Feat. Go mod file detector #1547

sig-abyreddy · 2025-09-19T05:53:50Z

Description

Support for buildless inspection of Go Mod package manager through parsing of go.mod file.

Changes/Additions/Notes

Created a new detector named "Go Mod File"
Support for computing dependency graph for transitives by polling the go registry (https://proxy.golang.org)
Support for overriding the go registry URL through --detect.go.forge property
Support for considering toolchain, exclude, and replace go directives
Cascading Mechanism: Go Mod (1) > Go Mod File (2)
Accuracy: HIGH
Documentation for Go Mod File detector

Copilot

Pull Request Overview

This PR introduces a new Go mod file detector that provides buildless inspection of Go module dependencies by parsing go.mod files directly. The detector fetches transitive dependencies from the Go proxy (proxy.golang.org) and handles Go directives like toolchain, exclude, and replace.

Creates a Go Mod File detector with high accuracy
Implements recursive dependency resolution via Go proxy API calls
Supports configuration override for Go forge URL through --detect.go.forge property

Reviewed Changes

Copilot reviewed 29 out of 30 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
DetectDetectableFactory.java	Adds factory method for creating GoModFileDetectable instances
DetectorRuleFactory.java	Configures Go Mod File detector as fallback after Go Mod CLI detector
DetectableOptionFactory.java	Creates options factory with Go proxy URL configuration
DetectProperties.java	Adds new property for configuring Go forge URL
DetectableFactory.java	Integrates GoModFileDetectable creation into main factory
GoModFile*.java	Core implementation files for parsing, dependency resolution, and proxy communication
Test files	Comprehensive test coverage for all components

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

src/main/java/com/blackduck/integration/detect/configuration/DetectProperties.java

...blackduck/integration/detectable/detectables/go/gomodfile/parse/GoModDependencyResolver.java

...in/java/com/blackduck/integration/detectable/detectables/go/gomodfile/parse/GoModParser.java

Copilot

Pull Request Overview

Copilot reviewed 28 out of 30 changed files in this pull request and generated no new comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

cpottsbd · 2025-09-19T14:40:44Z

documentation/src/main/markdown/packagemgrs/golang.md

 ## Go Mod CLI (GO_MOD) detector

-* Discovers dependencies of go language (GoLang) projects.
+* Discovers dependencies of Go projects that uses Go Mod package manager.


Perhaps a small change to reflect the go mod command versus the Go Module package manager?

Discovers dependencies of Go projects that use Go Module package manager.

cpottsbd · 2025-09-19T14:44:47Z

documentation/src/main/markdown/packagemgrs/golang.md


 ## Overview

 [detect_product_short] has four detectors for GoLang:


Are we up to six detectors now I think?

cpottsbd · 2025-09-19T14:46:30Z

documentation/src/main/markdown/packagemgrs/golang.md

 [detect_product_short] has four detectors for GoLang:

 * Go Mod CLI (GO_MOD) detector (recommended)
+* Go Mod File (GO_MOD) detector


Should this be using something other than (GO_MOD) to differentiate from Go Mod CLI?

cpottsbd · 2025-09-19T14:47:19Z

documentation/src/main/markdown/packagemgrs/golang.md


+## Go Mod File (GO_MOD) detector
+
+* Discovers dependencies of Go projects that uses Go Mod package manager.


Suggestion:

Discovers dependencies of Go projects that use Go Module package manager.

andrian-sevastyanov · 2025-09-19T15:50:27Z

There are a couple of tests that seem to perform real HTTP requests.
Those should either be mocked, or we should mark the tests as integration tests using @Tag("integration").

andrian-sevastyanov

Overall the changes look good. Please consider the comments I put down.

andrian-sevastyanov · 2025-09-19T15:10:06Z

...ava/com/blackduck/integration/detectable/detectables/go/gomodfile/parse/GoModFileParser.java

+import com.blackduck.integration.detectable.detectables.go.gomodfile.parse.model.GoModuleInfo;
+import com.blackduck.integration.detectable.detectables.go.gomodfile.parse.model.GoReplaceDirective;
+
+import java.util.*;


nit: We generally try to make imports explicit and avoid wildcards. Same applies to other classes in this PR.

andrian-sevastyanov · 2025-09-19T15:12:16Z

...ava/com/blackduck/integration/detectable/detectables/go/gomodfile/parse/GoModFileParser.java

+                                     Set<GoModuleInfo> retractedVersions) {
+
+        // Check for block starts
+        if (line.startsWith("require (")) {


Do we need to be a bit more flexible regarding the number of spaces between the word and parentheses?
Same question applies to other similar checks.

andrian-sevastyanov · 2025-09-19T15:18:21Z

...in/java/com/blackduck/integration/detectable/detectables/go/gomodfile/parse/GoModParser.java

+        return fileParser.parseGoModFile(goModContents);
+    }
+
+    private void printDependencyGraphOfIndirectDependency(Dependency dependency, List<GoDependencyNode> path) {


