addind security scans

Author: KT-Doan

.github/workflows/security.yml

@@ -10,13 +10,11 @@ on:
 
 permissions:
   contents: read
-  security-events: write
-  actions: read
 
 jobs:
-  # Static Application Security Testing (SAST) - CodeQL
-  codeql:
-    name: CodeQL Analysis
+  # Static Application Security Testing (SAST) - gosec
+  gosec:
+    name: Go Security Check
     runs-on: ubuntu-slim
     steps:
       - name: Checkout
@@ -28,18 +26,11 @@ jobs:
           go-version-file: 'go.mod'
           cache: true
 
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: go
-
-      - name: Build
-        run: go build ./...
+      - name: Install gosec
+        run: go install github.com/securego/gosec/v2/cmd/gosec@latest
 
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:go"
+      - name: Run gosec
+        run: gosec ./...
 
   # Software Composition Analysis (SCA) - Go vulnerability check
   govulncheck:
@@ -102,20 +93,14 @@ jobs:
         with:
           scan-type: 'fs'
           scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
+          format: 'table'
+          exit-code: '1'
           severity: 'CRITICAL,HIGH'
           scanners: 'vuln,secret,misconfig'
         env:
           TRIVY_SKIP_JAVA_DB_UPDATE: 'true'
           TRIVY_DISABLE_VEX_NOTICE: 'true'
 
-      - name: Upload Trivy scan results
-        uses: github/codeql-action/upload-sarif@v3
-        if: always()
-        with:
-          sarif_file: 'trivy-results.sarif'
-
   # Dependency license compliance
   licenses:
     name: License Check

go.mod

@@ -1,11 +1,12 @@
 module github.com/ory/terraform-provider-orynetwork
 
-go 1.24.1
+go 1.24.11
 
 require (
 	github.com/hashicorp/terraform-plugin-framework v1.16.1
 	github.com/hashicorp/terraform-plugin-framework-validators v0.19.0
 	github.com/hashicorp/terraform-plugin-go v0.29.0
+	github.com/hashicorp/terraform-plugin-log v0.9.0
 	github.com/hashicorp/terraform-plugin-testing v1.13.3
 	github.com/ory/client-go v1.22.12
 	github.com/ory/x v0.0.729
@@ -44,7 +45,6 @@ require (
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-exec v0.23.0 // indirect
 	github.com/hashicorp/terraform-json v0.25.0 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 // indirect
 	github.com/hashicorp/terraform-registry-address v0.4.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect