mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-18 08:36:13 +00:00
Tobias Gesellchen
7da18d3a8c
- Replace gosec with govulncheck (official Go vulnerability scanner) - Add dedicated security.yml workflow with multiple tools: - govulncheck: Official Go team vulnerability scanner - Nancy: Sonatype dependency vulnerability scanner - Staticcheck: Go static analysis with security checks - Semgrep: Multi-language security scanner - CodeQL: GitHub semantic security analysis - Dependency Review: Automated dependency vulnerability checking - Update golangci-lint config to temporarily disable gosec - Add CodeQL configuration for enhanced Go security analysis - Separate fast CI checks from comprehensive security scanning - Schedule daily security scans at 2 AM UTC - Integrate with GitHub Security tab via SARIF reports
75 lines
2.0 KiB
YAML
75 lines
2.0 KiB
YAML
# CodeQL configuration for enhanced security analysis
|
|
# See: https://docs.github.com/en/code-security/codeql-cli/using-the-codeql-cli/creating-codeql-query-suites
|
|
|
|
name: "Go Security Analysis"
|
|
|
|
disable-default-queries: false
|
|
|
|
queries:
|
|
# Include default security queries
|
|
- uses: security-extended
|
|
- uses: security-and-quality
|
|
|
|
# Additional Go-specific security queries
|
|
- name: go-security-extra
|
|
uses:
|
|
- go/bad-redirect-check
|
|
- go/clear-text-logging
|
|
- go/incorrect-integer-conversion
|
|
- go/log-injection
|
|
- go/missing-regexp-anchor
|
|
- go/path-injection
|
|
- go/request-forgery
|
|
- go/sensitive-package-import
|
|
- go/sql-injection
|
|
- go/uncontrolled-allocation-size
|
|
- go/unsafe-quoting
|
|
- go/useless-regexp-character-escape
|
|
- go/zip-slip
|
|
|
|
# Configure paths to exclude from analysis
|
|
paths-ignore:
|
|
- "**/*.pb.go" # Generated protobuf files
|
|
- "**/*_gen.go" # Generated code
|
|
- "**/vendor/**" # Vendor dependencies
|
|
- "**/build/**" # Build artifacts
|
|
- "**/scripts/**" # Build scripts
|
|
- "**/*_test.go" # Test files (optional - remove if you want to analyze tests)
|
|
|
|
# Configure paths to include (if not specified, all Go files are included)
|
|
paths:
|
|
- "cmd/**/*.go"
|
|
- "pkg/**/*.go"
|
|
- "*.go"
|
|
|
|
# Query filters to reduce noise
|
|
query-filters:
|
|
- exclude:
|
|
id: go/unused-variable
|
|
reason: "Can be noisy in development"
|
|
- exclude:
|
|
id: go/hardcoded-credentials
|
|
reason: "Will be handled by separate secret scanning"
|
|
|
|
# Configuration for specific query packs
|
|
packs:
|
|
# Use the official CodeQL Go queries
|
|
- codeql/go-queries
|
|
|
|
# Additional community query packs for enhanced security
|
|
- codeql/go-queries@~0.0.0 # Latest version
|
|
|
|
# Custom configuration for specific queries
|
|
query-config:
|
|
go/path-injection:
|
|
# Configure severity levels
|
|
severity: "error"
|
|
go/sql-injection:
|
|
severity: "error"
|
|
go/request-forgery:
|
|
severity: "warning"
|
|
go/log-injection:
|
|
severity: "warning"
|
|
go/clear-text-logging:
|
|
severity: "note"
|