ci: consolidate release pipeline and add PR security gate (#303)

* ci: consolidate release pipeline into `release.yml`, add PR security gate

* build: exclude `ci/chore/build` commits from goreleaser changelog

* fix: harden config dir perms to  and annotate gosec false positives

* ci: scope release workflow permissions to least privilege

* build: silence hadolint DL3018 on throwaway apk build deps

* docs: fix dead  connectors link

* ci: updating action version

Author: digitalghost-dev

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: Security
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  gosec:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@v2.25.0
+        with:
+          args: '-severity medium -confidence medium ./...'
+
+  bandit:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Run Bandit Security Scanner
+        run: |
+          uv tool run --from 'bandit[toml]' bandit \
+            -r data_platform/pipelines \
+            --severity-level medium \
+            --confidence-level medium

.github/workflows/release.yml

@@ -60,6 +60,9 @@ changelog:
     exclude:
       - "^docs:"
       - "^test:"
+      - "^ci:"
+      - "^chore:"
+      - "^build:"
 
 homebrew_casks:
   - name: poke-cli

.github/workflows/security.yml

@@ -15,6 +15,7 @@ FROM rust:1-alpine AS rust-build
 
 WORKDIR /build
 
+# hadolint ignore=DL3018
 RUN apk add --no-cache build-base
 
 COPY services/Cargo.toml services/Cargo.lock ./services/
@@ -26,6 +27,7 @@ RUN cargo build --release --manifest-path services/Cargo.toml --bin poke-cache
 FROM alpine:3.24
 
 # Installing only necessary packages and remove them after use
+# hadolint ignore=DL3018
 RUN apk add --no-cache shadow && \
     addgroup -S poke_group && adduser -S poke_user -G poke_group && \
     sed -i 's/^root:.*/root:!*:0:0:root:\/root:\/sbin\/nologin/' /etc/passwd && \

.goreleaser.yml

@@ -214,7 +214,7 @@ func runCLI(args []string) int {
 var exit = os.Exit
 
 func isInteractive() bool {
-	return term.IsTerminal(int(os.Stdin.Fd())) && term.IsTerminal(int(os.Stdout.Fd()))
+	return term.IsTerminal(int(os.Stdin.Fd())) && term.IsTerminal(int(os.Stdout.Fd())) // #nosec G115
 }
 
 func saveConfig(cfg flags.Config) {

Dockerfile

@@ -40,7 +40,7 @@ func DamageTable(typesName string, endpoint string) (string, error) {
 	out.WriteString(styling.StyleBold.Render("Damage Chart:"))
 	out.WriteString("\n")
 
-	physicalWidth, _, _ := term.GetSize(uintptr(int(os.Stdout.Fd())))
+	physicalWidth, _, _ := term.GetSize(uintptr(int(os.Stdout.Fd()))) // #nosec G115
 	doc := strings.Builder{}
 
 	// Helper function to build list items

cli.go

@@ -22,13 +22,13 @@ func Open(url string) tea.Cmd {
 		switch runtime.GOOS {
 		case "windows":
 			browserCmd = "cmd"
-			openCmd = exec.Command("cmd", "/c", "start", url) //nolint:gosec
+			openCmd = exec.Command("cmd", "/c", "start", url) // #nosec G204
 		case "darwin":
 			browserCmd = "open"
-			openCmd = exec.Command("open", url)
+			openCmd = exec.Command("open", url) // #nosec G204
 		default:
 			browserCmd = "xdg-open"
-			openCmd = exec.Command("xdg-open", url)
+			openCmd = exec.Command("xdg-open", url) // #nosec G204
 		}
 
 		if _, err := exec.LookPath(browserCmd); err != nil {

cmd/types/damage_table.go

@@ -71,7 +71,7 @@ func cachedFetch(url string) ([]byte, error) {
 		warnNoCache()
 		return directFetch(url)
 	}
-	out, err := exec.Command(path, "get", url).Output()
+	out, err := exec.Command(path, "get", url).Output() // #nosec G204
 	if err != nil {
 		return directFetch(url)
 	}

cmd/utils/web.go

@@ -196,7 +196,7 @@ The above `yml` defines the structure for the raw `series` table from the `stagi
 Soda and its components needed for the project can be installed with `uv`:
 
 1. Install Soda Core with PostgreSQL connector since Supabase uses PostgreSQL.
-   Other [connectors](https://github.com/sodadata/soda-core/blob/main/docs/installation.md#compatibility) can be used.
+   Other [connectors](https://github.com/sodadata/soda-core/blob/v3/docs/installation.md#compatibility) can be used.
 ```shell
    uv add soda-core-postgres
 ```