Skip to content

Commit 9e3cbe4

Browse files
BozdoganMehmetozkanBozdoganMehmetozkan
committed
gosec commit
0 parents  commit 9e3cbe4

File tree

172 files changed

+22976
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

172 files changed

+22976
-0
lines changed

‎.github/FUNDING.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# These are supported funding model platforms
2+
3+
github: [ccojocar, gcmurphy]

‎.github/issue_template.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
### Summary
2+
3+
### Steps to reproduce the behavior
4+
5+
### gosec version
6+
7+
### Go version (output of 'go version')
8+
9+
### Operating system / Environment
10+
11+
### Expected behavior
12+
13+
### Actual behavior

‎.github/workflows/ci.yml

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: CI
2+
on:
3+
push:
4+
branches:
5+
- master
6+
pull_request:
7+
branches:
8+
- master
9+
jobs:
10+
test:
11+
strategy:
12+
matrix:
13+
version: [{go: '1.22.6', golangci: 'latest'}, {go: '1.23.0', golangci: 'latest'}]
14+
runs-on: ubuntu-latest
15+
env:
16+
GO111MODULE: on
17+
steps:
18+
- name: Setup go ${{ matrix.version.go }}
19+
uses: actions/setup-go@v5
20+
with:
21+
go-version: ${{ matrix.version.go }}
22+
- name: Checkout Source
23+
uses: actions/checkout@v4
24+
- uses: actions/cache@v4
25+
with:
26+
path: ~/go/pkg/mod
27+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
28+
restore-keys: |
29+
${{ runner.os }}-go-
30+
- name: lint
31+
uses: golangci/golangci-lint-action@v6
32+
with:
33+
version: ${{ matrix.version.golangci }}
34+
- name: Run Gosec Security Scanner
35+
uses: securego/gosec@master
36+
with:
37+
args: ./...
38+
- name: Run Tests
39+
run: make test
40+
- name: Perf Diff
41+
run: make perf-diff
42+
coverage:
43+
needs: [test]
44+
runs-on: ubuntu-latest
45+
env:
46+
GO111MODULE: on
47+
steps:
48+
- name: Setup go
49+
uses: actions/setup-go@v5
50+
with:
51+
go-version: '1.23.0'
52+
- name: Checkout Source
53+
uses: actions/checkout@v4
54+
- uses: actions/cache@v4
55+
with:
56+
path: ~/go/pkg/mod
57+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
58+
restore-keys: |
59+
${{ runner.os }}-go-
60+
- name: Create Test Coverage
61+
run: make test-coverage
62+
- name: Upload Test Coverage
63+
uses: codecov/codecov-action@v4
64+
with:
65+
token: ${{ secrets.CODECOV_TOKEN }}
66+
fail_ci_if_error: true

‎.github/workflows/release.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Release
2+
on:
3+
push:
4+
tags:
5+
- 'v*'
6+
jobs:
7+
build:
8+
runs-on: ubuntu-latest
9+
env:
10+
GO111MODULE: on
11+
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
12+
steps:
13+
- name: Checkout Source
14+
uses: actions/checkout@v4
15+
- name: Unshallow
16+
run: git fetch --prune --unshallow
17+
- name: Set up Go
18+
uses: actions/setup-go@v5
19+
with:
20+
go-version: '1.23.0'
21+
- name: Install Cosign
22+
uses: sigstore/cosign-installer@v3
23+
with:
24+
cosign-release: 'v2.2.4'
25+
- name: Store Cosign private key in a file
26+
run: 'echo "$COSIGN_KEY" > /tmp/cosign.key'
27+
shell: bash
28+
env:
29+
COSIGN_KEY: ${{secrets.COSIGN_KEY}}
30+
- name: Set up QEMU
31+
uses: docker/setup-qemu-action@v3
32+
- name: Set up Docker Buildx
33+
uses: docker/setup-buildx-action@v3
34+
- name: Login to DockerHub
35+
uses: docker/login-action@v3
36+
with:
37+
username: ${{secrets.DOCKER_USERNAME}}
38+
password: ${{secrets.DOCKER_PASSWORD}}
39+
- name: Generate SBOM
40+
uses: CycloneDX/gh-gomod-generate-sbom@v2
41+
with:
42+
version: v1
43+
args: mod -licenses -json -output bom.json
44+
- name: Docker meta
45+
uses: docker/metadata-action@v5
46+
id: meta
47+
with:
48+
images: securego/gosec
49+
flavor: |
50+
latest=true
51+
tags: |
52+
type=sha,format=long
53+
type=semver,pattern={{version}}
54+
- name: Release Binaries
55+
uses: goreleaser/goreleaser-action@v6
56+
with:
57+
version: latest
58+
args: release --clean
59+
env:
60+
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
61+
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
62+
- name: Release Docker Image
63+
uses: docker/build-push-action@v6
64+
id: relimage
65+
with:
66+
platforms: linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
67+
tags: ${{steps.meta.outputs.tags}}
68+
labels: ${{steps.meta.outputs.labels}}
69+
push: true
70+
build-args: GO_VERSION=1.23
71+
- name: Sign Docker Image
72+
run: cosign sign --yes --key /tmp/cosign.key ${DIGEST}
73+
env:
74+
TAGS: ${{steps.meta.outputs.tags}}
75+
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
76+
COSIGN_PRIVATE_KEY: /tmp/cosign.key
77+
DIGEST: ${{steps.relimage.outputs.digest}}

