Skip to content

ci: bump gosec pin to latest v2.27.x and retire obsolete #nosec suppressions #1382

Closed
Closed
ci: bump gosec pin to latest v2.27.x and retire obsolete #nosec suppressions#1382
Labels
effort/sHoursimpact/internalTeam-internal onlypriority/p3Polish / idea / may never shipseverity/lowMinor harmtriagedItem has been triagedtype/choreMaintenance / non-user-visibleurgency/this-quarterWithin the quarter

Description

@cristim
cristim
opened on Jul 16, 2026

Follow-up to #1363 (owner suggestion). The gosec binary version, not the GitHub action wrapper, decides findings. Newer gosec (v2.27.x) has materially better G115 bounds-check recognition and improved G304 analysis, so a number of the current rule-specific #nosec annotations (added next to real guards) should no longer be needed.

Scope: bump the pinned version in .github/workflows/ci.yml (and scripts/gosec-hook.sh from #1376 - keep both pins identical); re-scan all 6 Go modules; REMOVE every #nosec the new version no longer requires (verify each by temporarily removing it and re-scanning); KEEP the genuinely-intentional ones (G101 env-var-name/constant false positives, TOTP SHA-1 compat) with their justifications - those are audit trail, not debt. Zero behavior changes to production code; suppress-count strictly decreases. Per feedback_gosec_nosec_not_nolint + no-masking directive.

Activity

  1. cristim
    added
    triagedItem has been triaged
    priority/p3Polish / idea / may never ship
    severity/lowMinor harm
    urgency/this-quarterWithin the quarter
    impact/internalTeam-internal only
    effort/sHours
    type/choreMaintenance / non-user-visible
    on Jul 16, 2026

  2. cristim commented on Jul 16, 2026

    @cristim
    cristim
    on Jul 16, 2026
    MemberAuthor

    PR #1384 implements this: #1384

    Bumped gosec to v2.28.0 and audited all #nosec annotations across the repo. Results:

    • 10 annotations retired/cleaned (9 full removals, 1 partial label cleanup)
    • ~69 annotations kept (findings still return with v2.28.0)

    Key retirements: 6x G201 (SQL format string -- rule removed from gosec v2.28.0), 2x G101 in email templates, 1x G101 for azure_client_secret constant, and G122 removed from one G304,G122 pair (G122 not recognized by v2.28.0).

    All 6 modules pass gosec with 0 findings; go build, go vet, and go test all clean.

  3. cristim
    closed this as completedin 8cd51abon Jul 17, 2026
  4. cristim
    added a commit that references this issue on Sep 27, 2026

    ci: bump gosec to v2.28.0, retire obsolete #nosec suppressions (closes …

    8c8d91a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    effort/sHoursimpact/internalTeam-internal onlypriority/p3Polish / idea / may never shipseverity/lowMinor harmtriagedItem has been triagedtype/choreMaintenance / non-user-visibleurgency/this-quarterWithin the quarter

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions