Open laurentsimon opened 2 years ago
@naveensrinivasan do you agree with my claim?
@naveensrinivasan do you agree with my claim?
Maybe not! go
proxy caches the version of the deps and shouldn't change AFAIK.
Maybe @rsc can clarify my assumption.
We're using a shell script to manually extract the dependencies to install. There must be a better way to do that, I hope
We're not pinning our dependencies in the Makefile commands run in workflow. Some example include all the additional tooling: it's currently stored under
tools
and is installed by running:cd tools; cat tools.go | grep _ | awk -F'"' '{print $$2}' | xargs -tI % go install %
This does not use the
tools/go.sum
because it runs all install asgo install github.com/XXX
. We should be pinning these dependencies properly.I've started adding pinning in https://github.com/ossf/scorecard/pull/1332 for license check.