Uh oh!
There was an error while loading. Please reload this page.
Suppress G304 on the install id read in the form gosec honors - #391
Conversation
The Go security analysis job has failed on every push to main since the install id landed: gosec v2.28.0 does not honor the nolint comment on this one os.ReadFile, though it does on the same form elsewhere in the repo. Its own #nosec directive with the reason clears it, and the release workflow, which requires that job, can run again.
There was a problem hiding this comment.
🟢 Approval recommended
The targeted comment-only change uses established gosec syntax without affecting runtime behavior.
Pull request overview
Updates the install-ID file read to use gosec’s native suppression syntax, unblocking security CI and releases.
Changes:
- Replaces
//nolint:gosecwith// #nosec G304while retaining the justification.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
internal/auth/install_id.go | Uses the suppression format honored by gosec v2.28.0. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
No issues found across 1 file
You’re at about 97% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.
Uh oh!
There was an error while loading. Please reload this page.
The "Go security analysis" job in the security workflow has failed on every push to main since the install id landed in #355 (six runs), and the release workflow requires it, so no release can ship until it is green.
The finding is G304 on
os.ReadFile(path)ininternal/auth/install_id.go. The line already carries//nolint:gosec // G304: …, the form used on forty other lines in this repo, and gosec v2.28.0 honors it everywhere except here. I do not have an explanation for the difference. Switching this one line to gosec's own// #nosec G304 -- reasonclears it: gosec exits 0 on the package and golangci-lint still reports 0 issues.Unblocks the v1.4.0 release.