It would be nice to figure out when we can safely set CGO_ENABLED, but I'm not sure it should be simply because CC is set. We have a corresponding set of bug reports from people who set CC to the wrong compiler. But I don't have a better suggestion.
We have a very simple rule right now: cgo is disabled for all cross-compiles. We should probably keep that simple rule. People building for Android have needed to set CGO_ENABLED from the start, and they seem to be coping just fine.