serverless-plugin-go 0.1.2 → 0.1.4

package/.cz.toml

@@ -1,7 +1,7 @@
 [tool]
 [tool.commitizen]
 name = "cz_customize"
-version = "0.1.2"
+version = "0.1.4"
 tag_format = "v$version"
 bump_message = "bump: release $current_version → $new_version [skip-ci]"
 update_changelog_on_bump = true

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## v0.1.4 (2026-11-13)
+
+
+- fix: default GOFLAGS=-trimpath -buildvcs=false and merge custom env with defaults (#14)
+
+## v0.1.3 (2026-11-10)
+
+
+- fix: per-function GOARCH and deterministic zip artifacts (#12)
+- - Build env is now computed per function with an explicit GOARCH
+  (arm64/amd64). Previously config.env was mutated, so once an arm64
+  function compiled, every following x86_64 function was built as ARM,
+  and x86_64 builds on Apple Silicon used the host arch.
+- Zip entries use a fixed mtime so identical binaries yield
+  byte-identical artifacts (stable hashes across builds).
+- Bump mocha 10 -> 12 (mocha 10 fails to start on Node 26).
+
 ## v0.1.2 (2026-03-31)
 
 

package/README.md

@@ -62,6 +62,9 @@ custom:
     env:
       GOOS: 'linux' # Default compile OS
       CGO_ENABLED: '0' # By default CGO is disabled
+      GOFLAGS: '-trimpath -buildvcs=false' # Reproducible builds by default
+      # Variables you define are merged with these defaults; redefining one (e.g. GOFLAGS) replaces
+      # its whole value. These values also override any same-named variable from the shell.
       
     # Bash commands to execute before compilation
     # These commands will be executed once before all compilations

package/index.js

@@ -12,6 +12,9 @@ const supportedRuntimes = ["provided.al2", "provided.al2023"];
 
 const logPrefix = "GoPlugin";
 
+// DOS zip timestamps can't go before 1980.
+const zipEpoch = new Date(1980, 0, 1);
+
 export default class Go {
   constructor(serverless, options) {
     this.readFileSync = readFileSync;
@@ -27,6 +30,7 @@ export default class Go {
       env: {
         CGO_ENABLED: "0",
         GOOS: "linux",
+        GOFLAGS: "-trimpath -buildvcs=false", // reproducible builds
       },
       cmd: 'go build -ldflags="-s -w"',
       monorepo: false,
@@ -149,9 +153,12 @@ export default class Go {
       return;
     }
 
-    if (arch === "arm64") {
-      config.env["GOARCH"] = "arm64";
-    }
+    // Per-function env: never mutate shared config, and always set GOARCH so the
+    // host arch (e.g. Apple Silicon) never leaks into an x86_64 Lambda.
+    const env = {
+      ...config.env,
+      GOARCH: arch === "arm64" ? "arm64" : "amd64",
+    };
 
     const absHandler = path.resolve(config.baseDir);
     const absBin = path.resolve(config.binDir);
@@ -172,7 +179,7 @@ export default class Go {
       compileBinPath = path.relative(cwd, compileBinPath);
     }
 
-    this.logDebug(`[${name}] env: ${JSON.stringify(config.env)}`);
+    this.logDebug(`[${name}] env: ${JSON.stringify(env)}`);
     this.logDebug(`[${name}] cwd: ${cwd}`);
     this.logDebug(`[${name}] arch: ${arch}`);
 
@@ -181,7 +188,7 @@ export default class Go {
       compileBinPath,
       handler,
       cwd,
-      config.env,
+      env,
       arch,
     );
 
@@ -261,6 +268,8 @@ export default class Go {
    */
   packageBootstrap(name, binPath) {
     this.zip.addFile("bootstrap", this.readFileSync(binPath), "", 0o755);
+    // Fixed mtime so identical binaries produce byte-identical zips (stable hashes).
+    this.zip.getEntry("bootstrap").header.time = zipEpoch;
 
     const zipPath = binPath + ".zip";
     this.zip.writeZip(zipPath);
@@ -283,7 +292,11 @@ export default class Go {
     const service = this.serverless.service;
 
     if (service.custom && service.custom.go) {
-      config = { ...config, ...service.custom.go };
+      config = {
+        ...config,
+        ...service.custom.go,
+        env: { ...config.env, ...service.custom.go.env },
+      };
     }
 
     for (let env of Object.keys(config.env)) {

package/index.test.js

@@ -2,6 +2,11 @@ import sinon from "sinon";
 import chai from "chai";
 import sinonChai from "sinon-chai";
 
