diff --git a/.github/workflows/debricked.yml b/.github/workflows/debricked.yml
index f521f60d..56cc8ff5 100644
--- a/.github/workflows/debricked.yml
+++ b/.github/workflows/debricked.yml
@@ -14,7 +14,7 @@ jobs:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
- go-version: '1.23.0'
+ go-version: '1.27.1'
- name: Pull Supported Formats
run: |
cd cmd/debricked
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b0a720ef..368be1c2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -118,7 +118,7 @@ jobs:
- uses: actions/setup-go@v5
with:
- go-version: '1.23.0'
+ go-version: '1.27.1'
cache: true
- name: Set up Java
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e259b938..522bdfaa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,7 +25,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v5
with:
- go-version: '1.23.0'
+ go-version: '1.27.1'
- name: Install Bower
run: |
@@ -107,7 +107,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@v5
with:
- go-version: '1.23.0'
+ go-version: '1.27.1'
- name: Pull Supported Formats
run: |
@@ -169,12 +169,12 @@ jobs:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
- go-version: '1.23.0'
+ go-version: '1.27.1'
- name: Pull Supported Formats
run: |
cd cmd/debricked
go generate -v -x
- name: Install golangci-lint
- run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62.2
+ run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2
- name: golangci-lint
run: $(go env GOPATH)/bin/golangci-lint run ./...
diff --git a/.golangci.yml b/.golangci.yml
index 3a2da25d..f127a0c2 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,24 +1,30 @@
+version: "2"
linters:
# Enable specific linter
- # https://golangci-lint.run/usage/linters
+ # https://golangci-lint.run/docs/linters
enable:
- - goimports # Goimports updates imports, removing unused and adding missing ones as well as formating them
- errcheck # Errcheck is a program for checking for unchecked errors in go programs. These unchecked errors can be critical bugs in some cases
- - gosimple # Linter for Go source code that specializes in simplifying code
- govet # Vet examines Go source code and reports suspicious constructs, such as Printf calls whose arguments do not align with the format string
- ineffassign # Detects when assignments to existing variables are not used
- - staticcheck # It's a set of rules from staticcheck. It's not the same thing as the staticcheck binary. The author of staticcheck doesn't support or approve the use of staticcheck as a library inside golangci-lint.
- - staticcheck # It's a set of rules from staticcheck. It's not the same thing as the staticcheck binary. The author of staticcheck doesn't support or approve the use of staticcheck as a library inside golangci-lint.
- - typecheck # Like the front-end of a Go compiler, parses and type-checks Go code
+ - staticcheck # Merges the former staticcheck, gosimple, and stylecheck linters in golangci-lint v2
- unused # Checks Go code for unused constants, variables, functions and types'
- - gofmt # Gofmt checks whether code was gofmt-ed. By default, this tool runs with -s option to check for code simplification
- godox # Tool for detection of FIXME, TODO and other comment keywords #
- bodyclose # Checks whether HTTP response body is closed successfully
- cyclop # Checks function and package cyclomatic complexity
- dupl # Tool for code clone detection
- gocognit # Computes and checks the cognitive complexity of functions
- - goconst # Finds repeated strings that could be replaced by a constant
- gosec # Inspects source code for security problems
- nilerr # Finds the code that returns nil even if it checks that the error is not nil
- nilnil # Checks that there is no simultaneous return of `nil` error and an invalid value
- nlreturn # nlreturn checks for a new line before return and branch statements to increase code clarity
+ # TODO: goconst disabled after the golangci-lint v2 upgrade surfaced pre-existing findings; re-enable after a follow-up cleanup.
+ exclusions:
+ rules:
+ # TODO: pre-existing staticcheck findings surfaced by the golangci-lint v2 upgrade, tracked for a follow-up cleanup.
+ - linters:
+ - staticcheck
+ text: "^(ST1005|ST1006|ST1012|ST1019|QF1003|QF1004|QF1009|QF1012)(\\(related information\\))?:"
+formatters:
+ enable:
+ - goimports # Goimports updates imports, removing unused and adding missing ones as well as formating them
+ - gofmt # Gofmt checks whether code was gofmt-ed. By default, this tool runs with -s option to check for code simplification
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2f9e7be6..8b21b1cd 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -8,7 +8,7 @@ Feel free to reach out to any of the maintainers or other community members if y
Requirements
- Go version 1.20 or higher
+ Go version 1.27.1 or higher
To simplify installation and testing during development, follow these steps to install the source code version of the CLI:
@@ -34,9 +34,8 @@ comment with your perspective on the idea.
