Skip to content

ci: run real gosec SARIF instead of hardcoded empty results #112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sirantd merged 1 commit into from
May 31, 2026
Merged

ci: run real gosec SARIF instead of hardcoded empty results #112

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 5 additions & 15 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,28 +79,18 @@ jobs:
with:
go-version: ${{ env.GO_VERSION }}

- name: Run Static Analysis Security Scanner
run: |
echo "Installing reliable static analysis tools..."
go install honnef.co/go/tools/cmd/staticcheck@latest
go install golang.org/x/vuln/cmd/govulncheck@latest

echo "Running staticcheck for code quality analysis..."
staticcheck -f json ./... > staticcheck-results.json || true

echo "Running govulncheck for vulnerability scanning..."
govulncheck -json ./... > govulncheck-results.json || true

echo "Creating SARIF output for GitHub Security tab..."
echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"ci-static-analysis","version":"1.0.0"}},"results":[]}]}' > gosec.sarif
- name: Install gosec
run: go install github.com/securego/gosec/v2/cmd/gosec@latest

echo "Static analysis completed successfully"
- name: Run gosec security scanner
run: gosec -no-fail -fmt sarif -out gosec.sarif ./...

- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@v4
if: always() && hashFiles('gosec.sarif') != ''
with:
sarif_file: gosec.sarif
category: gosec

# Build and test
test:
Expand Down
36 changes: 6 additions & 30 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,42 +249,18 @@ jobs:
git config --global url."https://github.com/".insteadOf "git@github.com:"
git config --global url."https://".insteadOf "git://"

- name: Install Static Analysis Tools
run: |
echo "Go version: $(go version)"
echo "GOPATH: $(go env GOPATH)"
echo "GOPROXY: $(go env GOPROXY)"

# Install reliable static analysis tools that work with Go 1.24
echo "Installing staticcheck..."
go install honnef.co/go/tools/cmd/staticcheck@latest

echo "Installing govulncheck..."
go install golang.org/x/vuln/cmd/govulncheck@latest

- name: Run Static Analysis
run: |
echo "Running static analysis tools..."

# Run staticcheck for code quality issues
echo "Running staticcheck..."
staticcheck -f json ./... > staticcheck-results.json || true

# Run govulncheck for vulnerability scanning
echo "Running govulncheck..."
govulncheck -json ./... > govulncheck-results.json || true

# Create a basic SARIF file from the results
echo "Creating SARIF output..."
echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"static-analysis-suite","version":"1.0.0","informationUri":"https://github.com/perun-engineering/deployment-annotator-for-grafana","rules":[]}},"results":[]}]}' > gosec-results.sarif
- name: Install gosec
run: go install github.com/securego/gosec/v2/cmd/gosec@latest

echo "Static analysis completed successfully"
- name: Run gosec
run: gosec -no-fail -fmt sarif -out gosec-results.sarif ./...

- name: Upload Static Analysis results
- name: Upload gosec results
uses: github/codeql-action/upload-sarif@v4
if: always() && hashFiles('gosec-results.sarif') != ''
with:
sarif_file: gosec-results.sarif
category: gosec

- name: Install Semgrep
run: python3 -m pip install semgrep
Expand Down
Loading