Fix gosec security alerts #98

Workflow file for this run

	name: CI

	on:
	push:
	branches: [ main, develop ]
	pull_request:
	branches: [ main, develop ]

	env:
	GO_VERSION: '1.25.11'

	jobs:
	lint:
	name: Lint
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: true

	- name: Run golangci-lint
	uses: golangci/golangci-lint-action@v7
	with:
	version: v2.4.0
	args: --timeout=5m

	govulncheck:
	name: govulncheck
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: true

	- name: Run govulncheck
	run: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...

	module-integrity:
	name: Module Integrity
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: true

	- name: Verify dependency checksums
	run: go mod verify

	- name: Check go.mod and go.sum are tidy
	run: \|
	go mod tidy
	git diff --exit-code go.mod go.sum

	test:
	name: Test
	runs-on: ubuntu-latest
	needs: [module-integrity]
	strategy:
	matrix:
	go-version: ['1.25.11']
	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ matrix.go-version }}
	cache: true

	- name: Download dependencies
	run: go mod download

	- name: Run tests with coverage
	run: \|
	go test -v -race -coverprofile=coverage.txt -covermode=atomic ./...
	go tool cover -func=coverage.txt

	- name: Upload coverage reports to Codecov
	if: matrix.go-version == '1.25.11'
	uses: codecov/codecov-action@v5
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	files: ./coverage.txt
	flags: unittests
	name: codecov-go-${{ matrix.go-version }}
	fail_ci_if_error: true
	verbose: true

	build:
	name: Build
	runs-on: ubuntu-latest
	needs: [lint, test, govulncheck]
	strategy:
	matrix:
	os: [ubuntu-latest, macos-latest, windows-latest]
	arch: [amd64, arm64]
	exclude:
	- os: windows-latest
	arch: arm64
	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: true

	- name: Build binary
	env:
	GOOS: ${{ matrix.os == 'ubuntu-latest' && 'linux' \|\| matrix.os == 'macos-latest' && 'darwin' \|\| 'windows' }}
	GOARCH: ${{ matrix.arch }}
	run: \|
	go build -v -o itemize${{ matrix.os == 'windows-latest' && '.exe' \|\| '' }} ./cmd/itemize/

	- name: Upload artifact
	uses: actions/upload-artifact@v5
	with:
	name: binary-${{ matrix.os }}-${{ matrix.arch }}
	path: itemize*

	security:
	name: Security Scan
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	contents: read
	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: true

	- name: Run Gosec Security Scanner
	uses: securego/gosec@v2.26.1
	with:
	args: '-no-fail -fmt sarif -out results.sarif ./...'

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: results.sarif

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@v0.36.0
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'sarif'
	output: 'trivy-results.sarif'

	- name: Upload Trivy results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: 'trivy-results.sarif'

Navigation Menu

Fix gosec security alerts #98

Workflow file

Fix gosec security alerts #98

Uh oh!

Workflow file for this run