Repository navigation
ci: add pre-commit gosec hook for at-commit-time security feedback #1374
Description
Add a pre-commit hook running gosec (pinned to the same version as CI, currently v2.26.1) so security findings surface at commit time instead of first failing in the Security Scanning CI job. Requirements: pinned version (never @latest, per feedback_ci_tool_version_pin); scan only the packages containing changed .go files (fast); respect the multi-module layout (root, pkg, providers/aws|azure|gcp, ci_cd_sanity_tests) by running gosec within the module owning each changed package; same flags as CI so local and CI verdicts agree; suppressions must use the #nosec form (see feedback_gosec_nosec_not_nolint). Complements #1363 (multi-module CI scan).
Activity
cristim commentedon Jul 16, 2026
Implemented in PR #1376: #1376
ci(pre-commit): pinned gosec hook on changed packages (closes #1374)
ci(pre-commit): pinned gosec hook on changed packages (closes #1374)
Merge pull request #1376 from LeanerCloud/ci/pre-commit-gosec-hook
cristim commentedon Jul 16, 2026
Closed by #1376 (merged): pinned per-package gosec pre-commit hook. Rule-set alignment with CI tracked in #1394.
ci(pre-commit): pinned gosec hook on changed packages (closes #1374)
Merge pull request #1376 from LeanerCloud/ci/pre-commit-gosec-hook