From 6563d6757265751806ca0d5221888bb13c1d5dc8 Mon Sep 17 00:00:00 2001 From: korya <148461+korya@users.noreply.github.com> Date: Sun, 30 Aug 2026 22:26:10 -0400 Subject: [PATCH] chore(ci): Run gosec through its GitHub Action Use gosec's maintained action instead of compiling the scanner during every CI run. Keep the remaining repository checks in the existing job after the dedicated security scan. Co-Authored-By: OpenAI Codex (GPT-5) --- .github/workflows/build.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 71646ab..f239bd6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -55,11 +55,13 @@ jobs: # configuration. Without this the linter runs twice per build. install-only: true - - name: Install gosec - run: go install github.com/securego/gosec/v2/cmd/gosec@latest + - name: Run gosec + uses: securego/gosec@master + with: + args: ./... - - name: Run the static checks - run: just static-checks + - name: Run the remaining static checks + run: just build tidy-check lint-config-check vet lint # The tool ships for five platforms, and it is less OS-neutral than it looks: # socket timeout behaviour, colon parsing around IPv6 literals, printable-rune