From 28ca3b9a924589e6554f6b05bc902ff3d24d4f49 Mon Sep 17 00:00:00 2001 From: Karen Xu Date: Tue, 18 May 2021 16:07:41 -0400 Subject: [PATCH 1/5] Add gosec workflow --- .github/workflows/gosec.yml | 32 ++++++++++++++++++++++++++++++++ CHANGELOG.md | 1 + 2 files changed, 33 insertions(+) create mode 100644 .github/workflows/gosec.yml diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml new file mode 100644 index 00000000..a86b354d --- /dev/null +++ b/.github/workflows/gosec.yml @@ -0,0 +1,32 @@ +name: Run Gosec +on: + workflow_dispatch: + schedule: + # ┌───────────── minute (0 - 59) + # │ ┌───────────── hour (0 - 23) + # │ │ ┌───────────── day of the month (1 - 31) + # │ │ │ ┌───────────── month (1 - 12 or JAN-DEC) + # │ │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT) + # │ │ │ │ │ + # │ │ │ │ │ + # │ │ │ │ │ + # * * * * * + - cron: '30 1 * * *' +jobs: + tests: + runs-on: ubuntu-latest + env: + GO111MODULE: on + steps: + - name: Checkout Source + uses: actions/checkout@v2 + + - name: Run Gosec Security Scanner + uses: securego/gosec@master + with: + args: './...' + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: results.sarif diff --git a/CHANGELOG.md b/CHANGELOG.md index e165a500..0678f93e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - `add`, `remove`, `move`, `copy`, `retain`, and `flatten` operators, as alternatives to the `restructure` operator. - `add_attributes` option to `tcp_input` and `udp_input`, for capturing network attributes ([PR108](https://github.com/open-telemetry/opentelemetry-log-collection/pull/108)) - `multiline`, `encoding`, and `max_log_size` options to `tcp_input` ([PR125](https://github.com/open-telemetry/opentelemetry-log-collection/pull/125)) +- GoSec workflow added to GitHub Actions (PR###) ### Removed - Database package. The same functionality is supported via a `Persister` interface, passed to `Start` methods ([PR93](https://github.com/open-telemetry/opentelemetry-log-collection/pull/93)) From 61b00c341ce397ad0cbaf8aa9a72b9231e4e9581 Mon Sep 17 00:00:00 2001 From: Karen Xu Date: Wed, 19 May 2021 21:06:06 -0400 Subject: [PATCH 2/5] Update changelog --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0678f93e..e5f647b1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - `add`, `remove`, `move`, `copy`, `retain`, and `flatten` operators, as alternatives to the `restructure` operator. - `add_attributes` option to `tcp_input` and `udp_input`, for capturing network attributes ([PR108](https://github.com/open-telemetry/opentelemetry-log-collection/pull/108)) - `multiline`, `encoding`, and `max_log_size` options to `tcp_input` ([PR125](https://github.com/open-telemetry/opentelemetry-log-collection/pull/125)) -- GoSec workflow added to GitHub Actions (PR###) +- GoSec workflow added to GitHub Actions ([PR154](https://github.com/open-telemetry/opentelemetry-log-collection/pull/154)) ### Removed - Database package. The same functionality is supported via a `Persister` interface, passed to `Start` methods ([PR93](https://github.com/open-telemetry/opentelemetry-log-collection/pull/93)) From ee21ff676b2f2e1b36d669db76167feff2996f21 Mon Sep 17 00:00:00 2001 From: Karen Xu Date: Thu, 20 May 2021 11:40:44 -0400 Subject: [PATCH 3/5] Update CHANGELOG.md Co-authored-by: Daniel Jaglowski --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e5f647b1..b8d3c9cc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - `add`, `remove`, `move`, `copy`, `retain`, and `flatten` operators, as alternatives to the `restructure` operator. - `add_attributes` option to `tcp_input` and `udp_input`, for capturing network attributes ([PR108](https://github.com/open-telemetry/opentelemetry-log-collection/pull/108)) - `multiline`, `encoding`, and `max_log_size` options to `tcp_input` ([PR125](https://github.com/open-telemetry/opentelemetry-log-collection/pull/125)) +## Unreleased + +### Added - GoSec workflow added to GitHub Actions ([PR154](https://github.com/open-telemetry/opentelemetry-log-collection/pull/154)) ### Removed From 1c7d094c69e512dc9857a2209489a80781aa9054 Mon Sep 17 00:00:00 2001 From: Karen Xu Date: Thu, 20 May 2021 16:05:47 -0400 Subject: [PATCH 4/5] Add trigger on PR --- .github/workflows/gosec.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml index a86b354d..23f52a8f 100644 --- a/.github/workflows/gosec.yml +++ b/.github/workflows/gosec.yml @@ -12,6 +12,10 @@ on: # │ │ │ │ │ # * * * * * - cron: '30 1 * * *' + + pull_request: + branches: [ main ] + jobs: tests: runs-on: ubuntu-latest From 255702d389e83d5978d530570a47697ad9780ea7 Mon Sep 17 00:00:00 2001 From: Karen Xu Date: Fri, 21 May 2021 11:13:14 -0400 Subject: [PATCH 5/5] test --- .github/workflows/gosec.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml index 23f52a8f..de654e28 100644 --- a/.github/workflows/gosec.yml +++ b/.github/workflows/gosec.yml @@ -28,8 +28,7 @@ jobs: - name: Run Gosec Security Scanner uses: securego/gosec@master with: - args: './...' - + args: '-no-fail -fmt sarif -out results.sarif ./...' - name: Upload SARIF file uses: github/codeql-action/upload-sarif@v1 with: