feat: add Go ecosystem support to supply-chain plugin

Author: dcoric

SUPPLY-CHAIN.md

@@ -27,6 +27,20 @@ and on **clone/pull** (you download a poisoned repo).
 - Non-registry sources (vcs/url/editable, inline `git`/`url`/`path`, PEP 508 direct URLs).
 - Unpinned requirements and typosquats.
 
+**Go** (`go.mod`, `go.sum`):
+
+- `replace` directives pointing at local filesystem paths or redirecting to a different remote
+  module.
+- Suspicious module hosts: raw IPv4, `localhost`, or module paths containing `http://`.
+- Pseudo-versions, `+incompatible` versions, changed `toolchain` directives, and added `exclude`
+  directives.
+- Typosquatted module paths checked against the offline `lib/data/go-popular.js` list.
+- `go.sum` lockfile lines with suspicious module hosts.
+- `vendor/modules.txt` is not scanned.
+
+These heuristics are a warning layer, not a guarantee. Absence of findings does not mean a repo is
+safe.
+
 **Behaviour:** non-blocking by default (findings are surfaced for review), or configured to
 **hard-block** at/above a severity you choose.
 
@@ -240,7 +254,7 @@ Set `GIT_PROXY_SUPPLY_CHAIN_CONFIG` to a JSON file:
 {
   "enabled": true,
   "failOn": "off",
-  "ecosystems": { "npm": true, "python": true },
+  "ecosystems": { "npm": true, "python": true, "go": true },
   "typosquat": true,
   "allowPackages": [],
   "npmRegistryHosts": ["registry.npmjs.org"],
@@ -250,7 +264,8 @@ Set `GIT_PROXY_SUPPLY_CHAIN_CONFIG` to a JSON file:
 
 - `failOn` / `pull.failOn` - `"off"` (warn only) | `"low"` | `"medium"` | `"high"` | `"critical"`.
   A push/clone whose highest finding meets or exceeds the threshold is blocked.
-- `allowPackages` - names to exempt from typosquat / new-dependency flags.
+- `allowPackages` - package names and full Go module paths to exempt from typosquat /
+  new-dependency flags.
 - `npmRegistryHosts` - registry hosts treated as "expected" for lockfile source checks.
 
 ---
@@ -286,7 +301,7 @@ Set `GIT_PROXY_SUPPLY_CHAIN_CONFIG` to a JSON file:
   the scanned content can differ from what is delivered.
 - On an allowed clone the proxy fetches the repo once to scan it and the client fetches again
   (a double fetch); a future optimisation serves the pack from the scanned copy.
-- Coverage is **npm + Python**; Go/Cargo/RubyGems are planned.
+- Coverage is **npm + Python + Go**; Cargo/RubyGems are planned.
 
 ---
 

plugins/git-proxy-plugin-supply-chain/README.md

@@ -44,7 +44,27 @@ On any push that changes `requirements*.txt`, `pyproject.toml`, `setup.py`, `set
 - **Lockfile sources** - git or plain-http package sources newly introduced in `poetry.lock` /
   `Pipfile.lock`.
 
-> Coverage is npm + Python today. Go, Cargo, RubyGems and others are planned - each is a new
+## What it checks (Go)
+
+On any push that changes `go.mod` or `go.sum`:
+
+- **Replace directives** - local filesystem paths (HIGH) and remote redirects to a different
+  module path (HIGH).
+- **Suspicious hosts** - raw IPv4 module hosts (CRITICAL), plus `localhost` or `http://` module
+  paths (HIGH).
+- **Version signals** - pseudo-versions (LOW) and `+incompatible` versions (INFO) on newly-added
+  require entries.
+- **Toolchain directives** - added or changed `toolchain` values (MEDIUM on changed files, INFO
+  on fresh-file scans).
+- **Exclude entries** - newly-added `exclude` directives (INFO).
+- **Typosquats** - newly-added module paths compared with the offline list in
+  `lib/data/go-popular.js` (HIGH).
+- **go.sum suspicious hosts** - newly-added lockfile lines whose module host is raw IPv4,
+  `localhost`, or contains `http://`.
+
+`vendor/modules.txt` is not scanned.
+
+> Coverage is npm + Python + Go today; Cargo, RubyGems and others are planned - each is a new
 > module under `lib/ecosystems/` plus an entry in `lib/manifests.js`; the plugin wiring is shared.
 
