From 7f7fedad34bf5f4a91969275a76f77cf8e930acb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 4 Mar 2026 03:27:27 +0000 Subject: [PATCH 1/2] Bump aquasecurity/trivy-action from 0.34.1 to 0.34.2 Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.34.1 to 0.34.2. - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/e368e328979b113139d6f9068e03accaed98a518...97e0b3872f55f89b95b2f65b3dbab56962816478) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-version: 0.34.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 2f131ff..32e9704 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -29,7 +29,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1 + uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 with: scan-type: 'fs' ignore-unfixed: true From de2c73175d584f12269e2ed1f1261837713267a3 Mon Sep 17 00:00:00 2001 From: Alexander Adam Date: Wed, 4 Mar 2026 04:50:15 +0100 Subject: [PATCH 2/2] Add golangci-lint job, enhance Trivy and govulncheck workflows - Introduced a new `GolangCI` job for linting using `golangci-lint`. - Updated `Trivy` job to include `HIGH` severity findings. - Improved `govulncheck` workflow with optimized logic and naming fixes. - Adjusted permissions and hardened runner configurations across jobs. - Fixed linter findings. Signed-off-by: Alexander Adam --- .github/workflows/security.yml | 55 +++++++++++++------ example/example_test.go | 2 +- handler/basicauth/basic_auth_test.go | 2 +- .../htpasswdauth/htpasswd_auth_test.go | 2 +- handler/basicauth/mapauth/map_auth.go | 6 +- handler/basicauth/mapauth/map_auth_test.go | 2 +- 6 files changed, 46 insertions(+), 23 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 32e9704..0df4ab4 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -11,13 +11,41 @@ on: branches: - master -# Declare default permissions as read only. +# Declare default permissions as read-only. permissions: read-all jobs: + GolangCI: + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Harden Runner + uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0 + with: + egress-policy: audit + + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + fetch-depth: 1 + + - name: Run golangci-lint + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 + with: + version: latest + args: --timeout=5m --output.sarif.path=golangci-lint-results.sarif --output.text.path=stdout + + - name: Upload golangci-lint results to GitHub Security tab + uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 + with: + sarif_file: golangci-lint-results.sarif + TrivyCode: runs-on: ubuntu-latest permissions: + contents: read security-events: write steps: - name: Harden Runner @@ -28,14 +56,14 @@ jobs: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Run Trivy vulnerability scanner in repo mode + - name: Run Trivy vulnerability scanner in fs mode uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2 with: scan-type: 'fs' ignore-unfixed: true format: 'sarif' output: 'trivy-results.sarif' - severity: 'CRITICAL' + severity: 'CRITICAL,HIGH' - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 @@ -46,9 +74,10 @@ jobs: strategy: matrix: go-version: - - stable + - "stable" runs-on: ubuntu-latest permissions: + contents: read security-events: write steps: - name: Harden Runner @@ -56,33 +85,27 @@ jobs: with: egress-policy: audit - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 1 - - - name: VulnerabilityCheck + - name: Vulnerability Check uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4 with: - repo-checkout: false go-version-input: ${{matrix.go-version}} output-format: sarif output-file: govulncheck-results.sarif - - name: PrintSarif - id: PrintSarif + - name: Print Sarif + id: printSarif run: | cat govulncheck-results.sarif - if grep "'results'" govulncheck-results.sarif + if grep results govulncheck-results.sarif then echo "hasResults=true" >> $GITHUB_OUTPUT else echo "hasResults=false" >> $GITHUB_OUTPUT fi - - name: Upload govolncheck results to GitHub Security tab - if: ${{ steps.PrintSarif.outputs.hasResults == 'true' }} + - name: Upload govulncheck results to Security tab + if: ${{ steps.printSarif.outputs.hasResults == 'true' }} uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5 with: sarif_file: govulncheck-results.sarif diff --git a/example/example_test.go b/example/example_test.go index d0b2102..c2e486d 100644 --- a/example/example_test.go +++ b/example/example_test.go @@ -23,7 +23,7 @@ func TestExampleMain(t *testing.T) { req.Header.Add("Origin", "localhost") - res, resErr := http.DefaultClient.Do(req) + res, resErr := http.DefaultClient.Do(req) //nolint:gosec // all inputs are fixed, this is a test if resErr != nil { t.Errorf("got error for hello test page: %v", resErr) diff --git a/handler/basicauth/basic_auth_test.go b/handler/basicauth/basic_auth_test.go index 67f8b5a..0111733 100644 --- a/handler/basicauth/basic_auth_test.go +++ b/handler/basicauth/basic_auth_test.go @@ -33,7 +33,7 @@ func TestBasicAuth(t *testing.T) { tests := []struct { User string - Pass string + Pass string //nolint:gosec WantState int }{ { diff --git a/handler/basicauth/htpasswdauth/htpasswd_auth_test.go b/handler/basicauth/htpasswdauth/htpasswd_auth_test.go index c3eaf6b..780ab7b 100644 --- a/handler/basicauth/htpasswdauth/htpasswd_auth_test.go +++ b/handler/basicauth/htpasswdauth/htpasswd_auth_test.go @@ -17,7 +17,7 @@ func TestHtpasswdAuth(t *testing.T) { tests := []struct { Username string - Password string + Password string //nolint:gosec Valid bool }{ { diff --git a/handler/basicauth/mapauth/map_auth.go b/handler/basicauth/mapauth/map_auth.go index 9d3422f..3714d82 100644 --- a/handler/basicauth/mapauth/map_auth.go +++ b/handler/basicauth/mapauth/map_auth.go @@ -4,6 +4,8 @@ // Package mapauth implements the basic auth functionality using a user-pass-map. package mapauth +import "maps" + import "errors" // ErrNoAuthorizations is returned when no authorizations are configured. @@ -46,9 +48,7 @@ func WithAuths(auths map[string]string) func(a *MapAuthenticator) error { a.auths = make(map[string]string, len(auths)) } - for k, v := range auths { - a.auths[k] = v - } + maps.Copy(a.auths, auths) return nil } diff --git a/handler/basicauth/mapauth/map_auth_test.go b/handler/basicauth/mapauth/map_auth_test.go index 395fd88..44f3314 100644 --- a/handler/basicauth/mapauth/map_auth_test.go +++ b/handler/basicauth/mapauth/map_auth_test.go @@ -17,7 +17,7 @@ func TestMapAuthenticator(t *testing.T) { tests := []struct { Auths map[string]string User string - Pass string + Pass string //nolint:gosec WantNewErr bool Want bool WantError bool