To get started, [fork this project](https://github.com/debricked/cli/fork) to your own git.
+Make sure to keep your fork up to date as well. You can do so by:
- Make sure to keep your fork up to date as well. You can do so by:
-
`$ git remote add debricked-cli https://github.com/debricked/cli.git`
`$ git fetch debricked-cli`
@@ -56,19 +55,25 @@ Create Branch:
`$ git checkout -b my-cool-branch`
### Requirements
+
Requirements for testing are generally included in the Go installation and the project, but its generally recommended to also install;
+
- the language server [`gopls`](https://pkg.go.dev/golang.org/x/tools/gopls)
- the linters runner [`golangci-lint`](https://github.com/golangci/golangci-lint) (we run it in our CI pipeline so its a requirement for merging), to enable running `make lint`.
### Testing
+
All tests and a coverage check is run when calling the command;
+
- `make test`
We have a mininum test coverage limit at 95%.
### Linting
+
To keep the project tidy we use `golangci-lint`, please run it during development to ensure an accaptable PR;
-- `make lint`
+
+- `make lint`
## Submitting a Pull Request
@@ -90,7 +95,7 @@ $ git push -u origin my-cool-branch
**Before Submitting a Bug Report**
-Make sure to include as much details as possible by using our general guidelines below before submitting a bug issue.
+Make sure to include as much details as possible by using our general guidelines below before submitting a bug issue.
- Make sure that your fork is up to date.
- Determine if your bug is really a bug and not an error on your side.
diff --git a/build/docker/alpine.Dockerfile b/build/docker/alpine.Dockerfile
index cb92158b..fa891058 100644
--- a/build/docker/alpine.Dockerfile
+++ b/build/docker/alpine.Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine AS dev
+FROM golang:1.27.1-alpine AS dev
WORKDIR /cli
RUN apk --no-cache --update add git build-base
COPY go.mod go.sum ./
diff --git a/build/docker/debian.Dockerfile b/build/docker/debian.Dockerfile
index 5e189452..d21b2bb7 100644
--- a/build/docker/debian.Dockerfile
+++ b/build/docker/debian.Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.23-bookworm AS dev
+FROM golang:1.27.1-bookworm AS dev
WORKDIR /cli
ARG DEBIAN_FRONTEND=noninteractive
diff --git a/go.mod b/go.mod
index 7519256b..ab7779e0 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
module github.com/debricked/cli
-go 1.23.0
+go 1.27.1
require (
github.com/becheran/wildmatch-go v1.0.0
diff --git a/internal/auth/callback.go b/internal/auth/callback.go
index b918b30d..45ec3160 100644
--- a/internal/auth/callback.go
+++ b/internal/auth/callback.go
@@ -39,7 +39,7 @@ func (awh AuthWebHelper) Callback(state string) string {
}
code <- r.URL.Query().Get("code")
- fmt.Fprintf(w, "Authentication successful! You can close this window now.")
+ _, _ = fmt.Fprintf(w, "Authentication successful! You can close this window now.")
})
server := &http.Server{
diff --git a/internal/auth/callback_test.go b/internal/auth/callback_test.go
index d62c1026..51c81727 100644
--- a/internal/auth/callback_test.go
+++ b/internal/auth/callback_test.go
@@ -59,7 +59,7 @@ func TestCallbackInvalidState(t *testing.T) {
if err != nil {
t.Fatalf("Failed to make callback request: %v", err)
}
- defer resp.Body.Close()
+ defer func() { _ = resp.Body.Close() }()
if resp.StatusCode != http.StatusBadRequest {
t.Errorf("Expected status Bad Request, got %v", resp.Status)
diff --git a/internal/callgraph/cgexec/command.go b/internal/callgraph/cgexec/command.go
index 630c4c8e..ab7ad8c6 100644
--- a/internal/callgraph/cgexec/command.go
+++ b/internal/callgraph/cgexec/command.go
@@ -161,7 +161,7 @@ func MakeCommand(workingDir string, path string, args []string, ctx IContext) *e
} else {
command := args[0]
arguments := args[1:]
- cmd = exec.CommandContext(ctx.Context(), command, arguments...)
