Skip to content

Commit 1b1925e

Browse files
AMaini503Aayush Maini
andauthored
Clarify key change, fix typos (#1430)
Co-authored-by: Aayush Maini <aamaini@microsoft.com>
1 parent a40ed24 commit 1b1925e

File tree

1 file changed

+18
-16
lines changed

1 file changed

+18
-16
lines changed

docs/detectors/go.md

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@ Go detection runs when one of the following files is found in the project:
66

77
- `go.mod` or `go.sum`
88

9-
## Default Detection strategy
9+
## Detection strategy
1010

11-
### go.mod
11+
### go.mod parsing
1212
- All go.mod are parsed to detect dependencies. This parsing doesn't depend on presence of `go cli`.
1313

14-
### go cli (go list) or go.sum Parsing
15-
- If a `go.sum` file is found, detector first checks if go version in the adjacent `go.mod` >= `1.17`. If it is `>= 1.17`, the file is skipped. If it is `< 1.17`, the detector proceeds as follows. Read [Go Module Changes in Go 1.17](#go-module-changes-in-go-117) to understand why `1.17` is relevant.
14+
### go cli (go list) or go.sum parsing
15+
- If a `go.sum` file is found, detector first checks if go version in the adjacent `go.mod` `1.17`. If it is `1.17`, the file is skipped. If it is `< 1.17`, the detector proceeds as follows. Read [Go Module Changes in Go 1.17](#go-module-changes-in-go-117) to understand why `1.17` is relevant.
1616
- If `go cli` is found and not [disabled](#environment-variables), `go list` command is preferred over parsing `go.sum` file since `go.sum` files contains history of dependencies and including these dependencies can lead to [over-reporting](#known-limitations).
1717
- If `go list` was not used or did not run successfully, detector falls back to parsing `go.sum` manually.
1818

@@ -22,22 +22,24 @@ on the build agent. To generate the graph, the command
2222
[go mod graph][2] is executed. This only adds edges between the components
2323
that were already registered.
2424

25-
## Fallback Detection strategy
25+
## Default Detection Strategy
2626

27-
The fallback strategy refers to detector parsing `go.sum` manually.
28-
TThis strategy is known to overreport (see the
29-
[known limitations](#known-limitations)). Read through the
30-
[troubleshooting section](#troubleshooting-failures-to-run-the-default-go-detection-strategy)
31-
for tips on how to ensure that the newer, more accurate default
32-
detection strategy runs successfully.
27+
The Go detector’s default behavior is optimized to reduce over-reporting by leveraging improvements introduced in Go 1.17.
3328

34-
To force the fallback detection strategy, set the environment
35-
variable: `DisableGoCliScan=true`
29+
- When a go.mod file declares a Go version ≥ 1.17, the detector analyzes only the go.mod file to determine dependencies.
30+
- If the go.mod file specifies a Go version < 1.17, the detector uses a fallback strategy to ensure coverage.
31+
Read more about this in the [Fallback Detection Strategy](#fallback-detection-strategy)
32+
33+
## Fallback Detection Strategy
34+
35+
The fallback detection strategy is used when the default strategy (based on `go.mod` files with `Go 1.17` or later) cannot be applied.
36+
In this mode, the detector uses `Go CLI` or manually parses `go.sum` to resolve dependencies. This strategy is known to overreport (see the [known limitations](#known-limitations)). Read through the [troubleshooting-section](#troubleshooting-failures-to-run-the-default-go-detection-strategy) for tips on how to ensure that the newer, more accurate default detection strategy runs successfully.
37+
38+
To force the fallback detection strategy, set the environment variable: `DisableGoCliScan=true`
3639

3740
### `go.mod` before go 1.17
3841

39-
Go detection is performed by parsing any `go.mod` or `go.sum` found
40-
under the scan directory.
42+
Go detection is performed by parsing any `go.mod` files, and either invoking the `Go CLI` or manually parsing `go.sum` files found under the scan directory.
4143

4244
Only root dependency information is generated in the fallback detection
4345
strategy. The full graph is not detected.
@@ -263,7 +265,7 @@ file now includes information about both direct and transitive
263265
dependencies. This improvement enhances the clarity and completeness
264266
of dependency information within the `go.mod` file.
265267
266-
The completeness of `go.mod` file in `>= 1.17` allows the detector to skip `go.sum` files entirely.
268+
The completeness of `go.mod` file in `1.17` allows the detector to skip `go.sum` files entirely.
267269
268270
#### Relevance of the Go Version Check
269271

0 commit comments

Comments
 (0)