diff --git a/troubleshooting/codeql-builds/compiled-languages-go.md b/troubleshooting/codeql-builds/compiled-languages-go.md new file mode 100644 index 0000000..b27630b --- /dev/null +++ b/troubleshooting/codeql-builds/compiled-languages-go.md @@ -0,0 +1,40 @@ +## GoLang Private Modules + +Autobuild fails with error "Some packages could not be found" + +There are two options when it comes to private repositories: + +- Set-up the Go environment within the Actions workflow (not vendoring then) +- Vendor the dependencies + +Setting up the Go environment can be done by adding a Actions step to update the [Go settings](https://go.dev/ref/mod#private-modules) pointing them to use a [GitHub Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) with the corresponding access to the private repository. +The example below shows how this can be done using a single step beforet the CodeQL Initize step and stores the GitHub PAT in Secrets. + +**Example:** + +```yml +name: CodeQL + +env: + GOLANG_TOKEN: ${{ secrets.GOLANG_GITHUB_TOKEN }} + GOLANG_USER: octocat + +# ... +jobs: + analyze: + name: Analyze + # ... + steps: + - name: Go Configuration + run: git config --global url."https://${GOLANG_USER}:${GOLANG_TOKEN}@github.com".insteadOf "https://github.com" + + # ... Start scanning +``` + +Alternatively, pass the token into the CodeQL init action to allow it to be used for downstream git operations: + +```yml +- uses: github/codeql-action/init@v2 + with: + external-repository-token: ${{ secrets.GOLANG_GITHUB_TOKEN }} +``` diff --git a/troubleshooting/codeql-builds/compiled-languages.md b/troubleshooting/codeql-builds/compiled-languages.md index f84d11f..7838bba 100644 --- a/troubleshooting/codeql-builds/compiled-languages.md +++ b/troubleshooting/codeql-builds/compiled-languages.md @@ -5,6 +5,7 @@ * [CSharp](compiled-languages-csharp.md) * [C++](compiled-languages-cpp.md) * [Java](compiled-languages-java.md) +* [Go](compiled-languages-go.md) ## Autobuilder The autobuilder action (see [docs](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#about-autobuild-for-codeql) )