pantsbuild / pants / 28345096986

93%

push

github

Pin GOTOOLCHAIN=local in Go sandboxes for hermeticity (#23420)

Disclaimer: Like my previous Go PR, I'm still not primarily a golang
developer. However, the fact that Golang doesn't work properly in Pants
has been the bane of my existence for like 2 years now. The moment that
Mythos/Fable dropped I immediately had it dig deeply into whether the
whole road to proper-golang-in-pants could be opened up. So this is all
by Claude Code with Fable 5 (xhigh), with consults to GPT 5.5 (xhigh)
and Gemini 3.1 Pro. I've had it check and recheck, I ran many different
roles over it, and I had it explain and re-explain it to me, and then I
checked myself.

So, as much as I dislike AI slop and am worried about AI PR overload,
I've done my very best to avoid exactly that while still using AI. I
hope we can get this road unblocked.

The rest is Fable talking:

---

Since Go 1.21, the `go` command defaults to `GOTOOLCHAIN=auto`: when a
`go.mod` or `go.work` file demands a toolchain newer than the installed
SDK, `go` silently downloads that toolchain and re-execs it. Pants never
fingerprints the downloaded toolchain, so the same cached process result
can be produced by different toolchains on different machines. That is a
hermeticity hole in the Go backend.

This PR pins `GOTOOLCHAIN=local` in every Go subprocess sandbox. Builds
that demand a newer toolchain now fail fast with a deterministic,
actionable message:

```
go: go.mod requires go >= X.Y.Z (running go A.B.C; GOTOOLCHAIN=local)
```

Repos whose `go` directive is at or below the installed SDK version are
unaffected.

Changes:

- `sdk.py` (`setup_go_sdk_process`): add `"GOTOOLCHAIN": "local"` to the
process env. The entry is placed after `**env_vars` / `**request.env` so
a value passed via `[golang].subprocess_env_vars` cannot re-enable
toolchain switching.
- `golangci_lint/rules.py`: the lint runner script bypasses
`__run_go.sh` and invokes `go` directly, so it exports
`GOTOOLCHAIN=local` itself.
- Docs: new "Too... (continued)

23 of 23 new or added lines in 2 files covered. (100.0%)

93284 of 100518 relevant lines covered (92.8%)

3.69 hits per line