From 11fe9f0cada589c44ac9fd50e24c16dd3bfa61fd Mon Sep 17 00:00:00 2001 From: Garrison Davis Date: Wed, 17 Aug 2022 12:43:46 -0600 Subject: [PATCH] Fix gosec-sast job (#2194) We need to install base gosec tool and then the gitlab version to convert the gosec json to the gl-sast-report.json that GitLab expects. This lets us see the 'Security' tab under pipelines (and under the default branch after this change is merged). I chose to pin both of the versions of the tools to avoid any dependencies changing. This could be an issue, but both repos are largely frozen. --- .gitlab/.gitlab-ci.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index 74701278a..79b9e2018 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -4,6 +4,7 @@ include: - template: Security/Dependency-Scanning.gitlab-ci.yml gosec-sast: + allow_failure: false before_script: - export GOPRIVATE=github.com/molecula/* - apk add openssh-client @@ -14,6 +15,13 @@ gosec-sast: - git config --global --add url."ssh://git@github.com/".insteadOf "https://github.com/" - ssh-keygen -F github.com || echo "$SSH_KNOWN_HOSTS_HASHED" >> ~/.ssh/known_hosts - chmod 644 ~/.ssh/known_hosts + script: + ## securego/gosec works for scanning, but not converting to the gitlab report format. + - go install github.com/securego/gosec/v2/cmd/gosec@v2.12.0 + - gosec -fmt=json -out=gosec.json -tests ./... || true + ## gitlab's wrapper for gosec works for converting, but not for scanning. + - go install 'gitlab.com/gitlab-org/security-products/analyzers/gosec@v1.4.0' + - gosec convert gosec.json > gl-sast-report.json variables: GOVERSION: "1.17.8"