feat: add golang.org security contact fallback for go packages

Signed-off-by: Mouad BANI <mouad-mb@outlook.com>

Author: mbani01

services/apps/packages_worker/src/security-contacts/extractors/registry/go.ts

@@ -0,0 +1,28 @@
+import { ExtractorResult, ProvenanceEntry, RawContact } from '../../types'
+
+const SOURCE = 'go.dev/security-policy'
+const POLICY_URL = 'https://go.dev/doc/security/policy#reporting-a-security-bug'
+
+export async function fetchGo(): Promise<ExtractorResult> {
+  const fetchedAt = new Date().toISOString()
+  const prov = (): ProvenanceEntry[] => [
+    { source: SOURCE, sourceTier: 'D', path: POLICY_URL, fetchedAt },
+  ]
+  const contacts: RawContact[] = [
+    {
+      channel: 'email',
+      value: 'security@golang.org',
+      role: 'security-team',
+      tier: 'D',
+      provenance: prov(),
+    },
+    {
+      channel: 'web-form',
+      value: 'https://g.co/vulnz',
+      role: 'security-team',
+      tier: 'D',
+      provenance: prov(),
+    },
+  ]
+  return { contacts, policies: {} }
+}

services/apps/packages_worker/src/security-contacts/extractors/registry/index.ts

@@ -2,6 +2,7 @@ import { Extractor, ExtractorResult, RawContact, RepoPolicies } from '../../type
 
 import { fetchCargo } from './cargo'
 import { fetchComposer } from './composer'
+import { fetchGo } from './go'
 import { fetchMaven } from './maven'
 import { fetchNpm } from './npm'
 import { fetchNuget } from './nuget'
@@ -16,7 +17,7 @@ type EcosystemFetcher = (
   repoUrl?: string,
 ) => Promise<ExtractorResult>
 
-// Keyed by the lowercased packages.ecosystem value. go has no package-manifest contacts.
+// Keyed by the lowercased packages.ecosystem value.
 const FETCHERS: Record<string, EcosystemFetcher> = {
   npm: fetchNpm,
   pypi: fetchPypi,
@@ -25,6 +26,7 @@ const FETCHERS: Record<string, EcosystemFetcher> = {
   nuget: fetchNuget,
   rubygems: fetchRubygems,
   composer: fetchComposer,
+  go: fetchGo,
 }
 
 export const extractManifest: Extractor = async (target, deps) => {