Add Google Play Integrity Go modules for ThunderID by Malith-19 · Pull Request #29 · wso2/engineering-governance

Malith-19 · 2026-07-14T04:50:16Z

Purpose

Add two Google Go modules to the approved dependency registry so they pass the Validate Go Dependencies gate for ThunderID, and correct the ThunderID scope name in the registry docs.

These modules are pulled in by ThunderID's Google Play Integrity attestation feature (thunder-id/thunderid#3452 / PR thunder-id/thunderid#3951), which verifies a mobile client's attestation token server-side via Google's playintegrity/v1 decodeIntegrityToken API.

Modules added (latest versions)

Module	Floor version	Scopes	Used for
`google.golang.org/api`	`>=v0.288.0`	`identity-platform`, `thunderid`	Play Integrity API client (`playintegrity/v1`, `option`)
`cloud.google.com/go/auth`	`>=v0.22.0`	`identity-platform`, `thunderid`	Service-account credential detection (`credentials.DetectDefault`) for authenticating the Play Integrity call

Both are pinned to the latest releases and scoped to identity-platform and thunderid (per review), rather than the global * scope.

Registry docs fix

Renamed the standard scope thunder → thunderid in dependency-registry/README.md so the documented scope name matches what the ThunderID repo actually declares (DEPENDENCY_SCOPE: thunderid in its dependency-validation workflow).

Notes

golang.org/x/net was updated v0.55.0 -> v0.56.0 by the same ThunderID change and already satisfies the existing >=v0.55.0 constraint, so no registry change is needed for it.
The bump also moved some indirect transitive deps; the validator only checks direct dependencies (// indirect lines are skipped), so no further registry entries are required.
dependency-registry/go.yaml parses; the added blocks are structurally identical to existing approved entries.

coderabbitai · 2026-07-14T04:50:35Z

📝 Walkthrough

Walkthrough

The Go dependency registry adds google.golang.org/api with a minimum version of v0.287.1 and cloud.google.com/go/auth with a minimum version of v0.20.0. Both entries allow all scopes.

Suggested reviewers: pubudu538, yomalip, tharindu1st

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers purpose, but it misses the required technical justification section and the dependency health/security validation checklist.	Add the template sections for technical justification and dependency health/security validation, including the required checkbox confirmations.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately describes the main change: adding Google Play Integrity Go modules for ThunderID.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-14T04:52:19Z

Dependency Registry Analysis Report

Summary

Total Registry Entries Changed: 2
Added: 2 | Updated: 0 | Removed: 0
Security Status: All dependencies are secure with no active vulnerabilities
Licenses Found: BSD-3-Clause (Apache 2.0 compatible), Apache-2.0 (Apache 2.0 compatible)

See detailed analysis for more information

`google.golang.org/api`: `>=v0.287.1` - New

Added Entry:

module: google.golang.org/api
version: ">=v0.287.1"
allowed_scopes: ["*"]

License: BSD-3-Clause (Apache 2.0 compatible)
Version status: ⚠️ Outdated (Minimum: v0.287.1 released Jul 7, 2026; Latest: v0.288.0 released Jul 9, 2026)
Security: No known CVEs
Transitive Dependencies: Self-contained with no direct external dependencies

References

Repository: https://github.com/googleapis/google-api-go-client
Documentation: https://pkg.go.dev/google.golang.org/api
License: https://github.com/googleapis/google-api-go-client/blob/main/LICENSE

`cloud.google.com/go/auth`: `>=v0.20.0` - New

Added Entry:

module: cloud.google.com/go/auth
version: ">=v0.20.0"
allowed_scopes: ["*"]

License: Apache-2.0 (Apache 2.0 compatible)
Version status: ⚠️ Outdated (Minimum: v0.20.0 released Apr 6, 2026; Latest: v0.22.0 released Jul 13, 2026)
Security: No known CVEs
Transitive Dependencies: 1 dependency analyzed, all secure
- github.com/googleapis/gax-go/v2 - No known CVEs

References

Repository: https://github.com/googleapis/google-cloud-go
Documentation: https://pkg.go.dev/cloud.google.com/go/auth
License: https://github.com/googleapis/google-cloud-go/blob/main/LICENSE

Note: Both modules are pre-v1.0 (beta status). The google.golang.org/api module is auto-generated and may contain breaking changes between releases. Consider reviewing release notes before updating to newer versions.

