gosec.yaml

---
name: Go Test on Pull Requests
on:  # yamllint disable-line rule:truthy
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
    paths:
      - '**.go'
  workflow_dispatch:
jobs:
  gosec:
    name: Check GO security
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
        with:
          fetch-depth: 1
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Run Gosec Security Scanner
        id: gosec
        uses: securego/gosec@35f7ec2ca2e35fb91f7684b376a58e0c61f6c2a3 # master
        with:
          args: -exclude-generated ./...
        env:
          GOROOT: ""
        continue-on-error: true
      - name: Run Gosec Security Scanner - save SARIF
        id: gosec-sarif
        uses: securego/gosec@35f7ec2ca2e35fb91f7684b376a58e0c61f6c2a3 # master
        with:
          # we let the report trigger a failure using the GitHub Security features.
          args: -exclude-generated -fmt sarif -out results.sarif ./...
        env:
          GOROOT: ""
        continue-on-error: true
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3
        with:
          sarif_file: results.sarif
      - name: Check gosec result
        run: |
          if [ "${{ steps.gosec-sarif.outcome }}" != "success" ]
          then
            echo "Gosec failed. The errors and warnings should be displayed in the PR."
            exit 1
          fi