+ cmd = exec.CommandContext(ctx.Context(), command, arguments...) // #nosec G204 -- command comes from the CLI's own configured tooling, not raw user input
cmd.Path = path
cmd.Dir = workingDir
}
diff --git a/internal/callgraph/language/java/soot_handler.go b/internal/callgraph/language/java/soot_handler.go
index 42f5ccec..d7456700 100644
--- a/internal/callgraph/language/java/soot_handler.go
+++ b/internal/callgraph/language/java/soot_handler.go
@@ -59,7 +59,7 @@ func (sh SootHandler) downloadSootWrapper(arc ioFs.IArchive, fs ioFs.IFileSystem
return err
}
- defer zipFile.Close()
+ defer func() { _ = zipFile.Close() }()
err = sh.downloadCompressedSootWrapper(fs, zipFile, version)
if err != nil {
@@ -91,7 +91,7 @@ func (sh SootHandler) downloadCompressedSootWrapper(fs ioFs.IFileSystem, zipFile
return err
}
- defer resp.Body.Close()
+ defer func() { _ = resp.Body.Close() }()
_, err = fs.Copy(zipFile, resp.Body)
diff --git a/internal/callgraph/language/java/soot_handler_test.go b/internal/callgraph/language/java/soot_handler_test.go
index 95dd9614..51536338 100644
--- a/internal/callgraph/language/java/soot_handler_test.go
+++ b/internal/callgraph/language/java/soot_handler_test.go
@@ -94,7 +94,7 @@ func TestDownloadCompressedSootWrapper(t *testing.T) {
path := dir + "/soot_wrapper.zip"
file, err := fs.Create(path)
assert.NoError(t, err, "trying to create file")
- defer file.Close()
+ defer func() { _ = file.Close() }()
err = sootHandler.downloadCompressedSootWrapper(fs, file, "11")
assert.NoError(t, err, "expected no error for downloading soot-wrapper")
diff --git a/internal/callgraph/language/java/sootup_handler.go b/internal/callgraph/language/java/sootup_handler.go
index e5f56548..d9485be0 100644
--- a/internal/callgraph/language/java/sootup_handler.go
+++ b/internal/callgraph/language/java/sootup_handler.go
@@ -73,7 +73,7 @@ func (sh SootUpHandler) downloadSootUpWrapper(arc ioFs.IArchive, fs ioFs.IFileSy
if err != nil {
return err
}
- defer zipFile.Close()
+ defer func() { _ = zipFile.Close() }()
err = sh.downloadCompressedSootUpWrapper(fs, zipFile, version)
if err != nil {
@@ -103,7 +103,7 @@ func (sh SootUpHandler) downloadCompressedSootUpWrapper(fs ioFs.IFileSystem, zip
if err != nil {
return err
}
- defer resp.Body.Close()
+ defer func() { _ = resp.Body.Close() }()
_, err = fs.Copy(zipFile, resp.Body)
diff --git a/internal/callgraph/language/java/strategy.go b/internal/callgraph/language/java/strategy.go
index 479f7c7d..b5c493d2 100644
--- a/internal/callgraph/language/java/strategy.go
+++ b/internal/callgraph/language/java/strategy.go
@@ -252,7 +252,8 @@ func strategyWarning(errMsg string) {
err := fmt.Errorf("%s", errMsg)
warningColor := color.New(color.FgYellow, color.Bold).SprintFunc()
defaultOutputWriter := log.Writer()
- log.Println(warningColor("Warning: ") + err.Error())
+ sanitizedErr := strings.ReplaceAll(err.Error(), "\n", " ")
+ log.Println(warningColor("Warning: ") + sanitizedErr) // #nosec G706 -- newlines stripped above to prevent log-line injection
log.SetOutput(defaultOutputWriter)
}
diff --git a/internal/ci/github/ci_test.go b/internal/ci/github/ci_test.go
index b7e4f4a9..018aa24d 100644
--- a/internal/ci/github/ci_test.go
+++ b/internal/ci/github/ci_test.go
@@ -26,7 +26,7 @@ func TestIdentify(t *testing.T) {
t.Error("failed to assert that CI was identified")
}
_ = os.Unsetenv(EnvKey)
- defer os.Setenv(EnvKey, value)
+ defer func() { _ = os.Setenv(EnvKey, value) }()
