Add go cli native scanning for component governance (Azure#17655)

Author: benbp

azure-pipelines.yml

@@ -29,12 +29,19 @@ jobs:
       name: $(pool.name)
 
     variables:
-      GOPATH: '$(system.defaultWorkingDirectory)/work'
-      sdkPath: '$(GOPATH)/src/github.com/$(build.repository.name)'
-      GO111MODULE: 'off'
-      IGNORE_BREAKING_CHANGES: true
-      go.list.filter: 'profiles services storage'
-      go.test.filter: '-path ./vendor -prune -o -path ./sdk -prune -o -path ./eng -prune -o'
+      - template: ../variables/globals.yml
+      - name: GOPATH
+        value: '$(system.defaultWorkingDirectory)/work'
+      - name: sdkPath
+        value: '$(GOPATH)/src/github.com/$(build.repository.name)'
+      - name: GO111MODULE
+        value: 'off'
+      - name: IGNORE_BREAKING_CHANGES
+        value: 'true'
+      - name: go.list.filter
+        value: 'profiles services storage'
+      - name: go.test.filter
+        value: '-path ./vendor -prune -o -path ./sdk -prune -o -path ./eng -prune -o'
 
     steps:
     - task: GoTool@0

eng/pipelines/templates/variables/globals.yml

@@ -1,3 +1,7 @@
 variables:
   GoLintCLIVersion: 'v1.45.2'
   Package.EnableSBOMSigning: true
+  # Enable go native component governance detection
+  # https://docs.opensource.microsoft.com/tools/cg/index.html
+  # https://github.com/microsoft/component-detection/blob/main/src/Microsoft.ComponentDetection.Detectors/go/GoComponentDetector.cs
+  EnableGoCliScan: true