Skip to content

ci: make scripts/ci.sh gosec match the workflow #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
timimsms wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: make scripts/ci.sh gosec match the workflow #54

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions scripts/ci.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@

set -euo pipefail

# Keep in step with .github/workflows/ci.yml — a local run that uses a
# different gosec can pass while CI fails.
GOSEC_VERSION="v2.28.0"

# Add Go bin to PATH
export PATH="$PATH:$(go env GOPATH)/bin"

Expand Down Expand Up @@ -92,18 +96,20 @@ fi
# Step 6: Run gosec
print_step "Running security scan (gosec)"
if command -v gosec &> /dev/null; then
# Run gosec with same config as CI
if gosec -fmt json -out gosec-report.json -stdout -verbose=text -severity medium ./...; then
# Match .github/workflows/ci.yml exactly: pinned version, no severity
# filter. A -severity medium filter here would hide LOW findings that fail
# in CI, and an unpinned gosec can differ on which rules exist at all.
if gosec -fmt json -out gosec-report.json -stdout -verbose=text ./...; then
print_success "Security scan passed"
rm -f gosec-report.json
else
print_error "Security scan failed"
FAILED=1
fi
else
echo "gosec not installed, installing..."
go install github.com/securego/gosec/v2/cmd/gosec@latest
if gosec -fmt json -out gosec-report.json -stdout -verbose=text -severity medium ./...; then
echo "gosec not installed, installing $GOSEC_VERSION..."
go install github.com/securego/gosec/v2/cmd/gosec@$GOSEC_VERSION
if gosec -fmt json -out gosec-report.json -stdout -verbose=text ./...; then
print_success "Security scan passed"
rm -f gosec-report.json
else
Expand Down
Loading