tektoncd / chains

Supply Chain Security in Tekton Pipelines
Apache License 2.0
240 stars 125 forks source link

Move tools.go to its own module #1097

Open lcarva opened 3 months ago

lcarva commented 3 months ago

As mentioned in the docs for tools.go, the dependencies used there are only meant to be used in scripts. Let's isolate those dependencies in their own go module to formalize their usage.

We could turn the parent directoy, hack, into a go module, for example. This would likely require changes in other scripts and maybe CI.

The main benefit of this approach is that CVEs found in those dependencies do not impact the Chains controller.