Replace unavailable gosec with comprehensive security scanning

- Replace gosec with govulncheck (official Go vulnerability scanner) - Add dedicated security.yml workflow with multiple tools: - govulncheck: Official Go team vulnerability scanner - Nancy: Sonatype dependency vulnerability scanner - Staticcheck: Go static analysis with security checks - Semgrep: Multi-language security scanner - CodeQL: GitHub semantic security analysis - Dependency Review: Automated dependency vulnerability checking - Update golangci-lint config to temporarily disable gosec - Add CodeQL configuration for enhanced Go security analysis - Separate fast CI checks from comprehensive security scanning - Schedule daily security scans at 2 AM UTC - Integrate with GitHub Security tab via SARIF reports
2026-08-24 14:47:23 +00:00 · 2026-01-09 13:27:06 +01:00
parent 75aa9cf03e
commit 7da18d3a8c
4 changed files with 312 additions and 65 deletions
@@ -0,0 +1,74 @@
+# CodeQL configuration for enhanced security analysis
+# See: https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/creating-codeql-query-suites
+
+name: "Go Security Analysis"
+
+disable-default-queries: false
+
+queries:
+  # Include default security queries
+  - uses: security-extended
+  - uses: security-and-quality
+
+  # Additional Go-specific security queries
+  - name: go-security-extra
+    uses:
+      - go/bad-redirect-check
+      - go/clear-text-logging
+      - go/incorrect-integer-conversion
+      - go/log-injection
+      - go/missing-regexp-anchor
+      - go/path-injection
+      - go/request-forgery
+      - go/sensitive-package-import
+      - go/sql-injection
+      - go/uncontrolled-allocation-size
+      - go/unsafe-quoting
+      - go/useless-regexp-character-escape
+      - go/zip-slip
+
+# Configure paths to exclude from analysis
+paths-ignore:
+  - "**/*.pb.go"          # Generated protobuf files
+  - "**/*_gen.go"         # Generated code
+  - "**/vendor/**"        # Vendor dependencies
+  - "**/build/**"         # Build artifacts
+  - "**/scripts/**"       # Build scripts
+  - "**/*_test.go"        # Test files (optional - remove if you want to analyze tests)
+
+# Configure paths to include (if not specified, all Go files are included)
+paths:
+  - "cmd/**/*.go"
+  - "pkg/**/*.go"
+  - "*.go"
+
+# Query filters to reduce noise
+query-filters:
+  - exclude:
+      id: go/unused-variable
+      reason: "Can be noisy in development"
+  - exclude:
+      id: go/hardcoded-credentials
+      reason: "Will be handled by separate secret scanning"
+
+# Configuration for specific query packs
+packs:
+  # Use the official CodeQL Go queries
+  - codeql/go-queries
+
+  # Additional community query packs for enhanced security
+  - codeql/go-queries@~0.0.0  # Latest version
+
+# Custom configuration for specific queries
+query-config:
+  go/path-injection:
+    # Configure severity levels
+    severity: "error"
+  go/sql-injection:
+    severity: "error"
+  go/request-forgery:
+    severity: "warning"
+  go/log-injection:
+    severity: "warning"
+  go/clear-text-logging:
+    severity: "note"
@@ -106,7 +106,7 @@ jobs:
          path: soundtouch-cli-*

  security:
-    name: Security Scan
+    name: Basic Security Check
    runs-on: ubuntu-latest

    steps:
@@ -118,16 +118,16 @@ jobs:
        with:
          go-version-file: "go.mod"

-      - name: Install Gosec
-        run: go install github.com/securecodewarrior/gosec/v2/cmd/gosec@latest
-
-      - name: Run Gosec Security Scanner
-        run: gosec ./...
-
-      - name: Run Nancy vulnerability scanner
+      - name: Run basic vulnerability check
        run: |
-          go install github.com/sonatypecommunity/nancy@latest
-          go list -json -deps ./... | nancy sleuth
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+      - name: Security scan reminder
+        run: |
+          echo "ℹ️ This is a basic security check for CI speed."
+          echo "For comprehensive security scanning, see the Security workflow:"
+          echo "https://github.com/${{ github.repository }}/actions/workflows/security.yml"

  docs:
    name: Documentation Check
@@ -0,0 +1,172 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run security scans daily at 2 AM UTC
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+
+jobs:
+  vulnerability-scan:
+    name: Vulnerability Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
+
+      - name: Install security scanning tools
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          go install github.com/sonatypecommunity/nancy@latest
+
+      - name: Run govulncheck (Official Go vulnerability scanner)
+        run: |
+          echo "::group::Running govulncheck"
+          govulncheck ./...
+          echo "::endgroup::"
+
+      - name: Run Nancy vulnerability scanner
+        run: |
+          echo "::group::Running Nancy dependency scanner"
+          go list -json -deps ./... | nancy sleuth
+          echo "::endgroup::"
+
+      - name: Upload vulnerability scan results
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: vulnerability-scan-results
+          path: |
+            vulnerability-report.json
+            nancy-report.json
+
+  static-analysis:
+    name: Static Security Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
+
+      - name: Install static analysis tools
+        run: |
+          go install honnef.co/go/tools/cmd/staticcheck@latest
+
+      - name: Run staticcheck security analysis
+        run: |
+          echo "::group::Running staticcheck"
+          staticcheck ./...
+          echo "::endgroup::"
+
+      - name: Run Semgrep security analysis
+        uses: semgrep/semgrep-action@v1
+        with:
+          config: >-
+            p/security-audit
+            p/secrets
+            p/golang
+          generateSarif: "1"
+        continue-on-error: true
+
+      - name: Upload Semgrep SARIF results
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: semgrep.sarif
+        continue-on-error: true
+
+  codeql-analysis:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+          config-file: ./.github/codeql-config.yml
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:go"
+
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: moderate
+          allow-ghsas: GHSA-xxxx-xxxx-xxxx  # Add specific allowlisted advisories if needed
+          deny-licenses: GPL-2.0, LGPL-2.0  # Add licenses to deny if needed
+
+  security-summary:
+    name: Security Summary
+    runs-on: ubuntu-latest
+    needs: [vulnerability-scan, static-analysis, codeql-analysis]
+    if: always()
+
+    steps:
+      - name: Security scan summary
+        run: |
+          echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [[ "${{ needs.vulnerability-scan.result }}" == "success" ]]; then
+            echo "✅ **Vulnerability Scan**: PASSED" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "❌ **Vulnerability Scan**: FAILED" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if [[ "${{ needs.static-analysis.result }}" == "success" ]]; then
+            echo "✅ **Static Analysis**: PASSED" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "❌ **Static Analysis**: FAILED" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if [[ "${{ needs.codeql-analysis.result }}" == "success" ]]; then
+            echo "✅ **CodeQL Analysis**: PASSED" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "❌ **CodeQL Analysis**: FAILED" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "For detailed results, check the individual job logs above." >> $GITHUB_STEP_SUMMARY
+
+      - name: Fail on security issues
+        if: needs.vulnerability-scan.result == 'failure' || needs.static-analysis.result == 'failure' || needs.codeql-analysis.result == 'failure'
+        run: |
+          echo "Security scan detected issues. Please review the results above."
+          exit 1