security: the gosec gate excludes 7 rule classes with no ADR #717

New issue

Closed

opened 2026-10-05 12:32:20 +00:00 by hexajon · 2 comments

hexajon commented

2026-10-05 12:32:20 +00:00

Owner

What happens

scripts/gosec.sh excludes seven gosec rule classes at high confidence - G104, G204, G301, G302, G304, G306, G704 - but no ADR records why. The rationale lives only in the script header and a CONTRIBUTING.md paragraph. The project rule, and ADR 0044's precedent for the osv-scanner exceptions, is that a gate opt-out needs a pointing decision record.

Decision

Tighten first, then record. Re-run gosec with the seven classes NOT excluded; for each class, fix what fires when it is a real finding and drop that exclusion, or justify keeping it. Then record every remaining exclusion in an ADR that mirrors ADR 0044 (one justification per class), and trim scripts/gosec.sh so its exclusions match the ADR exactly.

Acceptance criteria

gosec has been re-run without the seven exclusions, and each class is triaged: fixed-and-dropped, or kept-with-reason.
An ADR records every remaining gosec exclusion with its rationale, mirroring ADR 0044.
scripts/gosec.sh's exclusion set matches the ADR exactly.
./scripts/gate.sh is green.

## What happens `scripts/gosec.sh` excludes seven gosec rule classes at high confidence - G104, G204, G301, G302, G304, G306, G704 - but no ADR records why. The rationale lives only in the script header and a CONTRIBUTING.md paragraph. The project rule, and ADR 0044's precedent for the osv-scanner exceptions, is that a gate opt-out needs a pointing decision record. ## Decision Tighten first, then record. Re-run gosec with the seven classes NOT excluded; for each class, fix what fires when it is a real finding and drop that exclusion, or justify keeping it. Then record every remaining exclusion in an ADR that mirrors ADR 0044 (one justification per class), and trim `scripts/gosec.sh` so its exclusions match the ADR exactly. ## Acceptance criteria - [ ] gosec has been re-run without the seven exclusions, and each class is triaged: fixed-and-dropped, or kept-with-reason. - [ ] An ADR records every remaining gosec exclusion with its rationale, mirroring ADR 0044. - [ ] `scripts/gosec.sh`'s exclusion set matches the ADR exactly. - [ ] `./scripts/gate.sh` is green.

hexajon added the

security

label

2026-10-05 12:32:20 +00:00

hexajon added a new dependency

2026-10-05 12:34:16 +00:00

#675 epic: v0.20.0 - breaking: clearer ADR tooling and the write guard on every surface

~~hexajon referenced this issue 2026-10-05 12:34:16 +00:00~~

epic: v0.20.0 - breaking: clearer ADR tooling and the write guard on every surface #675

hexajon referenced this issue from a commit

2026-10-13 00:38:14 +00:00

fix(gosec): enforce G104, drop dead G704, record kept exclusions

hexajon referenced this issue

2026-10-13 00:38:15 +00:00

fix(gosec): enforce G104, drop dead G704, record kept exclusions #751

hexajon commented

2026-10-13 16:23:01 +00:00

Author

Owner

Resolved by ADR 0053, which records the gosec gate exclusions and is now accepted. PR #751 landed the code: G104 is fixed and enforced, the dead G704 exclusion is dropped, and G204, G301, G302, G304, G306 stay with corrected rationales. scripts/gosec.sh matches the record and the full gate is green.

hexajon closed this issue

2026-10-13 16:23:02 +00:00

hexajon commented

2026-10-13 16:27:06 +00:00

Author

Owner

The accepting decision record is 0053-gosec-gate-exclusions-recorded (accepted).

hexajon referenced this issue

2026-10-13 16:30:38 +00:00

docs(adr): accept 0053, the gosec gate exclusions record #753