Reduce standalone gosec exclusions to restore actionable detection of new findings#44705
Merged
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Review securego/gosec Go module usage
Reduce standalone gosec exclusions to restore actionable detection of new findings
Jul 10, 2026
Contributor
🤖 PR Triage
Reduces standalone gosec exclusions to restore actionable security findings detection. 3 files, minimal net change. Review with similar security/chore draft PRs.
|
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request tightens the standalone gosec configuration so that only the broadly noisy G602 rule remains globally excluded, restoring detection for newly introduced findings that should be handled via targeted inline #nosec suppressions.
Changes:
- Reduced standalone
gosecglobal exclusions from multiple rules down to-exclude=G602in both local (make security-gosec) and CI scanning. - Updated comments in the standalone
goseccall sites to clarify the intended policy (global excludes only for noisy rules; inline#nosec Gxxx -- justificationfor targeted suppressions). - Adjusted
.golangci.ymlcommentary to clarify it only applies ifgosecis re-enabled undergolangci-lint.
Show a summary per file
| File | Description |
|---|---|
| Makefile | Narrows standalone gosec exclusions to G602 and updates policy comments. |
| .golangci.yml | Clarifies the scope of the gosec exclusion list when/if re-enabled in golangci-lint. |
| .github/workflows/security-scan.yml | Narrows CI gosec exclusions to G602 and updates policy comments. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 2
- Review effort level: Low
Comment on lines
+212
to
+214
| @# Keep only globally noisy rules here. | ||
| @# G602 (slice bounds check) is excluded globally due persistent false positives. | ||
| @# Use inline '#nosec Gxxx -- justification' suppressions for specific findings. |
Comment on lines
+30
to
+32
| # Keep only globally noisy rules here. | ||
| # G602 (slice bounds check) is excluded globally due persistent false positives. | ||
| # Use inline '#nosec Gxxx -- justification' suppressions for specific findings. |
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The current gosec setup globally excluded several rules that were already suppressed inline with rule-specific, justified
#nosecannotations. That made those inline suppressions effectively dead and prevented detection of new unannotated violations in those categories.Scope reduction in standalone gosec invocation
Makefile(security-gosec).github/workflows/security-scan.yml(Run Gosec)G101,G115,G204,G602,G301,G302,G304,G306G602Policy clarification in comments
#nosec Gxxx -- justificationG602as global exclude.Config comment alignment
.golangci.ymlgosec commentary to remove outdated “source of truth / keep in sync” wording and clarify that this block applies if gosec is re-enabled in golangci-lint.