Add support for nested go.mod files