gosec.yaml

---
name: Go Test on Pull Requests
on:  # yamllint disable-line rule:truthy
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
    paths:
      - '**.go'
  workflow_dispatch:
  merge_group:
    types: [checks_requested]
jobs:
  gosec:
    name: Check GO security
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 1
          ref: ${{ github.sha }}
      - name: Run Gosec Security Scanner
        id: gosec
        uses: securego/gosec@11023e51e1f46c4ea63315bdb7670f073442168f # master
        with:
          args: -exclude-generated ./...
        env:
          GOROOT: ""
        continue-on-error: true
      - name: Run Gosec Security Scanner - save SARIF
        id: gosec-sarif
        uses: securego/gosec@11023e51e1f46c4ea63315bdb7670f073442168f # master
        with:
          # we let the report trigger a failure using the GitHub Security features.
          args: -exclude-generated -fmt sarif -out results.sarif ./...
        env:
          GOROOT: ""
        continue-on-error: true
      - name: Upload SARIF file
        if: github.event_name != 'merge_group'
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: results.sarif
      - name: Check gosec result
        run: |
          if [ "${{ steps.gosec-sarif.outcome }}" != "success" ]
          then
            echo "Gosec failed. The errors and warnings should be displayed in the PR."
            exit 1
          fi