Skip to content

ci(security): save the gosec binary only when it exists #1399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
IAmJSD merged 1 commit into from
Oct 25, 2026
Merged

ci(security): save the gosec binary only when it exists #1399

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -888,6 +888,7 @@ jobs:
if: always() && steps.checkout.outcome == 'success' && steps.setup_go.outcome == 'success'
env:
RESULTS_CACHE_HIT: ${{ steps.gosec_results.outputs.cache-hit }}
GOSEC_BIN_DIR: ${{ steps.gosec_key.outputs.bin_dir }}
run: |
# On an exact results-cache hit the restored SARIF is the merged
# output of a clean scan of identical inputs (only clean scans are
Expand Down Expand Up @@ -919,10 +920,14 @@ jobs:
rc=0
scripts/run-gosec.sh --sarif-dir "$RUNNER_TEMP" || rc=$?
[ "$rc" -eq 0 ] || status=1
# run-gosec.sh exits 2 only on a setup failure (a failed install
# included). Any other exit means the binary is in its cache dir,
# ready for "Save gosec binary".
[ "$rc" -eq 2 ] || echo "binary_ready=true" >> "$GITHUB_OUTPUT"
# run-gosec.sh exits 2 on a setup failure (a failed install
# included), but an early mkdir/mktemp failure can stop it with 1
# before gosec exists. Mark the binary ready for "Save gosec binary"
# only when the executable is really in its cache dir; findings and
# scan errors (exit 1 with the binary present) still save it.
if [ "$rc" -ne 2 ] && [ -n "${GOSEC_BIN_DIR:-}" ] && [ -x "$GOSEC_BIN_DIR/gosec" ]; then
echo "binary_ready=true" >> "$GITHUB_OUTPUT"
fi
shopt -s nullglob
for out in "$RUNNER_TEMP"/gosec-*.sarif; do
tag=$(basename "$out" .sarif)
Expand Down
Loading