Add go stdlib version support

.github/workflows/osv-scanner-scheduled.yml

@@ -26,5 +26,5 @@ permissions:
   contents: read
 
 jobs:
-  scan-pr-attempt:
+  scan-scheduled:
     uses: "./.github/workflows/osv-scanner-reusable-scheduled.yml"

.golangci.yaml

@@ -30,6 +30,7 @@ linters:
     - testpackage      # will re-add later (another-rex)
     - goerr113         # will re-add later (another-rex)
     - nonamedreturns   # disagree with, for now (another-rex)
+    - depguard         # not necessary at the moment (another-rex)
   presets:
     - bugs
     - comment

pkg/osvscanner/optional_enricher.go

@@ -0,0 +1,41 @@
+package osvscanner
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"github.com/google/osv-scanner/pkg/lockfile"
+	"github.com/google/osv-scanner/pkg/reporter"
+)
+
+// Get the go version of the default environment that osv-scanner is being ran on
+func getGoVersion() (string, error) {
+	versionBytes, err := exec.Command("go", "env", "GOVERSION").Output()
+	if err != nil {
+		return "", err
+	}
+	// version format can be:
+	// - go1.20.6
+	// - go1.22-20230729-RC00 cl/552016856 +457721cd52 X:fieldtrack,boringcrypto
+	version := strings.TrimPrefix(string(versionBytes), "go")
+	version, _, _ = strings.Cut(version, " ")
+
+	return version, nil
+}
+
+func addCompilerVersion(r reporter.Reporter, parsedLockfile *lockfile.Lockfile) {
+	switch parsedLockfile.ParsedAs { //nolint:gocritic
+	case "go.mod":
+		goVer, err := getGoVersion()
+		if err != nil {
+			r.PrintError(fmt.Sprintf("cannot get go standard library version, go might not be installed: %s", err))
+		}
+		parsedLockfile.Packages = append(parsedLockfile.Packages, lockfile.PackageDetails{
+			Name:      "stdlib",
+			Version:   goVer,
+			Ecosystem: lockfile.GoEcosystem,
+			CompareAs: lockfile.GoEcosystem,
+		})
+	}
+}

pkg/osvscanner/osvscanner.go

@@ -209,6 +209,9 @@ func scanLockfile(r reporter.Reporter, query *osv.BatchedQuery, path string, par
 	if err != nil {
 		return err
 	}
+
+	addCompilerVersion(r, &parsedLockfile)
+
 	parsedAsComment := ""
 
 	if parseAs != "" {