jfrog
Add --exclude support in go publish command
Is your feature request related to a problem? Please describe. When publishing a go module with the jf cli, the full module folder is uploaded. Considering that in a common go module the source root is also the repo root, there can be many files that are not intended for uploaded found in the folder such as helm charts or even binaries such as a build artifact from a previously executed build. This can also become a security issue to an unaware user if accidentally dotfiles or other sensitive files are uploaded.
Describe the solution you'd like to see In some commands like the artifactory upload a --excludes flag already exists, providing support to exclude certain files and folder from being uploaded, I'd like to see --excludes support also added to the go publish action.
Describe alternatives you've considered
- An ignorefile similar to gitignore, helmignore, dockerignore etc
- some configuration in the .jfrog folder
Additional context I observed this issue after building a software with the operator-sdk inside a pipeline. the operator-sdk will try to download tool CLIs into the bin folder inside the project. The folder is properly excluded via .gitignore and .dockerignore etc, but still the bin folder, including the containing tool binaries, got uploaded to artifactory when publsihing the go module.
+1 on this feature, I had exactly the same issue (also using operator sdk)
In general, you do not want to upload the entire folder as sources, typically projects contain other files as well that do not belong in a published go module