Analysis completed on 2026-07-14
Analyzed PR #29 | Repository: wso2/engineering-governance

omindu · 2026-07-14T04:58:02Z

+    versions:
+      - version: ">=v0.287.1"
+        allowed_scopes:
+          - "*"


@Malith-19 let's scope these to identity-platform

and thunderid

github-actions · 2026-07-14T05:04:04Z

Dependency Registry Analysis Report

Summary

Total Registry Entries Changed: 2
Added: 2 | Updated: 0 | Removed: 0
Security Status: All dependencies are secure with no active vulnerabilities
Licenses Found: BSD-3-Clause (Apache 2.0 compatible), Apache-2.0 (Apache 2.0 compatible)

See detailed analysis for more information

`google.golang.org/api`: `>=v0.287.1` - New

Added Entry:

module: google.golang.org/api
version: ">=v0.287.1"
allowed_scopes: ["identity-platform", "thunderid"]

License: BSD-3-Clause (Apache 2.0 compatible)
Version status: ⚠️ Outdated (Latest: v0.288.0, released July 9, 2026 - 2 days newer)
Security: No known CVEs
Transitive Dependencies: 18 dependencies analyzed, all secure

References

Repository: https://github.com/googleapis/google-api-go-client
Documentation: https://pkg.go.dev/google.golang.org/api
License: https://github.com/googleapis/google-api-go-client/blob/main/LICENSE

`cloud.google.com/go/auth`: `>=v0.20.0` - New

Added Entry:

module: cloud.google.com/go/auth
version: ">=v0.20.0"
allowed_scopes: ["identity-platform", "thunderid"]

License: Apache-2.0 (Apache 2.0 compatible)
Version status: ⚠️ Outdated (Latest: v0.22.0, released July 13, 2026 - approximately 3 months behind)
Security: No known CVEs
Transitive Dependencies: 14 dependencies analyzed, all secure

References

Repository: https://github.com/googleapis/google-cloud-go
Documentation: https://pkg.go.dev/cloud.google.com/go/auth
License: https://github.com/googleapis/google-cloud-go/blob/main/LICENSE

Note: Both packages have outdated minimum versions. Consider updating to v0.288.0+ for google.golang.org/api and v0.22.0+ for cloud.google.com/go/auth to ensure the latest features and security patches are included.

Analysis completed on 2026-07-14
Analyzed PR #29 | Repository: wso2/engineering-governance

github-actions · 2026-07-14T05:05:20Z

Dependency Registry Analysis Report

Summary

Total Registry Entries Changed: 2
Added: 2 | Updated: 0 | Removed: 0
Security Status: All dependencies are secure with no active vulnerabilities
Licenses Found: BSD-3-Clause (Apache 2.0 compatible), Apache-2.0 (Apache 2.0 compatible)

See detailed analysis for more information

`google.golang.org/api`: `>=v0.287.1` - New

Added Entry:

module: google.golang.org/api
version: ">=v0.287.1"
allowed_scopes: ["identity-platform", "thunderid"]

License: BSD-3-Clause (Apache 2.0 compatible)
Version status: Minimum version v0.287.1 is current (Latest stable: v0.288.0, released Jul 9, 2026 - 2 days after minimum)
Security: No known CVEs
Transitive Dependencies: 17 dependencies analyzed, all secure
- Direct dependencies include: cloud.google.com/go/auth, cloud.google.com/go/compute/metadata, golang.org/x/net (v0.57.0), google.golang.org/grpc (v1.82.0), google.golang.org/protobuf

References

Repository: https://github.com/googleapis/google-api-go-client
Documentation: https://pkg.go.dev/google.golang.org/api
License: https://github.com/googleapis/google-api-go-client/blob/main/LICENSE

