[K9CODESEC-3103] Add static Go reachability analysis - #197

Open

jbcibois-ddhq wants to merge 16 commits into

mainfrom

jb.cibois/K9CODESEC-3103

Commits on Jul 15, 2026

chore: add tree-sitter-go dependency for Go reachability analysis
jbcibois-ddhq
committed
feat: add Detector interface and ReachabilityGo skeleton
jbcibois-ddhq
committed
feat: resolve Go import aliases for reachability matching
jbcibois-ddhq
committed
feat: match Go call sites against vulnerable function symbols
jbcibois-ddhq
committed
refactor: generalize reachability detector pool to support multiple languages
jbcibois-ddhq
committed
fix: derive reachability language key from PURL type instead of hardcoding java
jbcibois-ddhq
committed
test: add end-to-end Go reachability coverage
jbcibois-ddhq
committed
Extract shared tree-sitter helpers from Java and Go reachability detectors
jbcibois-ddhq
committed
fix: handle gopkg.in-style dotted major-version suffixes in unaliased import identifiers
jbcibois-ddhq
committed
fix: skip scheduling detector goroutine when a language has no advisories to check
jbcibois-ddhq
committed
Skip blank and dot imports instead of defaulting their alias
jbcibois-ddhq
committed
Strip go- prefix when deriving default import identifier
jbcibois-ddhq
committed
Strip trailing -go suffix when deriving default import identifier
jbcibois-ddhq
committed
Share language-key constants across reachability dispatch maps
jbcibois-ddhq
committed
Add end-to-end Detect() coverage for blank/dot imports and go-/-go heuristic
jbcibois-ddhq
committed
Don't strip v0/v1 as a Go module major-version suffix
jbcibois-ddhq
committed