ci: bump gosec to v2.28.0, retire obsolete #nosec suppressions (closes #1382) - #1384
Conversation
|
@coderabbitai review |
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 53 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
✅ Action performedReview finished.
|
PR #1384 bumps the CI Security Scanning gosec pin to v2.28.0; align the pre-commit hook so local and CI verdicts stay in agreement. Updates the GOSEC_VERSION pin in scripts/gosec-hook.sh and the doc mentions in the hook config comment. Re-verified with v2.28.0: auto-install to the versioned cache dir works; clean pass on cmd/ + pkg/ + providers/aws in ~1.6 s warm; deliberate G501 (crypto/md5) scratch file fails with exit 1; clean pass restored after removal.
PR #1384 bumps the CI Security Scanning gosec pin to v2.28.0; align the pre-commit hook so local and CI verdicts stay in agreement. Updates the GOSEC_VERSION pin in scripts/gosec-hook.sh and the doc mentions in the hook config comment. Re-verified with v2.28.0: auto-install to the versioned cache dir works; clean pass on cmd/ + pkg/ + providers/aws in ~1.6 s warm; deliberate G501 (crypto/md5) scratch file fails with exit 1; clean pass restored after removal.
PR #1384 bumps the CI Security Scanning gosec pin to v2.28.0; align the pre-commit hook so local and CI verdicts stay in agreement. Updates the GOSEC_VERSION pin in scripts/gosec-hook.sh and the doc mentions in the hook config comment. Re-verified with v2.28.0: auto-install to the versioned cache dir works; clean pass on cmd/ + pkg/ + providers/aws in ~1.6 s warm; deliberate G501 (crypto/md5) scratch file fails with exit 1; clean pass restored after removal.
The latest securego/gosec release is v2.28.0. Update the self-install in the Security Scanning job so CI runs the current version. PR #1376 (pre-commit gosec hook) is still open; a comment has been posted there asking to align its pin to v2.28.0 when it lands.
Tested each annotation by temporarily removing it and running gosec v2.28.0 on the owning module. Findings that no longer appear indicate the rule was removed or no longer triggers on the pattern. Retired (finding gone in v2.28.0): - G201 x6: postgres_analytics.go (x4) and analytics_postgres.go (x2) -- gosec v2.28.0 removed the G201 SQL-format-string rule entirely - G101 x2: email/templates.go -- gosec no longer flags email copy text containing the word "password" as a hardcoded credential - G101 x1: credentials/resolver.go:27 (azure_client_secret constant) -- gosec no longer flags this string; sibling GCP constants still flagged - G122 x1 (partial): deploy/frontend.go annotation updated from G304,G122 to G304 -- G122 is not a recognized rule in v2.28.0 Kept (finding still returned after removing the annotation): - G302,G304: pkg/common/audit.go -- 0644 file permission + path variable - G404: pkg/retry/exponential.go and providers/aws/recommendations/ratelimiter.go - G115, G101, G704, G703, G304, G204, G117, G505, G706, G104, G703, G705: all remaining annotations (verified per-module) Full verification: gosec v2.28.0 on all 6 modules -> 0 findings; go build ./... and go vet ./... clean; tests pass on all touched packages.
b58daeb to
e128700
Compare
|
@coderabbitai review |
✅ Action performedReview finished.
|
Summary
#nosecannotations that gosec v2.28.0 no longer requires, verified by temporarily removing each annotation and re-running gosec on its module.Annotation audit: before vs after
internal/analytics/postgres_analytics.gointernal/api/analytics_postgres.gointernal/email/templates.gointernal/credentials/resolver.go:27(azure_client_secret constant only)internal/deploy/frontend.go(G304 kept; G122 not a recognized rule)G201 was removed from gosec entirely between v2.26.1 and v2.28.0. G101 refinement means email copy text containing "password" and the
azure_client_secrettype-name constant are no longer flagged.Test plan
go build ./...andgo vet ./...on root and pkg: cleango teston all touched packages (internal/analytics, internal/api, internal/email, internal/credentials, internal/deploy): pass