[release-branch.go1.26] pipeline: exclude stage 0 toolchain from Component Governance

[George Adams (gdams)]

Backport of #2494.

Summary

• install the temporary Stage 0 Go bootstrap toolchain under eng/artifacts/_goStage0, matching Go 1.27 behavior
• exclude that non-shipping directory from Component Governance scans
• avoid attributing bootstrap-toolchain findings such as CVE-2026-42508 to this repository

Validation

• pwsh eng/run.ps1 pipelineymlgen
  • installed Stage 0 at eng/artifacts/_goStage0/go1.25.0-1
  • used that installation to regenerate the pipeline YAML
• git diff --check
• verified the installed Stage 0 binary is ignored by eng/.gitignore

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

🟡 Changes recommended

The ignored directory path appears inconsistent with where the Stage 0 toolchain is installed in this repo’s build scripts, so the change likely won’t achieve the intended suppression.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	eng/​pipeline/​rolling-internal-pipeline.yml — ignoreDirectories points at $(Build.SourcesDirectory)/eng/artifacts/_goStage0, but the repo’s…

What changed in this PR

This PR backports a pipeline change to prevent Component Governance from attributing vulnerabilities found in the temporary Stage 0 (bootstrap) Go toolchain (e.g., CVE-2026-42508) to this repository’s code.

Changes:

• Adds a Component Governance configuration to ignore a Stage 0 toolchain directory during scanning.

File	Description
eng/​pipeline/​rolling-internal-pipeline.yml	Configures Component Governance to ignore a directory intended to contain the non-shipping Stage 0 bootstrap toolchain.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The Stage 0 install location and the Component Governance ignore rule are now aligned and consistent with existing pipeline path conventions.

Review tier: Lite
Findings: None

Issues resolved since last review (1)

Severity	Finding
	eng/​pipeline/​rolling-internal-pipeline.yml — ignoreDirectories points at $(Build.SourcesDirectory)/eng/artifacts/_goStage0, but the repo’s… View resolved comment