fix: filter toolchain entries in GoModulesProvider

src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java

@@ -394,10 +394,10 @@ private static List<String> collectAllDirectDependencies(List<String> targetLine
         .collect(Collectors.toList());
   }
 
-  private static boolean isGoToolchainEntry(String dependency) {
-    // Filter out Go toolchain entries like "go@1.18", "go@1.19", etc.
-    // These are not actual dependencies but the Go toolchain itself
-    return dependency.startsWith("go@");
+  static boolean isGoToolchainEntry(String dependency) {
+    // Filter out Go toolchain entries like "go@1.18" and "toolchain@go1.21.0".
+    // These are not actual dependencies but the Go toolchain itself.
+    return dependency.startsWith("go@") || dependency.startsWith("toolchain@");
   }
 
   private String buildGoModulesDependencies(Path manifestPath) {

src/test/java/io/github/guacsec/trustifyda/providers/Golang_Modules_Provider_Test.java

@@ -198,6 +198,19 @@ void Test_Golang_MvS_Logic_Disabled() throws IOException {
             == 1);
   }
 
+  @Test
+  void test_isGoToolchainEntry_filters_go_and_toolchain() {
+    // go@* entries should be filtered
+    assertThat(GoModulesProvider.isGoToolchainEntry("go@1.18")).isTrue();
+    assertThat(GoModulesProvider.isGoToolchainEntry("go@1.21.0")).isTrue();
+    // toolchain@* entries should be filtered
+    assertThat(GoModulesProvider.isGoToolchainEntry("toolchain@go1.21.0")).isTrue();
+    assertThat(GoModulesProvider.isGoToolchainEntry("toolchain@go1.22.2")).isTrue();
+    // normal module entries should NOT be filtered
+    assertThat(GoModulesProvider.isGoToolchainEntry("github.com/spf13/cobra@v0.0.5")).isFalse();
+    assertThat(GoModulesProvider.isGoToolchainEntry("golang.org/x/tools@v0.1.0")).isFalse();
+  }
+
   private String dropIgnoredKeepFormat(String s) {
     return s.replaceAll("goarch=\\w+&goos=\\w+&", "")
         .replaceAll("\"timestamp\" : \"[a-zA-Z0-9\\-\\:]+\",\n    ", "");