 ## How it runs
@@ -59,8 +79,8 @@ manifest with `git show <newCommit>:<path>` and diffs it against `git show <oldC
 The plugin also scans repositories **as they are cloned/fetched through the proxy**, so a developer
 is warned - or the clone is blocked - before pulling a poisoned repository. On a
 `git clone`/`fetch`, the plugin (running once the repo is confirmed authorised) shallow-clones the
-default branch, enumerates its manifests (`git ls-tree`) and scans them with the same npm/Python
-analyzers, treating the whole tree as newly introduced.
+default branch, enumerates its manifests (`git ls-tree`) and scans them with the same
+npm/Python/Go analyzers, treating the whole tree as newly introduced.
 
 - **Warn (default):** findings are logged server-side and the clone proceeds.
 - **Block (`pull.failOn` set):** a clone whose highest finding meets/exceeds the threshold **fails**,
@@ -99,7 +119,7 @@ Set the `GIT_PROXY_SUPPLY_CHAIN_CONFIG` environment variable to a JSON file to o
 {
   "enabled": true,
   "failOn": "off",
-  "ecosystems": { "npm": true, "python": true },
+  "ecosystems": { "npm": true, "python": true, "go": true },
   "typosquat": true,
   "allowPackages": [],
   "npmRegistryHosts": ["registry.npmjs.org"],
@@ -110,7 +130,8 @@ Set the `GIT_PROXY_SUPPLY_CHAIN_CONFIG` environment variable to a JSON file to o
 - `failOn` - `"off"` (default, annotate only) | `"low"` | `"medium"` | `"high"` | `"critical"`.
   When set, a push whose highest finding severity meets/exceeds the threshold is **blocked**
   (returned as an error to the pusher's terminal).
-- `allowPackages` - package names to exempt from typosquat/new-dependency flags.
+- `allowPackages` - package names and Go module paths to exempt from typosquat/new-dependency
+  flags. For Go, use full module paths such as `github.com/stretchr/testify`.
 - `npmRegistryHosts` - registry hosts treated as "expected" for lockfile source checks.
 - `pull.enabled` - turn pull/clone scanning on or off.
 - `pull.failOn` - block threshold for clones (same scale as `failOn`; default `"off"` = warn-only).

plugins/git-proxy-plugin-supply-chain/lib/analyze.js

@@ -16,12 +16,14 @@
 
 import { analyzeNpm } from './ecosystems/npm.js';
 import { analyzePython } from './ecosystems/python.js';
+import { analyzeGo } from './ecosystems/go.js';
 import { maxSeverity } from './severity.js';
 
 // Registry of per-ecosystem analyzers. Add go/cargo/... here as they are implemented.
 const ANALYZERS = {
   npm: analyzeNpm,
   python: analyzePython,
+  go: analyzeGo,
 };
 
 /**

plugins/git-proxy-plugin-supply-chain/lib/config.js

@@ -25,7 +25,7 @@ export const DEFAULT_CONFIG = {
   // 'off' | 'low' | 'medium' | 'high' | 'critical' - block the push when the highest finding
   // severity meets/exceeds this threshold. 'off' never blocks (annotate-only).
   failOn: 'off',
-  ecosystems: { npm: true, python: true },
+  ecosystems: { npm: true, python: true, go: true },
   typosquat: true,
   allowPackages: [],
   npmRegistryHosts: ['registry.npmjs.org'],

