Add workflow to run security scan for gama's github repository #22
Comments
canack
added
improvement
This commit introduces a new GitHub Actions workflow to run 'govulncheck' for security scanning of Go modules. The workflow will automatically scan for known vulnerabilities and enhance the security posture of the repository. References: - Go Vulnerability Management: https://go.dev/blog/vuln - Related Issue: termkit#22 Signed-off-by: atilsensalduz <atil.sensalduz@gmail.com>
|
Hey @canack, I've created a pull request to address this issue. The new PR introduces a GitHub Actions workflow that integrates govulncheck for automated security scanning of Go modules. This will help identify and mitigate potential vulnerabilities early in the development process. If you’d like, you can assign this issue to me. I’d love to add more security checks to further improve the security posture of the repository. If you have any feedback or suggestions, please feel free to share them on the PR! Thank you |
|
Hi @atilsensalduz , nice to see you interested to GAMA! 🍀 |
This commit introduces a new GitHub Actions workflow to run 'gosec' for static code analysis of Go modules. The workflow will automatically scan the source code for potential security issues and improve the security posture of the repository. References: - Gosec Documentation: https://github.com/securego/gosec - Related Issue: termkit#22 Signed-off-by: atilsensalduz <atil.sensalduz@gmail.com>
This commit introduces a new GitHub Actions workflow to run 'gosec' for static code analysis of Go modules. The workflow will automatically scan the source code for potential security issues and improve the security posture of the repository. References: - Gosec Documentation: https://github.com/securego/gosec - Related Issue: termkit#22 Signed-off-by: atilsensalduz <atil.sensalduz@gmail.com>
|
Great suggestion! @canack I was also thinking about adding more security controls to the repository, and gosec is one of them. While govulncheck focuses on checking Go module dependencies against the Go vulnerability database, gosec identifies security issues in the source code. I believe using both tools would significantly improve the security posture of the repository. And gosec already found sth 😄
|
We can add an Open Source Scanner to our workflow, which will run every time we push to the PR or main branch.
The text was updated successfully, but these errors were encountered: