test(go): refactor mod_test.go to use txtar format (#9775)

Author: knqyf263

go.mod

@@ -111,6 +111,7 @@ require (
 	github.com/twitchtv/twirp v8.1.3+incompatible
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/xlab/treeprint v1.2.0
+	github.com/zalando/go-keyring v0.2.6
 	github.com/zclconf/go-cty v1.17.0
 	github.com/zclconf/go-cty-yaml v1.1.0
 	go.etcd.io/bbolt v1.4.3
@@ -120,6 +121,7 @@ require (
 	golang.org/x/sync v0.17.0
 	golang.org/x/term v0.35.0
 	golang.org/x/text v0.28.0
+	golang.org/x/tools v0.35.1-0.20250728180453-01a3475a31bc
 	golang.org/x/vuln v1.1.4
 	golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9
 	google.golang.org/protobuf v1.36.10
@@ -130,8 +132,6 @@ require (
 	modernc.org/sqlite v1.39.0
 )
 
-require github.com/zalando/go-keyring v0.2.6
-
 require (
 	al.essio.dev/pkg/shellescape v1.5.1 // indirect
 	buf.build/gen/go/bufbuild/bufplugin/protocolbuffers/go v1.36.6-20250718181942-e35f9b667443.1 // indirect
@@ -471,7 +471,6 @@ require (
 	golang.org/x/sys v0.36.0 // indirect
 	golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488 // indirect
 	golang.org/x/time v0.13.0 // indirect
-	golang.org/x/tools v0.35.1-0.20250728180453-01a3475a31bc // indirect
 	golang.org/x/tools/gopls v0.20.0 // indirect
 	google.golang.org/api v0.248.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect

internal/testutil/txtar.go

@@ -0,0 +1,19 @@
+package testutil
+
+import (
+	"io/fs"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/tools/txtar"
+)
+
+// TxtarToFS reads a txtar file and returns it as an fs.FS.
+func TxtarToFS(t *testing.T, path string) fs.FS {
+	t.Helper()
+	archive, err := txtar.ParseFile(path)
+	require.NoError(t, err)
+	fsys, err := txtar.FS(archive)
+	require.NoError(t, err)
+	return fsys
+}

pkg/fanal/analyzer/language/golang/mod/mod.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"io/fs"
 	"os"
+	"path"
 	"path/filepath"
 	"regexp"
 	"slices"
@@ -53,6 +54,10 @@ type gomodAnalyzer struct {
 
 	licenseClassifierConfidenceLevel float64
 
+	// gopathFS represents the $GOPATH directory as an fs.FS.
+	// It should contain the "pkg/mod" subdirectory structure.
+	gopathFS fs.FS
+
 	logger *log.Logger
 }
 
@@ -62,6 +67,7 @@ func newGoModAnalyzer(opt analyzer.AnalyzerOptions) (analyzer.PostAnalyzer, erro
 		sumParser:                        sum.NewParser(),
 		leafModParser:                    mod.NewParser(false, false), // Don't detect stdlib for non-root go.mod files
 		licenseClassifierConfidenceLevel: opt.LicenseScannerOption.ClassifierConfidenceLevel,
+		gopathFS:                         os.DirFS(cmp.Or(os.Getenv("GOPATH"), build.Default.GOPATH)),
 		logger:                           log.WithPrefix("golang"),
 	}, nil
 }
@@ -142,7 +148,7 @@ func (a *gomodAnalyzer) fillAdditionalData(ctx context.Context, fsys fs.FS, apps
 	var modSearchDirs []searchDir
 
 	// $GOPATH/pkg/mod
-	if gopath, err := newGOPATH(); err != nil {
+	if gopath, err := newGOPATH(a.gopathFS); err != nil {
 		a.logger.Debug("GOPATH not found. Run 'go mod download' or 'go mod tidy' for identifying dependency graph and licenses", log.Err(err))
 	} else {
 		modSearchDirs = append(modSearchDirs, gopath)
@@ -413,18 +419,26 @@ type searchDir interface {
 }
 
 type gopathDir struct {
-	root string
+	root fs.FS // $GOPATH/pkg/mod as fs.FS (can be os.DirFS or test fixture)
 }
 
