fix(agentcompat): resolve trusted Go executable

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

integration/agentcompat/internal/workspace/build.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 )
 
@@ -42,7 +43,11 @@ func (workspace *Workspace) Build(ctx context.Context, spec BuildSpec) (string,
 		arguments = append(arguments, "-ldflags", strings.Join(spec.Ldflags, " "))
 	}
 	arguments = append(arguments, spec.Package)
-	command := exec.CommandContext(ctx, "go", arguments...)
+	goExecutable, err := resolveGoExecutable()
+	if err != nil {
+		return "", err
+	}
+	command := exec.CommandContext(ctx, goExecutable, arguments...) // #nosec G204 -- Resolved absolute regular Go toolchain executable and fixed argv; no shell is invoked.
 	command.Dir = spec.SourceDir
 	command.Env = spec.Env
 	if spec.Env == nil {
@@ -54,3 +59,25 @@ func (workspace *Workspace) Build(ctx context.Context, spec BuildSpec) (string,
 	}
 	return binaryPath, nil
 }
+
+func resolveGoExecutable() (string, error) {
+	candidates := []string{filepath.Join(runtime.GOROOT(), "bin", "go")}
+	if path, err := exec.LookPath("go"); err == nil {
+		candidates = append(candidates, path)
+	}
+	for _, candidate := range candidates {
+		absolute, err := filepath.Abs(candidate)
+		if err != nil {
+			continue
+		}
+		resolved, err := filepath.EvalSymlinks(absolute)
+		if err != nil {
+			continue
+		}
+		info, err := os.Stat(resolved)
+		if err == nil && info.Mode().IsRegular() && info.Mode()&0o111 != 0 {
+			return resolved, nil
+		}
+	}
+	return "", errors.New("Go toolchain executable is unavailable")
+}

integration/agentcompat/internal/workspace/workspace_test.go

@@ -122,6 +122,23 @@ func TestWorkspace_BuildsBinaryInRunDirectory(t *testing.T) {
 	}
 }
 
+func TestWorkspace_ResolvesAbsoluteRegularGoExecutable(t *testing.T) {
+	// When
+	path, err := resolveGoExecutable()
+
+	// Then
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !filepath.IsAbs(path) {
+		t.Fatalf("Go executable path is not absolute: %s", path)
+	}
+	info, err := os.Stat(path)
+	if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 {
+		t.Fatalf("Go executable is not an executable regular file: info=%v err=%v", info, err)
+	}
+}
+
 func TestWorkspace_PreservesEvidenceWhenTrackedPIDRemains(t *testing.T) {
 	// Given
 	workspace, err := New(context.Background())