+import AdmZip from "adm-zip";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
 import Go from "./index.js";
 import ServerlessMock from "./mocks/serverless.mock.js";
 
@@ -27,6 +32,7 @@ describe("Go Plugin", () => {
     admZipStub = {
       addFile: sinon.stub(),
       writeZip: sinon.stub(),
+      getEntry: sinon.stub().returns({ header: {} }),
     };
   });
 
@@ -86,7 +92,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o .bin/testFunc2 functions/func2/main.go`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
 
@@ -98,7 +112,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o .bin/testFunc3 functions/func3`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
 
@@ -110,7 +132,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o .bin/testFunc5 functions/func5/main.go`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
 
@@ -122,7 +152,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o .bin/testFunc6 functions/func6`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
   });
@@ -155,7 +193,15 @@ describe("Go Plugin", () => {
       `go build -o .bin/testFunc1 functions/func1/main.go`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
   });
@@ -188,7 +234,12 @@ describe("Go Plugin", () => {
         cwd: ".",
         env: {
           ...process.env,
-          ...{ CGO_ENABLED: "0", GOOS: "linux", GOARCH: "arm64" },
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "arm64",
+          },
         },
       },
     );
@@ -222,7 +273,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o ../.bin/testFunc1 functions/func1/main.go`,
       {
         cwd: "gopath",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
   });
@@ -323,7 +382,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o .bin/testFunc1 functions/func1/main.go`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
   });
@@ -365,7 +432,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o ../../.bin/testFunc1 .`,
       {
         cwd: "functions/func1",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
 
@@ -377,7 +452,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o ../../.bin/testFunc2 main.go`,
       {
         cwd: "functions/func2",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
   });
@@ -405,6 +488,19 @@ describe("Go Plugin", () => {
     );
   });
 
+  it("Merges custom env with default env", async () => {
+    config.service.setCustom({ go: { env: { FOO: "x" } } });
+
+    const plugin = new Go(config);
+
+    expect(plugin.config.env).to.deep.equal({
+      CGO_ENABLED: "0",
+      GOOS: "linux",
+      GOFLAGS: "-trimpath -buildvcs=false",
+      FOO: "x",
+    });
+  });
+
   it("Should get concurrency config", async () => {
     config.service.setFunctions({
       testFunc1: {
@@ -491,11 +587,25 @@ describe("Go Plugin", () => {
     // Verify beforeBuild commands were executed once
     expect(execStub).to.have.been.calledWith("echo 'before build command'", {
       cwd: ".",
-      env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+      env: {
+        ...process.env,
+        ...{
+          CGO_ENABLED: "0",
+          GOOS: "linux",
+          GOFLAGS: "-trimpath -buildvcs=false",
+        },
+      },
     });
     expect(execStub).to.have.been.calledWith("go mod tidy", {
       cwd: ".",
-      env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+      env: {
+        ...process.env,
+        ...{
+          CGO_ENABLED: "0",
+          GOOS: "linux",
+          GOFLAGS: "-trimpath -buildvcs=false",
+        },
+      },
     });
 
     // Verify compilation commands were executed for each function
@@ -503,14 +613,30 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o .bin/testFunc1 functions/func1/main.go`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
     expect(execStub).to.have.been.calledWith(
       `go build -ldflags="-s -w" -o .bin/testFunc2 functions/func2/main.go`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
 
@@ -545,11 +671,25 @@ describe("Go Plugin", () => {
     // Verify beforeBuild commands were executed once
     expect(execStub).to.have.been.calledWith("echo 'before build command'", {
       cwd: ".",
-      env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+      env: {
+        ...process.env,
+        ...{
+          CGO_ENABLED: "0",
+          GOOS: "linux",
+          GOFLAGS: "-trimpath -buildvcs=false",
+        },
+      },
     });
     expect(execStub).to.have.been.calledWith("go mod tidy", {
       cwd: ".",
-      env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+      env: {
+        ...process.env,
+        ...{
+          CGO_ENABLED: "0",
+          GOOS: "linux",
+          GOFLAGS: "-trimpath -buildvcs=false",
+        },
+      },
     });
 
