From 9cf861e5097716dfff35f4f40550aa5a272d37df Mon Sep 17 00:00:00 2001 From: Tim Walsh Date: Tue, 22 Sep 2026 23:37:42 -0700 Subject: [PATCH] ci: make scripts/ci.sh gosec match the workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The script claimed "same config as CI" while passing -severity medium and installing gosec@latest. The workflow pins v2.28.0 and applies no severity filter, so the local check could pass on code CI rejects — which is exactly what happened on the extension-dispatch branch: a HIGH-severity G702 taint finding was invisible locally and failed in CI. Pins the same version and drops the severity filter. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014aqbmccWm1tqttmBUCR5rv ClickUp: 86dxbeqyt --- scripts/ci.sh | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/scripts/ci.sh b/scripts/ci.sh index 00fda5a..ca0ace2 100755 --- a/scripts/ci.sh +++ b/scripts/ci.sh @@ -6,6 +6,10 @@ set -euo pipefail +# Keep in step with .github/workflows/ci.yml — a local run that uses a +# different gosec can pass while CI fails. +GOSEC_VERSION="v2.28.0" + # Add Go bin to PATH export PATH="$PATH:$(go env GOPATH)/bin" @@ -92,8 +96,10 @@ fi # Step 6: Run gosec print_step "Running security scan (gosec)" if command -v gosec &> /dev/null; then - # Run gosec with same config as CI - if gosec -fmt json -out gosec-report.json -stdout -verbose=text -severity medium ./...; then + # Match .github/workflows/ci.yml exactly: pinned version, no severity + # filter. A -severity medium filter here would hide LOW findings that fail + # in CI, and an unpinned gosec can differ on which rules exist at all. + if gosec -fmt json -out gosec-report.json -stdout -verbose=text ./...; then print_success "Security scan passed" rm -f gosec-report.json else @@ -101,9 +107,9 @@ if command -v gosec &> /dev/null; then FAILED=1 fi else - echo "gosec not installed, installing..." - go install github.com/securego/gosec/v2/cmd/gosec@latest - if gosec -fmt json -out gosec-report.json -stdout -verbose=text -severity medium ./...; then + echo "gosec not installed, installing $GOSEC_VERSION..." + go install github.com/securego/gosec/v2/cmd/gosec@$GOSEC_VERSION + if gosec -fmt json -out gosec-report.json -stdout -verbose=text ./...; then print_success "Security scan passed" rm -f gosec-report.json else