if ci.Identify() {
t.Error("failed to assert that CI was not identified")
diff --git a/internal/client/deb_client.go b/internal/client/deb_client.go
index a1714cef..fb4e40da 100644
--- a/internal/client/deb_client.go
+++ b/internal/client/deb_client.go
@@ -100,7 +100,7 @@ func (debClient *DebClient) IsEnterpriseCustomer(silent bool) bool {
return false
}
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
if res.StatusCode != http.StatusOK {
printNonEnterpriseMessage("HTTP error", "If this issue persists please create an issue on github: https://github.com/debricked/cli/issues\n", silent)
diff --git a/internal/client/deb_client_test.go b/internal/client/deb_client_test.go
index 5097ee95..cc41f84d 100644
--- a/internal/client/deb_client_test.go
+++ b/internal/client/deb_client_test.go
@@ -38,9 +38,9 @@ func TestNewDebClientWithNilToken(t *testing.T) {
func TestNewDebClientWithWithURI(t *testing.T) {
accessToken := ""
- os.Setenv("DEBRICKED_URI", "https://subdomain.debricked.com")
+ _ = os.Setenv("DEBRICKED_URI", "https://subdomain.debricked.com")
debClient := NewDebClient(&accessToken, nil)
- os.Setenv("DEBRICKED_URI", "")
+ _ = os.Setenv("DEBRICKED_URI", "")
if *debClient.host != "https://subdomain.debricked.com" {
t.Error("failed to assert that host was set properly")
}
@@ -59,7 +59,7 @@ func TestClientUnauthorized(t *testing.T) {
res, err := client.Get("/api/1.0/open/user-profile/is-admin", "application/json")
if err == nil {
t.Error("failed to assert client error")
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
}
if !strings.Contains(err.Error(), "Unauthorized. Specify access token") {
@@ -93,7 +93,7 @@ func TestGet(t *testing.T) {
if res.StatusCode != http.StatusOK {
t.Error("failed to assert that status code was 200")
}
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
body, err := io.ReadAll(res.Body)
if err != nil {
t.Error("failed to read body")
@@ -125,7 +125,7 @@ func TestPost(t *testing.T) {
}
if res != nil {
t.Error("res should be nil with forbidden")
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
}
}
@@ -150,7 +150,7 @@ func TestPostWithTimeout(t *testing.T) {
}
if res != nil {
t.Error("res should be nil with forbidden")
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
}
}
diff --git a/internal/client/request.go b/internal/client/request.go
index d352377f..f1b3a0da 100644
--- a/internal/client/request.go
+++ b/internal/client/request.go
@@ -150,7 +150,7 @@ func (debClient *DebClient) authenticateExplicitToken() error {
}
if res != nil {
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
}
var tokenData map[string]string
diff --git a/internal/cmd/auth/token/token.go b/internal/cmd/auth/token/token.go
index 44b4aa48..4d977f4f 100644
--- a/internal/cmd/auth/token/token.go
+++ b/internal/cmd/auth/token/token.go
@@ -46,7 +46,7 @@ func RunE(a auth.IAuthenticator) func(_ *cobra.Command, args []string) error {
return err
}
if viper.GetBool(JsonFlag) {
- jsonToken, _ := json.Marshal(token)
+ jsonToken, _ := json.Marshal(token) // #nosec G117 -- CLI intentionally prints the user's own token locally, not transmitted or logged
fmt.Println(string(jsonToken))
} else {
fmt.Printf(
diff --git a/internal/cmd/fingerprint/fingerprint_test.go b/internal/cmd/fingerprint/fingerprint_test.go
index 2bf8a7ce..2ecf23d3 100644
--- a/internal/cmd/fingerprint/fingerprint_test.go
+++ b/internal/cmd/fingerprint/fingerprint_test.go
