fix(gosec): enforce G104, drop dead G704, record kept exclusions #751

Merged

hexajon merged 1 commit from issue-717-gosec-exclusion-adr into main

2026-10-13 00:38:21 +00:00

hexajon commented

2026-10-13 00:38:15 +00:00

Owner

Summary

scripts/gosec.sh excluded seven rule classes with the rationale only in the script header. ADR 0044 set the rule that a gate opt-out carries a record, so I re-ran gosec with no exclusions (108 findings, all within those classes) and triaged each.

Dropped two:

G104 (unhandled errors): the header called these infallible buffer writes. They were best-effort git, API, and config calls in the orchestrate pipeline and bisect, a reviewer request after PR creation, and local git-config writes. Each is now an explicit ignore with a reason at the call site, so G104 is enforced with no exclusion - a future bare unhandled error fails the gate.
G704 (SSRF taint): no findings, so the exclusion suppressed nothing.

Kept five, each by-design, now recorded with accurate rationales in ADR 0053: G204 (subprocess: fixed-binary calls plus the user's own command via orchestrate verify, secretexec, and the commandRunner seam), G304 (file reads of user-supplied or madtea-derived paths), G301/G302/G306 (output-dir, executable-bit, and generated-doc permissions). scripts/gosec.sh now excludes exactly G204,G301,G302,G304,G306.

ADR 0053 is proposed. It is accepted once a second contributor assents (ADR 0047), which also closes the tracking issue. Full gate green.

Refs #717

## Summary scripts/gosec.sh excluded seven rule classes with the rationale only in the script header. ADR 0044 set the rule that a gate opt-out carries a record, so I re-ran gosec with no exclusions (108 findings, all within those classes) and triaged each. Dropped two: - G104 (unhandled errors): the header called these infallible buffer writes. They were best-effort git, API, and config calls in the orchestrate pipeline and bisect, a reviewer request after PR creation, and local git-config writes. Each is now an explicit ignore with a reason at the call site, so G104 is enforced with no exclusion - a future bare unhandled error fails the gate. - G704 (SSRF taint): no findings, so the exclusion suppressed nothing. Kept five, each by-design, now recorded with accurate rationales in ADR 0053: G204 (subprocess: fixed-binary calls plus the user's own command via orchestrate verify, secretexec, and the commandRunner seam), G304 (file reads of user-supplied or madtea-derived paths), G301/G302/G306 (output-dir, executable-bit, and generated-doc permissions). scripts/gosec.sh now excludes exactly G204,G301,G302,G304,G306. ADR 0053 is proposed. It is accepted once a second contributor assents (ADR 0047), which also closes the tracking issue. Full gate green. Refs #717 Refs #717

hexajon added 1 commit

2026-10-13 00:38:15 +00:00

fix(gosec): enforce G104, drop dead G704, record kept exclusions

drift / govulncheck (pull_request) Has been skipped

Details

drift / surface-diff (pull_request) Successful in 5m7s

Details

drift / forgejo-smoke (pull_request) Has been skipped

Details

ci / mcp-conformance (pull_request) Successful in 8m50s

Details

ci / mcp-conformance (push) Successful in 7m22s