ENG-14840: Ignore harmless sec warnings

[rodolforeitz]

gosec -fmt=sonarqube -exclude-generated -out secreport.json ./...

after

{
	"issues": []
}

before:

{
	"issues": [
		{
			"engineId": "gosec",
			"ruleId": "G304",
			"primaryLocation": {
				"message": "Potential file inclusion via variable",
				"filePath": "parser/pkgpath.go",
				"textRange": {
					"startLine": 114,
					"endLine": 114
				}
			},
			"type": "VULNERABILITY",
			"severity": "MAJOR",
			"effortMinutes": 5
		},
		{
			"engineId": "gosec",
			"ruleId": "G306",
			"primaryLocation": {
				"message": "Expect WriteFile permissions to be 0600 or less",
				"filePath": "bootstrap/bootstrap.go",
				"textRange": {
					"startLine": 215,
					"endLine": 215
				}
			},
			"type": "VULNERABILITY",
			"severity": "MAJOR",
			"effortMinutes": 5
		},
		{
			"engineId": "gosec",
			"ruleId": "G103",
			"primaryLocation": {
				"message": "Use of unsafe calls should be audited",
				"filePath": "jlexer/bytestostr.go",
				"textRange": {
					"startLine": 20,
					"endLine": 20
				}
			},
			"type": "VULNERABILITY",
			"severity": "MINOR",
			"effortMinutes": 5
		},
		{
			"engineId": "gosec",
			"ruleId": "G103",
			"primaryLocation": {
				"message": "Use of unsafe calls should be audited",
				"filePath": "helpers.go",
				"textRange": {
					"startLine": 47,
					"endLine": 47
				}
			},
			"type": "VULNERABILITY",
			"severity": "MINOR",
			"effortMinutes": 5
		},
		{
			"engineId": "gosec",
			"ruleId": "G103",
			"primaryLocation": {
				"message": "Use of unsafe calls should be audited",
				"filePath": "buffer/pool.go",
				"textRange": {
					"startLine": 55,
					"endLine": 55
				}
			},
			"type": "VULNERABILITY",
			"severity": "MINOR",
			"effortMinutes": 5
		},
		{
			"engineId": "gosec",
			"ruleId": "G104",
			"primaryLocation": {
				"message": "Errors unhandled",
				"filePath": "gen/generator.go",
				"textRange": {
					"startLine": 78,
					"endLine": 78
				}
			},
			"type": "VULNERABILITY",
			"severity": "MINOR",
			"effortMinutes": 5
		},
		{
			"engineId": "gosec",
			"ruleId": "G104",
			"primaryLocation": {
				"message": "Errors unhandled",
				"filePath": "bootstrap/bootstrap.go",
				"textRange": {
					"startLine": 199,
					"endLine": 199
				}
			},
			"type": "VULNERABILITY",
			"severity": "MINOR",
			"effortMinutes": 5
		}
	]
}

[yoursnerdly]

Can you please fix the workflow file so it triggers on PR/push to main?

[yoursnerdly]

Suggested change

	return ioutil.WriteFile(g.OutName, out, 0644) // #nosec G306 -- Auto code generation.
	return ioutil.WriteFile(g.OutName, out, 0644) // #nosec G306 -- autogenerated code file, 0644 is fine.

[rodolforeitz]

This file isn't generated, but the generator itself.

[yoursnerdly]

yes, I understand that.

[yoursnerdly]

I meant that the file being written here is autogenerated code file.

[yoursnerdly]

We can delete the step test-non-amd64 as we don't use the library on anything other than amd64. The check is failing and it does not seem worthwhile to invest time in it.

[rodolforeitz]

f2172ee