     // Verify the compilation command was executed
@@ -557,7 +697,15 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o .bin/testFunc1 functions/func1/main.go`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
 
@@ -592,11 +740,25 @@ describe("Go Plugin", () => {
     // Verify beforeBuild commands were executed once
     expect(execStub).to.have.been.calledWith("echo 'before build command'", {
       cwd: ".",
-      env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+      env: {
+        ...process.env,
+        ...{
+          CGO_ENABLED: "0",
+          GOOS: "linux",
+          GOFLAGS: "-trimpath -buildvcs=false",
+        },
+      },
     });
     expect(execStub).to.have.been.calledWith("go mod tidy", {
       cwd: ".",
-      env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+      env: {
+        ...process.env,
+        ...{
+          CGO_ENABLED: "0",
+          GOOS: "linux",
+          GOFLAGS: "-trimpath -buildvcs=false",
+        },
+      },
     });
 
     // Verify compilation command was executed
@@ -604,11 +766,67 @@ describe("Go Plugin", () => {
       `go build -ldflags="-s -w" -o .bin/testFunc1 functions/func1/main.go`,
       {
         cwd: ".",
-        env: { ...process.env, ...{ CGO_ENABLED: "0", GOOS: "linux" } },
+        env: {
+          ...process.env,
+          ...{
+            CGO_ENABLED: "0",
+            GOOS: "linux",
+            GOFLAGS: "-trimpath -buildvcs=false",
+            GOARCH: "amd64",
+          },
+        },
       },
     );
 
     // Total calls should be 3: 2 beforeBuild commands + 1 compilation command
     expect(execStub.callCount).to.equal(3);
   });
+  it("Does not leak arm64 GOARCH into x86_64 functions", async () => {
+    config.service.setFunctions({
+      armFunc: {
+        name: "armFunc",
+        runtime: "provided.al2023",
+        architecture: "arm64",
+        handler: "functions/arm",
+      },
+      x86Func: {
+        name: "x86Func",
+        runtime: "provided.al2023",
+        handler: "functions/x86",
+      },
+    });
+
+    const plugin = new Go(config);
+    plugin.exec = execStub;
+    plugin.readFileSync = readFileSyncStub;
+    plugin.zip = admZipStub;
+
+    await plugin.compileFunctions();
+
+    const envOf = (bin) =>
+      execStub.getCalls().find((c) => c.args[0].includes(bin)).args[1].env;
+    expect(envOf(".bin/armFunc").GOARCH).to.equal("arm64");
+    expect(envOf(".bin/x86Func").GOARCH).to.equal("amd64");
+    expect(plugin.config.env.GOARCH).to.equal(undefined);
+  });
+
+  it("Produces byte-identical zips for identical binaries", async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sp-go-"));
+    const bin = path.join(dir, "fn");
+    fs.writeFileSync(bin, "fake binary content");
+    config.service.setFunctions({ fn: { name: "fn", handler: "fn" } });
+
+    const plugin = new Go(config);
+    plugin.zip = new AdmZip();
+
+    plugin.packageBootstrap("fn", bin);
+    const first = fs.readFileSync(bin + ".zip");
+    await new Promise((r) => setTimeout(r, 2100)); // DOS mtime has 2s resolution
+    plugin.zip = new AdmZip();
+    plugin.packageBootstrap("fn", bin);
+    const second = fs.readFileSync(bin + ".zip");
+
+    fs.rmSync(dir, { recursive: true });
+    expect(first.equals(second)).to.equal(true);
+  }).timeout(5000);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-plugin-go",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "description": "Serverless Framework plugin that compiles Go functions on the fly",
   "main": "index.js",
@@ -54,7 +54,7 @@
     "eslint-plugin-import": "^2.29.0",
     "eslint-plugin-prettier": "^5.0.1",
     "fs": "^0.0.1-security",
-    "mocha": "^10.2.0",
+    "mocha": "^12.0.3",
     "prettier": "^3.0.3",
     "sinon": "^17.0.0",
     "sinon-chai": "^3.7.0"