From 9bc3068d149ea091bc37b65f1380f7c59be81da1 Mon Sep 17 00:00:00 2001
From: naiba <hi@nai.ba>
Date: Mon, 20 Jul 2026 17:03:55 +0000
Subject: [PATCH] fix(agentcompat): resolve trusted Go executable

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
---
 .../agentcompat/internal/workspace/build.go   | 29 ++++++++++++++++++-
 .../internal/workspace/workspace_test.go      | 17 +++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/integration/agentcompat/internal/workspace/build.go b/integration/agentcompat/internal/workspace/build.go
index fe0b05d7..b63bc8d1 100644
--- a/integration/agentcompat/internal/workspace/build.go
+++ b/integration/agentcompat/internal/workspace/build.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 )
 
@@ -42,7 +43,11 @@ func (workspace *Workspace) Build(ctx context.Context, spec BuildSpec) (string,
 		arguments = append(arguments, "-ldflags", strings.Join(spec.Ldflags, " "))
 	}
 	arguments = append(arguments, spec.Package)
-	command := exec.CommandContext(ctx, "go", arguments...)
+	goExecutable, err := resolveGoExecutable()
+	if err != nil {
+		return "", err
+	}
+	command := exec.CommandContext(ctx, goExecutable, arguments...) // #nosec G204 -- Resolved absolute regular Go toolchain executable and fixed argv; no shell is invoked.
 	command.Dir = spec.SourceDir
 	command.Env = spec.Env
 	if spec.Env == nil {
@@ -54,3 +59,25 @@ func (workspace *Workspace) Build(ctx context.Context, spec BuildSpec) (string,
 	}
 	return binaryPath, nil
 }
+
+func resolveGoExecutable() (string, error) {
+	candidates := []string{filepath.Join(runtime.GOROOT(), "bin", "go")}
+	if path, err := exec.LookPath("go"); err == nil {
+		candidates = append(candidates, path)
+	}
+	for _, candidate := range candidates {
+		absolute, err := filepath.Abs(candidate)
+		if err != nil {
+			continue
+		}
+		resolved, err := filepath.EvalSymlinks(absolute)
+		if err != nil {
+			continue
+		}
+		info, err := os.Stat(resolved)
+		if err == nil && info.Mode().IsRegular() && info.Mode()&0o111 != 0 {
+			return resolved, nil
+		}
+	}
+	return "", errors.New("Go toolchain executable is unavailable")
+}
diff --git a/integration/agentcompat/internal/workspace/workspace_test.go b/integration/agentcompat/internal/workspace/workspace_test.go
index d08edbc7..86179e5b 100644
--- a/integration/agentcompat/internal/workspace/workspace_test.go
+++ b/integration/agentcompat/internal/workspace/workspace_test.go
@@ -122,6 +122,23 @@ func TestWorkspace_BuildsBinaryInRunDirectory(t *testing.T) {
 	}
 }
 
+func TestWorkspace_ResolvesAbsoluteRegularGoExecutable(t *testing.T) {
+	// When
+	path, err := resolveGoExecutable()
+
+	// Then
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !filepath.IsAbs(path) {
+		t.Fatalf("Go executable path is not absolute: %s", path)
+	}
+	info, err := os.Stat(path)
+	if err != nil || !info.Mode().IsRegular() || info.Mode()&0o111 == 0 {
+		t.Fatalf("Go executable is not an executable regular file: info=%v err=%v", info, err)
+	}
+}
+
 func TestWorkspace_PreservesEvidenceWhenTrackedPIDRemains(t *testing.T) {
 	// Given
 	workspace, err := New(context.Background())