‎.github/workflows/scan.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: "Security Scan"
2+
3+
# Run workflow each time code is pushed to your repository and on a schedule.
4+
# The scheduled workflow runs every at 00:00 on Sunday UTC time.
5+
on:
6+
push:
7+
pull_request:
8+
schedule:
9+
- cron: '0 0 * * 0'
10+
11+
jobs:
12+
build:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Check out code into the Go module directory
16+
uses: actions/checkout@v4
17+
- name: Security Scan
18+
uses: securego/gosec@master
19+
with:
20+
# we let the report trigger content trigger a failure using the GitHub Security features.
21+
args: '-no-fail -fmt sarif -out results.sarif ./...'
22+
- name: Upload SARIF file
23+
uses: github/codeql-action/upload-sarif@v3
24+
with:
25+
# Path to SARIF file relative to the root of the repository
26+
sarif_file: results.sarif

‎.gitignore

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# transient files
2+
/image
3+
4+
# Compiled Object files, Static and Dynamic libs (Shared Objects)
5+
*.o
6+
*.a
7+
*.so
8+
*.swp
9+
/gosec
10+
11+
# Folders
12+
_obj
13+
_test
14+
vendor
15+
dist
16+
17+
# Architecture specific extensions/prefixes
18+
*.[568vq]
19+
[568vq].out
20+
21+
*.cgo1.go
22+
*.cgo2.c
23+
_cgo_defun.c
24+
_cgo_gotypes.go
25+
_cgo_export.*
26+
27+
_testmain.go
28+
29+
*.exe
30+
*.test
31+
*.prof
32+
33+
.DS_Store
34+
35+
.vscode
36+
.idea
37+
38+
# SBOMs generated during CI
39+
/bom.json
40+
1

‎.golangci.yml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
linters:
2+
enable:
3+
- asciicheck
4+
- bodyclose
5+
- copyloopvar
6+
- dogsled
7+
- durationcheck
8+
- errcheck
9+
- errorlint
10+
- gci
11+
- ginkgolinter
12+
- gochecknoinits
13+
- gofmt
14+
- gofumpt
15+
- goimports
16+
- gosec
17+
- gosimple
18+
- govet
19+
- importas
20+
- ineffassign
21+
- misspell
22+
- nakedret
23+
- nolintlint
24+
- revive
25+
- staticcheck
26+
- typecheck
27+
- unconvert
28+
- unparam
29+
- unused
30+
- wastedassign
31+
32+
linters-settings:
33+
gci:
34+
sections:
35+
- standard
36+
- default
37+
- prefix(github.com/securego)
38+
staticcheck:
39+
checks:
40+
- all
41+
- '-SA1019'
42+
43+
revive:
44+
rules:
45+
- name: dot-imports
46+
disabled: true
47+
48+
run:
49+
timeout: 5m

‎.goreleaser.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
project_name: gosec
3+
4+
release:
5+
extra_files:
6+
- glob: ./bom.json
7+
github:
8+
owner: securego
9+
name: gosec
10+
11+
builds:
12+
- main: ./cmd/gosec/
13+
binary: gosec
14+
goos:
15+
- darwin
16+
- linux
17+
- windows
18+
goarch:
19+
- amd64
20+
- arm64
21+
- s390x
22+
- ppc64le
23+
ldflags: -X main.Version={{.Version}} -X main.GitTag={{.Tag}} -X main.BuildDate={{.Date}}
24+
env:
25+
- CGO_ENABLED=0
26+
27+
signs:
28+
- cmd: cosign
29+
stdin: '{{ .Env.COSIGN_PASSWORD}}'
30+
args:
31+
- "sign-blob"
32+
- "--key=/tmp/cosign.key"
33+
- "--output=${signature}"
34+
- "${artifact}"
35+
- "--yes"
36+
artifacts: all
37+

‎Dockerfile

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
ARG GO_VERSION
2+
FROM golang:${GO_VERSION}-alpine AS builder
3+
RUN apk add --no-cache ca-certificates make git curl gcc libc-dev \
4+
&& mkdir -p /build
5+
WORKDIR /build
6+
COPY . /build/
7+
RUN go mod download \
8+
&& make build-linux
9+
10+
FROM golang:${GO_VERSION}-alpine
11+
RUN apk add --no-cache ca-certificates bash git gcc libc-dev openssh
12+
ENV GO111MODULE on
13+
COPY --from=builder /build/gosec /bin/gosec
14+
COPY entrypoint.sh /bin/entrypoint.sh
15+
ENTRYPOINT ["/bin/entrypoint.sh"]

0 commit comments

Comments
 (0)