-func newGOPATH() (searchDir, error) {
-	gopath := cmp.Or(os.Getenv("GOPATH"), build.Default.GOPATH)
-
+func newGOPATH(gopathFS fs.FS) (searchDir, error) {
 	// $GOPATH/pkg/mod
-	modPath := filepath.Join(gopath, "pkg", "mod")
-	if !fsutils.DirExists(modPath) {
-		return nil, xerrors.Errorf("GOPATH not found: %s", modPath)
+	// Use path.Join instead of filepath.Join because fs.FS always uses forward slashes,
+	// regardless of the operating system.
+	modFS, err := fs.Sub(gopathFS, path.Join("pkg", "mod"))
+	if err != nil {
+		return nil, xerrors.Errorf("failed to access $GOPATH/pkg/mod: %w", err)
+	}
+
+	// Check if the directory exists.
+	// fs.Sub doesn't return an error for non-existent directories,
+	// so we need to explicitly verify the directory exists.
+	if _, err := fs.Stat(modFS, "."); err != nil {
+		return nil, xerrors.Errorf("$GOPATH/pkg/mod does not exist: %w", err)
 	}
-	return &gopathDir{root: modPath}, nil
+
+	return &gopathDir{root: modFS}, nil
 }
 
 // Resolve resolves the module directory for a given package.
@@ -437,9 +451,7 @@ func (d *gopathDir) Resolve(pkg types.Package) (fs.FS, error) {
 	// e.g. github.com/aquasecurity/[email protected]
 	modDirName := fmt.Sprintf("%s@%s", name, pkg.Version)
 
-	// e.g. $GOPATH/pkg/mod/github.com/aquasecurity/[email protected]
-	modDir := filepath.Join(d.root, modDirName)
-	return os.DirFS(modDir), nil
+	return fs.Sub(d.root, modDirName)
 }
 
 type vendorDir struct {
@@ -451,8 +463,16 @@ func newVendorDir(fsys fs.FS, modPath string) (vendorDir, error) {
 	vendor := filepath.Join(filepath.Dir(modPath), "vendor")
 	sub, err := fs.Sub(fsys, vendor)
 	if err != nil {
-		return vendorDir{}, xerrors.Errorf("vendor directory not found: %w", err)
+		return vendorDir{}, xerrors.Errorf("failed to access vendor directory: %w", err)
+	}
+
+	// Check if the directory exists.
+	// fs.Sub doesn't return an error for non-existent directories,
+	// so we need to explicitly verify the directory exists.
+	if _, err := fs.Stat(sub, "."); err != nil {
+		return vendorDir{}, xerrors.Errorf("vendor directory does not exist: %w", err)
 	}
+
 	return vendorDir{root: sub}, nil
 }
 

pkg/fanal/analyzer/language/golang/mod/mod_test.go

@@ -1,30 +1,30 @@
 package mod
 
 import (
-	"path/filepath"
 	"sort"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/aquasecurity/trivy/internal/testutil"
 	"github.com/aquasecurity/trivy/pkg/fanal/analyzer"
 	"github.com/aquasecurity/trivy/pkg/fanal/types"
-	"github.com/aquasecurity/trivy/pkg/mapfs"
 )
 
