From da334d68fda5d7ce3e72b63bdb879223cc83d11e Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 16 Oct 2026 22:38:25 +0200 Subject: [PATCH] ci: document how the embedded gosec policy differs from the standalone gate The standalone gate (scripts/run-gosec.sh, v2.28.0, used by CI, pre-commit and Make) runs all rules at all severities with no config and skips test files by default. The embedded golangci gosec excludes G104, requires medium severity and confidence, drops G301/G302/G304 via the legacy and common-false-positives presets, and excludes _test.go. Both honor #nosec. Fixture (scratch module, golangci-lint v2.10.1 vs gosec v2.28.0): - golangci: G501 main.go:4, G401 main.go:14, G115 main.go:16 - standalone: the same three plus G304 :17, G302 :21, G301 :22 and G104 :10/:22; the #nosec G304 line was suppressed in both; the _test.go file was not reported by either. The embedded set is a strict subset, so no config changes: the standalone gate is not loosened and golangci is not tightened. Only a comment is added next to the gosec settings. Closes #2152 Co-Authored-By: Claude Opus 5.5 --- .golangci.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.golangci.yml b/.golangci.yml index 8362af4b2..8f12e375a 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -41,6 +41,13 @@ linters: sizeThreshold: 1024 gocyclo: min-complexity: 10 + # gosec here is a code-hygiene signal, narrower than the enforcing gate + # scripts/run-gosec.sh (CI, pre-commit, Make; all rules, all severities, + # no config file, #nosec honored). Here G104 is excluded, severity and + # confidence are medium+, and the legacy/common-false-positives presets + # drop G301/G302/G304; gosec is also skipped in _test.go (the standalone + # scan omits tests by default). A clean golangci run does not imply a + # clean gosec run. gosec: excludes: - G104