.nh
.TH "glab" "1" "Nov 2026" "Auto generated by spf13/cobra" ""

.SH NAME
glab-dependency-firewall-go - Run go through the GitLab Dependency Firewall. (BETA)


.SH SYNOPSIS
\fBglab dependency-firewall go  [flags]\fP


.SH DESCRIPTION
Run the go binary through the GitLab Dependency Firewall. The command checks each module download against the policy for the current project, refuses blocked modules, and summarizes the results after the run.

.PP
Module downloads go through a Go module proxy that the command starts on \fB127.0.0.1\fR for the run. No certificate is involved, so your system trust store is not changed.

.PP
For the run, \fBGOPROXY\fR points at that proxy, \fBGONOPROXY\fR is \fBnone\fR, and \fBGO111MODULE\fR is \fBon\fR, so every module download is checked. Private modules matched by \fBGOPRIVATE\fR are also checked, then fetched the way your configuration fetches them.

.PP
If you set \fBGOPROXY=off\fR, the command keeps it.

.PP
Allowed modules are downloaded through your configured \fBGOPROXY\fR, from the environment or the \fBgo env\fR file, in list order and with its fallbacks. Credentials for that proxy come from your \fB\&.netrc\fR file, \fBGOAUTH\fR, or the URL itself. A \fBGOSUMDB\fR with its own URL is reached through the proxy the command starts; credentials for that URL must be in the URL itself, because \fB\&.netrc\fR and \fBGOAUTH\fR apply only to \fBGOPROXY\fR\&.

.PP
The command checks only modules that \fBgo\fR downloads during the run:
.IP \(bu 2
Modules already in your module cache are not checked. In CI, point \fBGOMODCACHE\fR at an empty directory to check every module.
.IP \(bu 2
Vendored code and \fBreplace\fR directives that point at a local path are not checked.
.IP \(bu 2
Go toolchain downloads are not checked by policy. \fBgo\fR verifies them against the checksum database.

.PP
Module paths and versions, including private ones, are sent to the policy API and written to \fB\&.gitlab/df/ci-log.json\fR\&. CI jobs that upload that file publish them with the job's artifacts.

.PP
Tests that make HTTPS requests can fail certificate checks under this command. Run \fBgo test\fR outside the firewall if your tests reach the network.

.PP
All arguments are forwarded to \fBgo\fR verbatim.

.PP
This feature is in beta and might not be ready for production use.
It might be unstable and breaking changes can occur outside of major releases.
For more information, see
https://docs.gitlab.com/policy/development_stages_support/.


.SH OPTIONS INHERITED FROM PARENT COMMANDS
\fB-h\fP, \fB--help\fP[=false]
	Show help for this command.


.SH EXAMPLE
.EX
# Download modules through the Dependency Firewall
glab dependency-firewall go mod download

# Add a dependency, checking it against the policy first
glab dependency-firewall go get github.com/pkg/errors@v0.9.1

.EE


.SH SEE ALSO
\fBglab-dependency-firewall(1)\fP