retail-demo-store
retail-demo-store copied to clipboard
Move to using Go Modules
I took a look at the Go code and the binaries are built by just doing a go get during build time. This can cause issues down the line as builds are not repeatable and versions are unknown.
Take a look at using Go modules instead
https://blog.golang.org/using-go-modules
It will pin the versions and allow the builds to be repeatable, it will also let you control when you want to bump versions of libraries being used and if a vulnerability is found in a library being used you can know if you have a bad version as well.
You'll just need to commit the go.mod and go.sum files into the repo.