plugins/git-proxy-plugin-supply-chain/lib/data/go-popular.js

@@ -0,0 +1,114 @@
+/**
+ * Copyright 2026 GitProxy Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Popular Go modules for typosquat detection.
+ * @type {string[]}
+ */
+export const GO_POPULAR = [
+  'golang.org/x/net',
+  'golang.org/x/sys',
+  'golang.org/x/text',
+  'golang.org/x/crypto',
+  'golang.org/x/tools',
+  'golang.org/x/mod',
+  'golang.org/x/sync',
+  'golang.org/x/time',
+  'golang.org/x/term',
+  'golang.org/x/oauth2',
+  'golang.org/x/exp',
+  'google.golang.org/grpc',
+  'google.golang.org/protobuf',
+  'google.golang.org/api',
+  'google.golang.org/genproto',
+  'cloud.google.com/go',
+  'github.com/stretchr/testify',
+  'github.com/stretchr/objx',
+  'github.com/davecgh/go-spew',
+  'github.com/pmezard/go-difflib',
+  'github.com/sirupsen/logrus',
+  'github.com/rs/zerolog',
+  'go.uber.org/zap',
+  'go.uber.org/multierr',
+  'go.uber.org/atomic',
+  'github.com/pkg/errors',
+  'github.com/spf13/cobra',
+  'github.com/spf13/viper',
+  'github.com/spf13/pflag',
+  'github.com/spf13/cast',
+  'github.com/spf13/afero',
+  'github.com/gin-gonic/gin',
+  'github.com/gorilla/mux',
+  'github.com/gorilla/websocket',
+  'github.com/go-chi/chi',
+  'github.com/labstack/echo',
+  'github.com/gofiber/fiber',
+  'github.com/valyala/fasthttp',
+  'github.com/julienschmidt/httprouter',
+  'github.com/urfave/cli',
+  'github.com/mitchellh/mapstructure',
+  'github.com/google/uuid',
+  'github.com/google/go-cmp',
+  'github.com/google/go-github',
+  'github.com/gofrs/uuid',
+  'github.com/golang/protobuf',
+  'github.com/golang/mock',
+  'github.com/gogo/protobuf',
+  'github.com/golang-jwt/jwt',
+  'github.com/dgrijalva/jwt-go',
+  'github.com/go-sql-driver/mysql',
+  'github.com/lib/pq',
+  'github.com/jackc/pgx',
+  'github.com/jmoiron/sqlx',
+  'github.com/mattn/go-sqlite3',
+  'gorm.io/gorm',
+  'github.com/redis/go-redis',
+  'github.com/go-redis/redis',
+  'go.mongodb.org/mongo-driver',
+  'github.com/aws/aws-sdk-go',
+  'github.com/aws/aws-sdk-go-v2',
+  'github.com/azure/azure-sdk-for-go',
+  'k8s.io/client-go',
+  'k8s.io/api',
+  'k8s.io/apimachinery',
+  'sigs.k8s.io/yaml',
+  'gopkg.in/yaml',
+  'gopkg.in/check',
+  'github.com/prometheus/client_golang',
+  'go.opentelemetry.io/otel',
+  'github.com/grpc-ecosystem/grpc-gateway',
+  'github.com/hashicorp/vault',
+  'github.com/hashicorp/consul',
+  'github.com/hashicorp/go-multierror',
+  'github.com/hashicorp/hcl',
+  'github.com/hashicorp/go-retryablehttp',
+  'github.com/fsnotify/fsnotify',
+  'github.com/joho/godotenv',
+  'github.com/kelseyhightower/envconfig',
+  'github.com/fatih/color',
+  'github.com/cenkalti/backoff',
+  'github.com/patrickmn/go-cache',
+  'github.com/robfig/cron',
+  'github.com/shopspring/decimal',
+  'github.com/pelletier/go-toml',
+  'github.com/burntsushi/toml',
+  'github.com/klauspost/compress',
+  'github.com/miekg/dns',
+  'github.com/nats-io/nats.go',
+  'github.com/segmentio/kafka-go',
+  'github.com/go-playground/validator',
+  'github.com/docker/docker',
+];