Build tags not propagating correctly

[matthewhartstonge]

Howdy! 🤠

Summary

SSA panics are occurring when performing static analysis due to references not being included when build tags are involved.

Description

I've been seeing static analysis panics occurring when references can't be found that should have been included by build tags.

See failing gosec report log here: https://github.com/matthewhartstonge/exp-buildtag/blob/main/gosec-log.txt

Prior Art

I noticed that a couple of issues and PRs in the past have attempted to fix this issue:

• Build Tag Option is not respected #393
• Bug fix 393 - BuildTags are propagated #481
• Fix data race in analyzer #1053

Workaround

You can currently set the GOFLAGS envvar with your expected build tags, gosec will then run as expected.

export GOFLAGS='-tags=tag'

Reproducible

Refer: https://github.com/matthewhartstonge/exp-buildtag

Fix

See: #1413