fix(lint): centralise gosec G117/G703/G704/G705 exclusions in config, pin CI to v2.10.1
- commit
- b2a9e59d226e24350aabd64dd1960cd56364d02d
- author
- bnema · · 2026-02-25 02:11 UTC
- parent
- c35e93d
- signature
- unsigned
2 files · +21 -1
M .github/workflows/ci.yml +1 -1
| @@ -47,7 +47,7 @@ jobs: | |||
| 47 | 47 | - name: Run golangci-lint | |
| 48 | 48 | uses: golangci/golangci-lint-action@v9 | |
| 49 | 49 | with: | |
| 50 | - | version: latest | |
| 50 | + | version: v2.10.1 | |
| 51 | 51 | ||
| 52 | 52 | test: | |
| 53 | 53 | name: Test | |
| @@ -47,7 +47,7 @@ jobs: | |||||
| 47 | - name: Run golangci-lint | 47 | - name: Run golangci-lint | ||
| 48 | uses: golangci/golangci-lint-action@v9 | 48 | uses: golangci/golangci-lint-action@v9 | ||
| 49 | with: | 49 | with: | ||
| 50 | - | version: latest | 50 | + | version: v2.10.1 |
| 51 | 51 | ||||
| 52 | test: | 52 | test: | ||
| 53 | name: Test | 53 | name: Test | ||
M .golangci.yml +20 -0
| @@ -58,6 +58,26 @@ linters: | |||
| 58 | 58 | - text: "G104:" | |
| 59 | 59 | linters: | |
| 60 | 60 | - gosec | |
| 61 | + | # gosec G117: exported struct fields matching secret-name patterns are intentional DTOs | |
| 62 | + | # (OCI registry tokens, CLI credential request bodies, telemetry config, JWT response frames). | |
| 63 | + | # These fields must be exported and carry credentials by design — they are not accidental leaks. | |
| 64 | + | - text: "G117:" | |
| 65 | + | linters: | |
| 66 | + | - gosec | |
| 67 | + | # gosec G703/G704/G705: taint-analysis false positives for a CLI tool and reverse proxy. | |
| 68 | + | # G704 (SSRF): target URLs come from operator-configured routing tables or explicit CLI flags, | |
| 69 | + | # not from untrusted user input. G703 (path traversal): XDG_RUNTIME_DIR is a trusted env var | |
| 70 | + | # set by the login session, not user-supplied. G705 (XSS): registry manifest data is binary | |
| 71 | + | # OCI content served with an explicit Content-Type, not rendered as HTML. | |
| 72 | + | - text: "G703:" | |
| 73 | + | linters: | |
| 74 | + | - gosec | |
| 75 | + | - text: "G704:" | |
| 76 | + | linters: | |
| 77 | + | - gosec | |
| 78 | + | - text: "G705:" | |
| 79 | + | linters: | |
| 80 | + | - gosec | |
| 61 | 81 | ||
| 62 | 82 | formatters: | |
| 63 | 83 | enable: | |
| @@ -58,6 +58,26 @@ linters: | |||||
| 58 | - text: "G104:" | 58 | - text: "G104:" | ||
| 59 | linters: | 59 | linters: | ||
| 60 | - gosec | 60 | - gosec | ||
| 61 | + | # gosec G117: exported struct fields matching secret-name patterns are intentional DTOs | |||
| 62 | + | # (OCI registry tokens, CLI credential request bodies, telemetry config, JWT response frames). | |||
| 63 | + | # These fields must be exported and carry credentials by design — they are not accidental leaks. | |||
| 64 | + | - text: "G117:" | |||
| 65 | + | linters: | |||
| 66 | + | - gosec | |||
| 67 | + | # gosec G703/G704/G705: taint-analysis false positives for a CLI tool and reverse proxy. | |||
| 68 | + | # G704 (SSRF): target URLs come from operator-configured routing tables or explicit CLI flags, | |||
| 69 | + | # not from untrusted user input. G703 (path traversal): XDG_RUNTIME_DIR is a trusted env var | |||
| 70 | + | # set by the login session, not user-supplied. G705 (XSS): registry manifest data is binary | |||
| 71 | + | # OCI content served with an explicit Content-Type, not rendered as HTML. | |||
| 72 | + | - text: "G703:" | |||
| 73 | + | linters: | |||
| 74 | + | - gosec | |||
| 75 | + | - text: "G704:" | |||
| 76 | + | linters: | |||
| 77 | + | - gosec | |||
| 78 | + | - text: "G705:" | |||
| 79 | + | linters: | |||
| 80 | + | - gosec | |||
| 61 | 81 | ||||
| 62 | formatters: | 82 | formatters: | ||
| 63 | enable: | 83 | enable: | ||