golang
4 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
golang/checksums-committed | warning | The module commits go.sum, so every module a build downloads is checked against the checksum the commit recorded. |
golang/no-local-replacements | error | No replace directive redirects a module to a filesystem path, so the build reads only source the checkout carries. |
golang/toolchain-pinned | warning | The module names the toolchain that compiles it, rather than leaving the go directive as a floor. |
golang/version-declared | warning | The module declares the Go version it is built against, and that version is no older than the configured floor. |
Shared inputs
Every golang guardrail declares these inputs, and each one may add its own.
| Input | Description | Default |
|---|---|---|
projectDir | Directory holding the project, relative to the directory the CLI runs in. | . |
Shared collectors
Every golang guardrail is handed the facts these collectors gather, and each one may ask for more of its own.
| Collector | Gathers |
|---|---|
golang | The Go build in the project directory: the module it declares, the Go version it asks for, every module of a workspace, the modules it requires directly and indirectly, and the replacements and lock file beside them. |
Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.