Update Go Ort

[prateek-kumar-improving]

Issue link

This Pull Request is linked to issue (URL): #3470

Description

1. Run GO ORT tool on GO folder. (Using ./.github/workflows/run-ort-tools)
2. Install Protobuf dependency for running ORT tool.
3. Update go/.ort.yml to add the files and folders to exclude in ORT for GO.

Changes after review.

1. Added GoMod to enabledPackageManagers.

Checklist

Before submitting the PR make sure the following are checked:

• This Pull Request is related to one issue.
• Commit message has a detailed description of what changed and why.
• Tests are added or updated.
• CHANGELOG.md and documentation files are updated.
• Destination branch is correct - main or release
• Create merge commit if merging release branch into main, squash otherwise.

[Yury-Fridlyand]

CI is red. I guess we can't use both Gradle and GradleInspector at a time, or we they require extra config.

[yipin-chen]

Conditional approve, for workflow change to add GoMod
Why do you keep Gradle, GradleInspector, Maven, NPM, etc? Is it due to cross-client dependency?
For Go package and FFI, I will let Yury or Bar to review and comment.

[barshaul]

I don't understand this change. What's the motivation?
Why not to add only the go package manager?
This field should include only the package managers we're publishing to

[prateek-kumar-improving]

I don't understand this change. What's the motivation? Why not to add only the go package manager? This field should include only the package managers we're publishing to

@barshaul
Can you tell how should we get the list of package managers we are publishing to?

[barshaul]

I don't understand this change. What's the motivation? Why not to add only the go package manager? This field should include only the package managers we're publishing to

@barshaul

Can you tell how should we get the list of package managers we are publishing to?

The list you've changed is the updated list of the package managers we're publishing too. Don't override it, instead just add the package manager that is relevant to go. In general- you can see in our CD workflows which package managers are being used

[barshaul]

those are packages used in tests only and they are added to the exclude list:

I initially assumed the first require block in go.mod was for production and the second for dev dependencies, but it appears Go doesn’t make this distinction built-in. So no, test dependencies shouldn’t be included—only protobuf is actually required. However, it’s still missing from the generated NOTICE file. The NOTICE DEFAULT file of Go shouldn't be empty

Approved be delegation