+const gopathFixture = "testdata/gopath.txtar"
+
 func Test_gomodAnalyzer_Analyze(t *testing.T) {
 	tests := []struct {
-		name  string
-		files []string
-		want  *analyzer.AnalysisResult
+		name   string
+		txtar  string
+		gopath bool
+		want   *analyzer.AnalysisResult
 	}{
 		{
-			name: "happy",
-			files: []string{
-				"testdata/happy/mod",
-				"testdata/happy/sum",
-			},
+			name:   "happy",
+			txtar:  "testdata/happy.txtar",
+			gopath: true,
 			want: &analyzer.AnalysisResult{
 				Applications: []types.Application{
 					{
@@ -74,10 +74,9 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) {
 			},
 		},
 		{
-			name: "wrong go.mod from `pkg`",
-			files: []string{
-				"testdata/wrong-gomod-in-pkg/mod",
-			},
+			name:   "wrong go.mod from `pkg`",
+			txtar:  "testdata/wrong-gomod-in-pkg.txtar",
+			gopath: true,
 			want: &analyzer.AnalysisResult{
 				Applications: []types.Application{
 					{
@@ -116,10 +115,9 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) {
 			},
 		},
 		{
-			name: "no pkg dir found",
-			files: []string{
-				"testdata/no-pkg-found/mod",
-			},
+			name:   "no pkg dir found",
+			txtar:  "testdata/no-pkg-found.txtar",
+			gopath: false,
 			want: &analyzer.AnalysisResult{
 				Applications: []types.Application{
 					{
@@ -179,11 +177,9 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) {
 			},
 		},
 		{
-			name: "less than 1.17",
-			files: []string{
-				"testdata/merge/mod",
-				"testdata/merge/sum",
-			},
+			name:   "less than 1.17",
+			txtar:  "testdata/merge.txtar",
+			gopath: true,
 			want: &analyzer.AnalysisResult{
 				Applications: []types.Application{
 					{
@@ -235,10 +231,9 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) {
 			},
 		},
 		{
-			name: "no go.sum",
-			files: []string{
-				"testdata/merge/mod",
-			},
+			name:   "no go.sum",
+			txtar:  "testdata/no-go-sum.txtar",
+			gopath: true,
 			want: &analyzer.AnalysisResult{
 				Applications: []types.Application{
 					{
@@ -278,18 +273,15 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) {
 			},
 		},
 		{
-			name: "sad go.mod",
-			files: []string{
-				"testdata/sad/mod",
-			},
-			want: &analyzer.AnalysisResult{},
+			name:   "sad go.mod",
+			txtar:  "testdata/sad.txtar",
+			gopath: false,
+			want:   &analyzer.AnalysisResult{},
 		},
 		{
-			name: "deps from GOPATH and license from vendor dir",
-			files: []string{
-				"testdata/vendor-dir-exists/mod",
-				"testdata/vendor-dir-exists/vendor",
-			},
+			name:   "deps from GOPATH and license from vendor dir",
+			txtar:  "testdata/vendor-dir-exists.txtar",
+			gopath: true,
 			want: &analyzer.AnalysisResult{
 				Applications: []types.Application{
 					{
@@ -339,36 +331,34 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) {
 			},
 		},
 	}
+
+	// Load GOPATH fixture once as fs.FS (represents $GOPATH/pkg/mod)
+	gopathFS := testutil.TxtarToFS(t, gopathFixture)
+
 	for _, tt := range tests {
-		t.Setenv("GOPATH", "testdata")
 		t.Run(tt.name, func(t *testing.T) {
+			// Load test case txtar as fs.FS
+			fsys := testutil.TxtarToFS(t, tt.txtar)
+
 			a, err := newGoModAnalyzer(analyzer.AnalyzerOptions{})
 			require.NoError(t, err)
 
-			mfs := mapfs.New()
-			for _, file := range tt.files {
-				// Since broken go.mod files bothers IDE, we should use other file names than "go.mod" and "go.sum".
-				switch filepath.Base(file) {
-				case "mod":
-					require.NoError(t, mfs.WriteFile("go.mod", file))
-				case "sum":
-					require.NoError(t, mfs.WriteFile("go.sum", file))
-				case "vendor":
-					require.NoError(t, mfs.CopyDir(file, "."))
-				}
+			// Set GOPATH fs.FS for testing
+			ma := a.(*gomodAnalyzer)
+			if tt.gopath {
+				ma.gopathFS = gopathFS
 			}
 
 			ctx := t.Context()
-			got, err := a.PostAnalyze(ctx, analyzer.PostAnalysisInput{
-				FS: mfs,
+			got, err := ma.PostAnalyze(ctx, analyzer.PostAnalysisInput{
+				FS: fsys,
 			})
 			require.NoError(t, err)
 
 			if len(got.Applications) > 0 {
 				sort.Sort(got.Applications[0].Packages)
 				sort.Sort(tt.want.Applications[0].Packages)
 			}
-			require.NoError(t, err)
 			assert.Equal(t, tt.want, got)
 		})
 	}