Add golangci-lint job, enhance Trivy and govulncheck workflows

- Introduced a new `GolangCI` job for linting using `golangci-lint`.
- Updated `Trivy` job to include `HIGH` severity findings.
- Improved `govulncheck` workflow with optimized logic and naming fixes.
- Adjusted permissions and hardened runner configurations across jobs.
- Fixed linter findings.

Signed-off-by: Alexander Adam <alphaone23@gmail.com>

Author: AlphaOne1

.github/workflows/security.yml

@@ -11,13 +11,41 @@ on:
         branches:
           - master
 
-# Declare default permissions as read only.
+# Declare default permissions as read-only.
 permissions: read-all
 
 jobs:
+    GolangCI:
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            security-events: write
+        steps:
+          - name: Harden Runner
+            uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+            with:
+                egress-policy: audit
+
+          - name: Checkout
+            uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            with:
+                fetch-depth: 1
+
+          - name: Run golangci-lint
+            uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+            with:
+                version: latest
+                args: --timeout=5m --output.sarif.path=golangci-lint-results.sarif --output.text.path=stdout
+
+          - name: Upload golangci-lint results to GitHub Security tab
+            uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
+            with:
+                sarif_file: golangci-lint-results.sarif
+
     TrivyCode:
         runs-on: ubuntu-latest
         permissions:
+            contents: read
             security-events: write
         steps:
           - name: Harden Runner
@@ -28,14 +56,14 @@ jobs:
           - name: Checkout code
             uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-          - name: Run Trivy vulnerability scanner in repo mode
+          - name: Run Trivy vulnerability scanner in fs mode
             uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2
             with:
                 scan-type: 'fs'
                 ignore-unfixed: true
                 format: 'sarif'
                 output: 'trivy-results.sarif'
-                severity: 'CRITICAL'
+                severity: 'CRITICAL,HIGH'
 
           - name: Upload Trivy scan results to GitHub Security tab
             uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
@@ -46,43 +74,38 @@ jobs:
         strategy:
             matrix:
                 go-version:
-                  - stable
+                  - "stable"
         runs-on: ubuntu-latest
         permissions:
+            contents: read
             security-events: write
         steps:
           - name: Harden Runner
             uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
             with:
                 egress-policy: audit
 
-          - name: Checkout
-            uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-            with:
-                fetch-depth: 1
-
-          - name: VulnerabilityCheck
+          - name: Vulnerability Check
             uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
             with:
-                repo-checkout: false
                 go-version-input: ${{matrix.go-version}}
                 output-format: sarif
                 output-file: govulncheck-results.sarif
 
-          - name: PrintSarif
-            id: PrintSarif
+          - name: Print Sarif
+            id: printSarif
             run:  |
                 cat govulncheck-results.sarif
 
-                if grep "'results'" govulncheck-results.sarif
+                if grep results govulncheck-results.sarif
                 then
                     echo "hasResults=true" >> $GITHUB_OUTPUT
                 else
                     echo "hasResults=false" >> $GITHUB_OUTPUT
                 fi
 
-          - name: Upload govolncheck results to GitHub Security tab
-            if: ${{ steps.PrintSarif.outputs.hasResults == 'true' }}
+          - name: Upload govulncheck results to Security tab
+            if: ${{ steps.printSarif.outputs.hasResults == 'true' }}
             uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
             with:
                 sarif_file: govulncheck-results.sarif

example/example_test.go

@@ -23,7 +23,7 @@ func TestExampleMain(t *testing.T) {
 
 	req.Header.Add("Origin", "localhost")
 
-	res, resErr := http.DefaultClient.Do(req)
+	res, resErr := http.DefaultClient.Do(req) //nolint:gosec // all inputs are fixed, this is a test
 
 	if resErr != nil {
 		t.Errorf("got error for hello test page: %v", resErr)

handler/basicauth/basic_auth_test.go

@@ -33,7 +33,7 @@ func TestBasicAuth(t *testing.T) {
 
 	tests := []struct {
 		User      string
-		Pass      string
+		Pass      string //nolint:gosec
 		WantState int
 	}{
 		{

handler/basicauth/htpasswdauth/htpasswd_auth_test.go

@@ -17,7 +17,7 @@ func TestHtpasswdAuth(t *testing.T) {
 
 	tests := []struct {
 		Username string
-		Password string
+		Password string //nolint:gosec
 		Valid    bool
 	}{
 		{

handler/basicauth/mapauth/map_auth.go

@@ -4,6 +4,8 @@
 // Package mapauth implements the basic auth functionality using a user-pass-map.
 package mapauth
 
+import "maps"
+
 import "errors"
 
 // ErrNoAuthorizations is returned when no authorizations are configured.
@@ -46,9 +48,7 @@ func WithAuths(auths map[string]string) func(a *MapAuthenticator) error {
 			a.auths = make(map[string]string, len(auths))
 		}
 
-		for k, v := range auths {
-			a.auths[k] = v
-		}
+		maps.Copy(a.auths, auths)
 
 		return nil
 	}

handler/basicauth/mapauth/map_auth_test.go

@@ -17,7 +17,7 @@ func TestMapAuthenticator(t *testing.T) {
 	tests := []struct {
 		Auths      map[string]string
 		User       string
-		Pass       string
+		Pass       string //nolint:gosec
 		WantNewErr bool
 		Want       bool
 		WantError  bool