While this doesn't print anything to the logs in debug mode, there's still quite a bit of processing going on when not in debug mode. You can avoid the unnecessary processing by introducing a check like if (logger.isDebugEnabled()) { ... }.

andrian-sevastyanov · 2025-09-19T15:19:37Z

...in/java/com/blackduck/integration/detectable/detectables/go/gomodfile/parse/GoModParser.java

+        return graph;
+    }
+
+    public List<GoDependencyNode> GetDependencyPathFromGraph(GoDependencyNode targetNode, GoDependencyNode graph, List<GoDependencyNode> visited) {


nit: method names should start with a lowercase letter

andrian-sevastyanov · 2025-09-19T15:20:25Z

.../blackduck/integration/detectable/detectables/go/gomodfile/parse/model/GoModFileHelpers.java

+        this.externalIdFactory = externalIdFactory;
+    }
+
+    public Dependency CreateDependency(GoModuleInfo moduleInfo) {


nit:c at the start of the method name should be lower cased

andrian-sevastyanov · 2025-09-19T15:26:51Z

...in/java/com/blackduck/integration/detectable/detectables/go/gomodfile/parse/GoModParser.java

+                if (childPath.isEmpty()) {
+                    visited.remove(visited.size() - 1);
+                }
+                if (!childPath.isEmpty()) {


nit: duplicate check to the one a few lines above. This could be an if/else instead.

andrian-sevastyanov · 2025-09-19T15:35:00Z

...kduck/integration/detectable/detectables/go/gomodfile/parse/model/GoProxyModuleResolver.java

+        HttpClient client = HttpClient.newBuilder().followRedirects(Redirect.ALWAYS).build();
+        try {
+            // configure http client to follow redirects
+            HttpRequest request = HttpRequest.newBuilder()


We should set some timeout settings. Otherwise the request may hang too long or even indefinitely.
Same applies to the requests that fetch dependency information.

cpottsbd · 2025-09-19T16:08:46Z

documentation/src/main/markdown/packagemgrs/golang.md

+* Discovers dependencies of Go projects that uses Go Mod package manager.
+* Attempts to run on your project if a go.mod file is found in your source directory.
+* Parses go.mod file to gather dependency information.
+* It computes dependency graph of transitives by fetching go.mod files of direct dependencies from proxy.golang.org or custom Go proxy supplied via [detect.go.forge](../properties/detectors/go.md#go-forge) property. If the proxy is not reachable, then the transitive dependencies are listed as additional components under the root module.


Minor wording change suggestion:

Computes transitive dependency graph by fetching go.mod files of direct dependencies from proxy.golang.org or custom Go proxy supplied via detect.go.forge property. If the proxy is not reachable, the transitive dependencies are listed as additional components under the root module.

sig-abyreddy added 7 commits September 3, 2025 17:17

Feat. Go mod buildless detector

7775d15

Enhanced Go Mod File parsing

06e8c32

Support for computing dependency chain through go package registry

af50913

Support for customizing go forge url through 'detect.go.forge property'

b11ab93

Include transitives under additional components in fallback scenario

0dcdd86

added more tests

ac242f3

more tests

6b0c94d

sig-abyreddy requested a review from Copilot September 19, 2025 05:53

Copilot AI reviewed Sep 19, 2025

View reviewed changes

sig-abyreddy and others added 2 commits September 19, 2025 11:24

Merge branch 'master' into go-mod-buildless-detector

8510b9f

addressing copilot review

149ccc4

sig-abyreddy requested a review from Copilot September 19, 2025 06:17

Copilot AI reviewed Sep 19, 2025

View reviewed changes

docs update

9b2bbda

sig-abyreddy changed the title ~~Draft: Feat. Go mod file detector~~ Feat. Go mod file detector Sep 19, 2025

sig-abyreddy requested review from cpottsbd, dterrybd, andrian-sevastyanov, shantyk and bd-samratmuk September 19, 2025 14:04

Merge branch 'master' into go-mod-buildless-detector

83c1e59

sig-abyreddy requested a review from devmehtabd September 19, 2025 14:10

cpottsbd reviewed Sep 19, 2025

View reviewed changes

andrian-sevastyanov requested changes Sep 19, 2025

View reviewed changes

cpottsbd reviewed Sep 19, 2025

View reviewed changes


		## Overview

		[detect_product_short] has four detectors for GoLang:


		## Go Mod File (GO_MOD) detector

		* Discovers dependencies of Go projects that uses Go Mod package manager.

Feat. Go mod file detector #1547

Are you sure you want to change the base?

Feat. Go mod file detector #1547

Uh oh!

Conversation

sig-abyreddy commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes/Additions/Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cpottsbd Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrian-sevastyanov commented Sep 19, 2025

Uh oh!

andrian-sevastyanov left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sig-abyreddy commented Sep 19, 2025 •

edited

Loading

cpottsbd Sep 19, 2025 •

edited

Loading