diff --git a/.github/workflows/gosec.yaml b/.github/workflows/gosec.yaml deleted file mode 100644 index ba6816a0d..000000000 --- a/.github/workflows/gosec.yaml +++ /dev/null @@ -1,15 +0,0 @@ ---- -name: gosec -# yamllint disable-line rule:truthy -on: - pull_request: - branches: - - '*' -jobs: - gosec: - name: gosec - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - name: gosec - run: CONTAINER_CMD=docker make containerized-test TARGET=gosec diff --git a/.mergify.yml b/.mergify.yml index 9f4d4c453..5c70c1580 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -46,7 +46,6 @@ pull_request_rules: - "status-success=multi-arch-build" - "status-success=go-test" - "status-success=golangci-lint" - - "status-success=gosec" - "status-success=mod-check" - "status-success=lint-extras" - "status-success=ci/centos/k8s-e2e-external-storage/1.21" @@ -76,7 +75,6 @@ pull_request_rules: - "status-success=multi-arch-build" - "status-success=go-test" - "status-success=golangci-lint" - - "status-success=gosec" - "status-success=commitlint" - "status-success=mod-check" - "status-success=lint-extras" @@ -105,7 +103,6 @@ pull_request_rules: - "status-success=multi-arch-build" - "status-success=go-test" - "status-success=golangci-lint" - - "status-success=gosec" - "status-success=commitlint" - "status-success=mod-check" - "status-success=lint-extras" @@ -147,7 +144,6 @@ pull_request_rules: - "status-success=go-test" - "status-success=commitlint" - "status-success=golangci-lint" - - "status-success=gosec" - "status-success=mod-check" - "status-success=lint-extras" - "#changes-requested-reviews-by=0" @@ -186,7 +182,6 @@ pull_request_rules: - "status-success=go-test" - "status-success=commitlint" - "status-success=golangci-lint" - - "status-success=gosec" - "status-success=mod-check" - "status-success=lint-extras" - "#changes-requested-reviews-by=0" diff --git a/Makefile b/Makefile index 065e527c4..1ed2ad5ef 100644 --- a/Makefile +++ b/Makefile @@ -87,7 +87,7 @@ endif all: cephcsi -.PHONY: go-test static-check mod-check go-lint lint-extras gosec commitlint codespell +.PHONY: go-test static-check mod-check go-lint lint-extras commitlint codespell ifeq ($(CONTAINERIZED),no) # include mod-check in non-containerized runs test: go-test static-check mod-check @@ -95,7 +95,7 @@ else # exclude mod-check for containerized runs (CI runs it separately) test: go-test static-check endif -static-check: check-env codespell go-lint lint-extras gosec +static-check: check-env codespell go-lint lint-extras go-test: TEST_COVERAGE ?= $(shell . $(CURDIR)/build.env ; echo $${TEST_COVERAGE}) go-test: GO_COVER_DIR ?= $(shell . $(CURDIR)/build.env ; echo $${GO_COVER_DIR}) @@ -133,9 +133,6 @@ lint-helm: lint-py: ./scripts/lint-extras.sh lint-py -gosec: - GO_TAGS="$(GO_TAGS)" ./scripts/gosec.sh - func-test: go test $(GO_TAGS) -mod=vendor github.com/ceph/ceph-csi/e2e $(TESTOPTIONS) diff --git a/build.env b/build.env index b6711e9e1..77471ec90 100644 --- a/build.env +++ b/build.env @@ -24,7 +24,6 @@ COMMITLINT_VERSION=latest # static checks and linters GOLANGCI_VERSION=v1.39.0 -GOSEC_VERSION=v2.7.0 # external snapshotter version # Refer: https://github.com/kubernetes-csi/external-snapshotter/releases diff --git a/scripts/Dockerfile.test b/scripts/Dockerfile.test index ae59e01c0..951d4b3fa 100644 --- a/scripts/Dockerfile.test +++ b/scripts/Dockerfile.test @@ -40,8 +40,6 @@ RUN source /build.env \ && gem install mdl \ && curl -sf "https://install.goreleaser.com/github.com/golangci/golangci-lint.sh" \ | bash -s -- -b ${GOPATH}/bin "${GOLANGCI_VERSION}" \ - && curl -sfL "https://raw.githubusercontent.com/securego/gosec/master/install.sh" \ - | sh -s -- -b $GOPATH/bin "${GOSEC_VERSION}" \ && curl -L https://git.io/get_helm.sh | bash -s -- --version "${HELM_VERSION}" \ && mkdir /opt/commitlint && pushd /opt/commitlint \ && npm init -y \ diff --git a/scripts/gosec.sh b/scripts/gosec.sh deleted file mode 100755 index 398baa171..000000000 --- a/scripts/gosec.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/bin/bash - -set -o pipefail - -if [[ -x "$(command -v gosec)" ]]; then - # gosec does not support -mod=vendor, so fallback to non-module support and - # assume all dependencies are available in ./vendor already - export GO111MODULE=off - find cmd internal -type d -print0 | xargs --null gosec "${GO_TAGS}" -else - echo "WARNING: gosec not found, skipping security tests" >&2 -fi