AlexStocks opened a new pull request, #3589: URL: https://github.com/apache/dubbo-go/pull/3589
## What changed SonarCloud reports `text:S8566` for the generated-project fixtures because these Go modules have `go.mod` files without colocated dependency locks: - `tools/dubbogo-cli/cmd/testGenCode/template/newApp/go.mod` - `tools/dubbogo-cli/cmd/testGenCode/template/newDemo/go.mod` This PR restores a real `go.sum` for both generated project types while preserving the dynamic protobuf generation introduced by #3587. ## Implementation - keep one shared checksum payload in `generator/internal/scaffold` - emit `go.sum` from both `application.Generate` and `sample.Generate` - add matching golden `go.sum` fixtures for newApp and newDemo - add a regression test that checks both generated projects have non-empty locks containing the direct Dubbo-Go and protobuf checksums - document the evidence, release boundary, and verification plan The two golden locks and the generator payload are byte-identical (140,727 bytes, 1,434 lines). ## Verification TDD red state: ```text go test ./cmd -run '^TestGeneratedProjectsIncludeDependencyLocks$' -count=1 -v # failed for newApp and newDemo because go.sum did not exist ``` Green verification: ```text go test ./cmd -run '^TestGeneratedProjectsIncludeDependencyLocks$|^TestNewApp$|^TestNewDemo$' -count=1 -v go test ./... -count=1 go vet ./... ``` The full test and vet commands passed on Windows (Go 1.26.2) and WSL/Linux (Go 1.25.1). The Linux generated-project E2E also passed: ```text make test-generated-projects ``` That target generated fresh newApp/newDemo projects and completed their existing `proto-gen -> tidy -> go test` flow. `git diff --check origin/develop..HEAD` also passed. ## Sonar evidence Failing main check: https://github.com/apache/dubbo-go/runs/91347559036 The remote Quality Gate is intentionally listed as not yet verified here; this PR should trigger the authoritative SonarCloud re-analysis. ## Release boundary No v3.3.2 retag or re-release is needed. The root module v3.3.2 archive does not include the nested `tools/dubbogo-cli` module; this fix targets the branch quality gate and future CLI source releases. ## AI assistance AI assistance: code / tests / docs Human verification: reviewed the complete diff and ran the commands listed above on Windows and WSL/Linux. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
