chore(gosec): suppress new gosec false positives#2377
Conversation
|
No actionable comments were generated in the recent review. 🎉 📝 WalkthroughSummary by CodeRabbit
WalkthroughThis pull request adds gosec suppression directives and broadens gosec exclusions without changing runtime behavior. Six Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@Makefile`:
- Around line 55-56: Remove the repo-wide exclusions of G117 and G704 from the
gosec invocations in the Makefile (the two lines invoking "gosec -quiet ...
-exclude=G117,G704 $(CHECK_FILES)"), and instead scope suppressions to the
specific false-positive locations by adding inline "#nosec" comments with
justifications or using file-specific excludes (or a documented allowlist) for
those known files; update the Makefile to run gosec without those global
excludes and add a short note in the repo's security/README describing why any
remaining scoped suppressions exist and how to verify (e.g., run the provided
verification command to confirm only expected G117/G704 instances are
suppressed).
2 participants
Exclude G117 (secret field names) and G704 (SSRF) globally in Makefile, and add #nosec annotations for G115, G602, G705, G706.