fix(apple): silence gosec G101 false positive on public issuer URL

Author: paskal

provider/apple.go

@@ -553,7 +553,7 @@ func (ah AppleHandler) makeRedirURL(path string) string {
 
 // appleIDTokenIssuer is the issuer Apple sets on every id_token issued by Sign in with Apple.
 // see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user
-const appleIDTokenIssuer = "https://appleid.apple.com"
+const appleIDTokenIssuer = "https://appleid.apple.com" // #nosec G101 -- public Apple issuer URL, not a credential
 
 // validateAppleIDClaims checks that the id_token claims have the expected Apple
 // issuer and that the audience matches the relying party's client ID. The signature

v2/provider/apple.go

@@ -558,7 +558,7 @@ func (ah AppleHandler) makeRedirURL(path string) string {
 
 // appleIDTokenIssuer is the issuer Apple sets on every id_token issued by Sign in with Apple.
 // see https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user
-const appleIDTokenIssuer = "https://appleid.apple.com"
+const appleIDTokenIssuer = "https://appleid.apple.com" // #nosec G101 -- public Apple issuer URL, not a credential
 
 // validateAppleIDClaims checks that the id_token claims have the expected Apple
 // issuer and that the audience matches the relying party's client ID. The signature