gosec.yml

name: Gosec

on:
  push:
    branches:
      - master
      - develop
      - fix-release*

  pull_request:
    branches:


jobs:
  gosec:
    name: gosec
    strategy:
      matrix:
        go-version: [1.20.x]
        os: [ubuntu-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
      - uses: actions/checkout@v3
      - uses: actions/cache@v3
        with:
          # In order:
          # * Module download cache
          # * Build cache (Linux)
          # * Build cache (Mac)
          # * Build cache (Windows)
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
            ~/Library/Caches/go-build
            %LocalAppData%\go-build
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-
      - run: |
          make install-tools
          make buf-gen
          go mod tidy
          go mod download
      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: -quiet -confidence high -severity high ./...