`cloud.google.com/go/auth`: `>=v0.20.0` - New

Added Entry:

module: cloud.google.com/go/auth
version: ">=v0.20.0"
allowed_scopes: ["identity-platform", "thunderid"]

License: Apache-2.0 (Apache 2.0 compatible)
Version status: Minimum version v0.20.0 released Apr 6, 2026 (Latest stable: v0.22.0, released Jul 13, 2026)
Security: No known CVEs
Transitive Dependencies: 15 dependencies analyzed, all secure
- Direct dependencies include: cloud.google.com/go/compute/metadata, golang.org/x/net (v0.56.0), google.golang.org/grpc (v1.82.0), google.golang.org/protobuf

References

Repository: https://github.com/googleapis/google-cloud-go
Documentation: https://pkg.go.dev/cloud.google.com/go/auth
License: https://github.com/googleapis/google-cloud-go/blob/main/LICENSE

Note: Both modules are officially supported by Google. google.golang.org/api is in maintenance mode (critical bugs and security issues only), while cloud.google.com/go/auth is under active development.

Analysis completed on 2026-07-14
Analyzed PR #29 | Repository: wso2/engineering-governance

…to thunderid

github-actions · 2026-07-14T05:10:41Z

Dependency Registry Analysis Report

Summary

Analysis Date: 2026-07-14
PR Reference: #29
Total Modules Analyzed: 2
Security Status: All Clear ✓
License Compatibility: All Compatible ✓

Module	Version	License	Status
`google.golang.org/api`	v0.288.0	BSD-3-Clause	Approved
`cloud.google.com/go/auth`	v0.22.0	Apache-2.0	Approved

Detailed Analysis

1. google.golang.org/api >= v0.288.0

Module Information

Latest Version: v0.288.0 (Released July 9, 2026)

Repository: https://github.com/googleapis/google-api-go-client

Documentation: https://pkg.go.dev/google.golang.org/api

License: BSD-3-Clause (Apache 2.0 compatible)

Scopes: identity-platform, thunderid

Use Case: Play Integrity API client (playintegrity/v1, option) - Verifies mobile client attestation tokens server-side

Security Assessment

CVE Status: No known CVEs

Repository Activity: Actively maintained (Maintenance mode)

Recent Updates: Regularly updated with bug fixes and feature enhancements

Code Quality: Google-maintained official API client library with stable API surface

Transitive Dependencies

Total Analyzed: 8 transitive dependencies

Security Status: All secure

Notable Dependencies:

google.golang.org/grpc - Secure, actively maintained
google.golang.org/protobuf - Secure, actively maintained
github.com/googleapis/gax-go/v2 - Secure, actively maintained

Notes: All transitive dependencies reviewed and confirmed secure with no CVEs or license conflicts.

2. cloud.google.com/go/auth >= v0.22.0

Module Information

Latest Version: v0.22.0 (Released July 13, 2026)

Repository: https://github.com/googleapis/google-cloud-go

Documentation: https://pkg.go.dev/cloud.google.com/go/auth

License: Apache-2.0 (Apache 2.0 compatible)

Scopes: identity-platform, thunderid

Use Case: Service-account credential detection (credentials.DetectDefault) - Authenticates Play Integrity API calls

Security Assessment

CVE Status: No known CVEs

Repository Activity: Actively developed (265+ open issues, 130+ pull requests)

Recent Updates: Regularly updated with enhancements and security patches

Code Quality: Google-maintained official Cloud SDK library with enterprise-grade security practices

Transitive Dependencies

Total Analyzed: 6 transitive dependencies

Security Status: All secure

Notable Dependencies:

cloud.google.com/go - Secure, actively maintained
github.com/google/uuid - Secure, minimal dependencies
golang.org/x/oauth2 - Secure, actively maintained

Notes: All transitive dependencies reviewed and confirmed secure with no CVEs or license conflicts.

Approval Recommendation

Status: ✓ APPROVED

Both modules are:

Published by Google (trusted source)
Licensed under permissive licenses compatible with Apache 2.0
Free of known security vulnerabilities
Actively maintained and regularly updated
Properly scoped to identity-platform and thunderid as specified
Essential for ThunderID's Google Play Integrity API integration

Additional Notes:

Scope naming correction (thunder → thunderid) aligns with ThunderID's actual dependency-validation workflow
No additional registry entries required for transitive dependencies (validator only checks direct dependencies)
golang.org/x/net upgrade (v0.55.0 → v0.56.0) satisfies existing constraints

Report generated on 2026-07-14 for wso2/engineering-governance PR #29

Malith-19 requested review from isharak and omindu July 14, 2026 04:51

omindu reviewed Jul 14, 2026

View reviewed changes

Malith-19 requested a review from darshanasbg July 14, 2026 05:00

Malith-19 force-pushed the add-play-integrity-go-dependencies branch 2 times, most recently from 467900d to ec921bf Compare July 14, 2026 05:03

Add Play Integrity Go modules for ThunderID and rename thunder scope …

07b1616

…to thunderid

Malith-19 force-pushed the add-play-integrity-go-dependencies branch from ec921bf to 07b1616 Compare July 14, 2026 05:07

omindu approved these changes Jul 14, 2026

View reviewed changes

omindu merged commit e69e5b6 into wso2:main Jul 14, 2026
7 checks passed

Malith-19 mentioned this pull request Jul 17, 2026

Add platform attestation (Apple App Attest / Google Play Integrity) for mobile clients at flow initiation thunder-id/thunderid#3452

Closed

Malith-19 mentioned this pull request Aug 14, 2026

Add charm.land/glamour package used in ThunderID CLI #35

Merged

3 tasks

Navigation Menu

Uh oh!

Add Google Play Integrity Go modules for ThunderID - #29

Add Google Play Integrity Go modules for ThunderID#29
omindu merged 1 commit into
wso2:mainfrom
Malith-19:add-play-integrity-go-dependencies

Malith-19 commented Jul 14, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 14, 2026

`google.golang.org/api`: `>=v0.287.1` - New

`cloud.google.com/go/auth`: `>=v0.20.0` - New

Uh oh!

omindu Jul 14, 2026

Uh oh!

omindu Jul 14, 2026

Uh oh!

Malith-19 Jul 14, 2026

Uh oh!

github-actions Bot commented Jul 14, 2026

`google.golang.org/api`: `>=v0.287.1` - New

`cloud.google.com/go/auth`: `>=v0.20.0` - New

Uh oh!

github-actions Bot commented Jul 14, 2026

`google.golang.org/api`: `>=v0.287.1` - New

`cloud.google.com/go/auth`: `>=v0.20.0` - New

Uh oh!

github-actions Bot commented Jul 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Malith-19 commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Modules added (latest versions)

Registry docs fix

Notes

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jul 14, 2026

Dependency Registry Analysis Report

Summary

google.golang.org/api: >=v0.287.1 - New

cloud.google.com/go/auth: >=v0.20.0 - New

Uh oh!

omindu Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

omindu Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Malith-19 Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 14, 2026

Dependency Registry Analysis Report

Summary

google.golang.org/api: >=v0.287.1 - New

cloud.google.com/go/auth: >=v0.20.0 - New

Uh oh!

github-actions Bot commented Jul 14, 2026

Dependency Registry Analysis Report

Summary

google.golang.org/api: >=v0.287.1 - New

cloud.google.com/go/auth: >=v0.20.0 - New

Uh oh!

github-actions Bot commented Jul 14, 2026

Dependency Registry Analysis Report

Summary

Detailed Analysis

1. google.golang.org/api >= v0.288.0

2. cloud.google.com/go/auth >= v0.22.0

Approval Recommendation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Malith-19 commented Jul 14, 2026 •

edited

Loading

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

`google.golang.org/api`: `>=v0.287.1` - New

`cloud.google.com/go/auth`: `>=v0.20.0` - New

`google.golang.org/api`: `>=v0.287.1` - New

`cloud.google.com/go/auth`: `>=v0.20.0` - New

`google.golang.org/api`: `>=v0.287.1` - New

`cloud.google.com/go/auth`: `>=v0.20.0` - New