Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[2/2] Add Security workflows: GoSec scan workflow #1923

Closed
wants to merge 4 commits into from
Closed

[2/2] Add Security workflows: GoSec scan workflow #1923

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
98210f0
added gosec workflow
Dec 30, 2020
6366583
added nelwine
Dec 30, 2020
0a8d254
run only daily cron and manual trigger
Dec 30, 2020
2f4016a
remove go sum change
Dec 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions .github/workflows/gosec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: Run Gosec
on:
workflow_dispatch:
schedule:
# ┌───────────── minute (0 - 59)
# │ ┌───────────── hour (0 - 23)
# │ │ ┌───────────── day of the month (1 - 31)
# │ │ │ ┌───────────── month (1 - 12 or JAN-DEC)
# │ │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
# │ │ │ │ │
# │ │ │ │ │
# │ │ │ │ │
# * * * * *
- cron: '30 2 * * *'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not running this for every PR?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn’t want it to be a blocker for development for now. This workflow fails when it finds potential issues, some of which may also be false positives. Right now there are a lot of issues that it flags so it would always be failing.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we need to start fixing the issues, otherwise this will be useless. We do have it enabled in the core collector and was not that hard :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where is it enabled in the core collector? I opened this same PR in the core collector repo because I thought it did not exist already. Even in the core collector this GoSec workflow fails because of many issues.

I will also create a new issue to fix GoSec issues if this PR gets merged. I think it would be best to fix the initial set of issues in a separate PR and then enable this for every future PR.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/open-telemetry/opentelemetry-collector/blob/d885cb20e11c5b8c9dafa3251b2591cc8f1f8c82/.golangci.yml

Copy link
Contributor Author

@amanbrar1999 amanbrar1999 Jan 6, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bogdandrutu looks like we restricted gosec to a very small set of rules in the core collector, whereas this workflow uses all rules, hence why I saw many more errors. I will follow up and update this to run the same rules at the core collector and run on PR builds as well

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

small set of rules in the core collector

We disable only 2 rules "G402" and "G404" :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah nevermind, I thought those were the only 2 being used

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please start fixing problems if you want, see #1955 that enables always gosec

jobs:
tests:
runs-on: ubuntu-latest
env:
GO111MODULE: on
steps:
- name: Checkout Source
uses: actions/checkout@v2
- name: Run Gosec Security Scanner
uses: securego/gosec@master
with:
args: ./...