refactor(ginrouter): extract to a separate module; drop gin from main go.mod #209
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "0 6 * * 1" # weekly Monday 06:00 UTC, catches newly-disclosed CVEs | |
| permissions: | |
| contents: read | |
| security-events: write # needed for gosec SARIF upload | |
| jobs: | |
| govulncheck: | |
| name: govulncheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "stable" | |
| - name: Run govulncheck | |
| run: | | |
| # Pinned, not @latest: govulncheck v1.4.0 (x/tools v0.46.0) panics | |
| # with "ForEachElement called on type containing *types.TypeParam" | |
| # on this codebase's generics under Go 1.26 — a tooling crash, not a | |
| # finding. v1.3.0 (x/tools v0.44.0) predates that SSA refactor and | |
| # scans cleanly. go-version stays `stable` so the toolchain (and its | |
| # stdlib) is always the latest patched release. Revisit when a newer | |
| # govulncheck fixes the panic. | |
| go install golang.org/x/vuln/cmd/govulncheck@v1.3.0 | |
| govulncheck ./... | |
| gosec: | |
| name: gosec | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "stable" | |
| - name: Run gosec | |
| uses: securego/gosec@master | |
| with: | |
| # G104: unchecked Close()/Remove() — noisy and rarely actionable for | |
| # fire-and-forget cleanup paths. | |
| # G204: subprocess launched with variable — every site is a CLI helper | |
| # (nexus dev, nexus add) launching `go run`, `npm`, `open <url>` | |
| # with operator-supplied args. Not server-side input. | |
| # G301/G302/G306: file/dir permission rules — the dep cache under | |
| # ~/.nexus/ needs to be user-writable; tightening these would | |
| # break the tool. CLI-only. | |
| # G304: file inclusion via variable — every site is a dev tool | |
| # reading operator-supplied paths (frontend dir, project root, | |
| # vite config). Server-side framework code never does this. | |
| args: "-no-fail -fmt sarif -out results.sarif -exclude=G104,G204,G301,G302,G304,G306 ./..." | |
| - name: Upload SARIF to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: results.sarif |