scriptoriumadmin/featurebase
1
0
Fork 0
mirror of https://github.com/featurebasedb/featurebase.git synced 2026-09-15 16:51:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix gosec-sast job (#2194)

Browse source 
We need to install base gosec tool and then the gitlab version to convert the gosec
json to the gl-sast-report.json that GitLab expects.

This lets us see the 'Security' tab under pipelines (and under the default branch
after this change is merged).

I chose to pin both of the versions of the tools to avoid any dependencies changing.
This could be an issue, but both repos are largely frozen.
This commit is contained in:
Garrison Davis 2022-08-17 12:43:46 -06:00 • committed by GitHub
parent a183357d65
commit 11fe9f0cad
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
.gitlab/.gitlab-ci.yml
View file

@ -4,6 +4,7 @@ include:
- template: Security/Dependency-Scanning.gitlab-ci.yml
gosec-sast:
allow_failure: false
before_script:
- export GOPRIVATE=github.com/molecula/*
- apk add openssh-client
@ -14,6 +15,13 @@ gosec-sast:
- git config --global --add url."ssh://git@github.com/".insteadOf "https://github.com/"
- ssh-keygen -F github.com || echo "$SSH_KNOWN_HOSTS_HASHED" >> ~/.ssh/known_hosts
- chmod 644 ~/.ssh/known_hosts
script:
## securego/gosec works for scanning, but not converting to the gitlab report format.
- go install github.com/securego/gosec/v2/cmd/gosec@v2.12.0
- gosec -fmt=json -out=gosec.json -tests ./... || true
## gitlab's wrapper for gosec works for converting, but not for scanning.
- go install 'gitlab.com/gitlab-org/security-products/analyzers/gosec@v1.4.0'
- gosec convert gosec.json > gl-sast-report.json
variables:
GOVERSION: "1.17.8"