Added Go dependency submission step

[soumeh01]

Changes

• This GitHub Action calculates dependencies for a Go build-target (a Go file with a main function) and submits the list to the Dependency submission API. Dependencies then appear in the repository's dependency graph, and contributors shall receive Dependabot alerts and updates for vulnerable or out-of-date dependencies.

Checklist

• 🤖 This change is covered by unit tests (if applicable).
• 🤹 Manual testing has been performed (if necessary).
• 🛡️ Security impacts have been considered (if relevant).
• 📖 Documentation updates are complete (if required).
• 🧠 Third-party dependencies and TPIP updated (if required).

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 10 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match. You may see unexpected additions in the diff.

Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

License Issues

go.mod

Package	Version	License	Issue Type
github.com/creack/pty	v1.1.21	Null	Unknown License
github.com/davecgh/go-spew	v1.1.1	Null	Unknown License
github.com/hashicorp/go-version	v1.9.0	Null	Unknown License
github.com/otiai10/copy	v1.14.1	Null	Unknown License
github.com/pmezard/go-difflib	v1.0.0	Null	Unknown License
github.com/sirupsen/logrus	v1.9.4	Null	Unknown License
github.com/spf13/cobra	v1.10.2	Null	Unknown License
github.com/spf13/pflag	v1.0.10	Null	Unknown License
github.com/stretchr/testify	v1.11.1	Null	Unknown License
gopkg.in/yaml.v3	v3.0.1	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
actions/actions/go-dependency-submission	f35d5c9af13ce9cc32f7930b171e315e878f6921	🟢 6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits
actions/actions/setup-go	4b73464bb391d4059bd26b0524d20df3927bd417	🟢 6.1	Details Check Score Reason Maintained 🟢 10 12 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9
gomod/github.com/aymanbagabas/go-pty	v0.2.2	🟢 3	Details Check Score Reason Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 0 Found 0/3 approved changesets -- score normalized to 0 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Security-Policy ⚠️ 0 security policy file not detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/creack/pty	v1.1.21	Unknown	Unknown
gomod/github.com/davecgh/go-spew	v1.1.1	Unknown	Unknown
gomod/github.com/hashicorp/go-version	v1.9.0	Unknown	Unknown
gomod/github.com/otiai10/copy	v1.14.1	Unknown	Unknown
gomod/github.com/pmezard/go-difflib	v1.0.0	Unknown	Unknown
gomod/github.com/sirupsen/logrus	v1.9.4	Unknown	Unknown
gomod/github.com/spf13/cobra	v1.10.2	Unknown	Unknown
gomod/github.com/spf13/pflag	v1.0.10	Unknown	Unknown
gomod/github.com/stretchr/testify	v1.11.1	Unknown	Unknown
gomod/github.com/u-root/u-root	v0.11.0	🟢 7.4	Details Check Score Reason Security-Policy 🟢 4 security policy file detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 2 badge detected: InProgress License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Binary-Artifacts 🟢 9 binaries present in source code Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
gomod/golang.org/x/crypto	v0.45.0	Unknown	Unknown
gomod/golang.org/x/sync	v0.8.0	Unknown	Unknown
gomod/golang.org/x/sys	v0.42.0	Unknown	Unknown
gomod/golang.org/x/term	v0.41.0	Unknown	Unknown
gomod/gopkg.in/yaml.v3	v3.0.1	Unknown	Unknown

Scanned Files

• .github/workflows/dependency-review.yml
• go.mod