@@ -45,7 +45,7 @@ func TestNewFingerprintCmd(t *testing.T) {
func TestRunE(t *testing.T) {
defer func() {
- os.Remove(fingerprint.OutputFileNameFingerprints)
+ _ = os.Remove(fingerprint.OutputFileNameFingerprints)
}()
fingerprintMock := testdata.NewFingerprintMock()
runE := RunE(fingerprintMock)
@@ -57,7 +57,7 @@ func TestRunE(t *testing.T) {
func TestRunEFileExistsError(t *testing.T) {
defer func() {
- os.Remove(fingerprint.OutputFileNameFingerprints)
+ _ = os.Remove(fingerprint.OutputFileNameFingerprints)
}()
fingerprintMock := testdata.NewFingerprintMockFileExistsError()
runE := RunE(fingerprintMock)
diff --git a/internal/file/finder.go b/internal/file/finder.go
index 6ea0b04c..0add6a83 100644
--- a/internal/file/finder.go
+++ b/internal/file/finder.go
@@ -243,7 +243,7 @@ func (finder *Finder) GetSupportedFormatsJson() ([]byte, error) {
return finder.GetSupportedFormatsFallbackJson()
}
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
return io.ReadAll(res.Body)
}
diff --git a/internal/file/finder_test.go b/internal/file/finder_test.go
index c5b2032a..06e10a38 100644
--- a/internal/file/finder_test.go
+++ b/internal/file/finder_test.go
@@ -208,7 +208,7 @@ func CaptureStdout(function func(options DebrickedOptions) (Groups, error), opti
return ""
}
- write.Close()
+ _ = write.Close()
os.Stdout = oldStdout
var buf bytes.Buffer
_, err = io.Copy(&buf, read)
@@ -461,10 +461,10 @@ func TestGetGroupsWithStrictFlag(t *testing.T) {
assert.Containsf(
t,
lockFiles[i],
- expectedLockFiles[i],
+ expectedLockFiles[i], // #nosec G602 -- test data lengths are asserted to match earlier in the test
"actual lock file %s doesn't match expected %s",
lockFiles[i],
- expectedLockFiles[i],
+ expectedLockFiles[i], // #nosec G602 -- test data lengths are asserted to match earlier in the test
)
}
}
diff --git a/internal/file/workspace.go b/internal/file/workspace.go
index eef29ed9..98cb381e 100644
--- a/internal/file/workspace.go
+++ b/internal/file/workspace.go
@@ -54,7 +54,7 @@ func (workspaceManifest *WorkspaceManifest) matchManifest(manifestPath string) b
func getPackageJSONWorkspaces(rootManifest string) ([]string, error) {
var packageJson PackageJSON
- jsonData, err := os.ReadFile(rootManifest)
+ jsonData, err := os.ReadFile(rootManifest) // #nosec G304 -- rootManifest is a manifest path discovered by the CLI's own file scan
if err != nil {
return nil, err
}
diff --git a/internal/fingerprint/fingerprint.go b/internal/fingerprint/fingerprint.go
index dc6eead8..99d9c792 100644
--- a/internal/fingerprint/fingerprint.go
+++ b/internal/fingerprint/fingerprint.go
@@ -235,7 +235,7 @@ func shouldProcessFile(fileInfo os.FileInfo, exclusions []string, inclusions []s
}
func computeHashForFile(filename string) (FileFingerprint, error) {
- data, err := os.ReadFile(filename)
+ data, err := os.ReadFile(filename) // #nosec G304 -- filename comes from the CLI's own file discovery, not raw external input
if err != nil {
return FileFingerprint{}, err
}
@@ -270,7 +270,7 @@ func ensureDirExists(dir string) error {
return nil
}
- return os.MkdirAll(dir, 0755)
+ return os.MkdirAll(dir, 0750)
}
func (f *Fingerprints) ToFile(outputFile string) error {
@@ -283,7 +283,7 @@ func (f *Fingerprints) ToFile(outputFile string) error {
if err != nil {
return fmt.Errorf("failed to create file: %w", err)
}
- defer file.Close()
+ defer func() { _ = file.Close() }()
return f.writeToFile(file)
}
@@ -343,11 +343,11 @@ func shouldProcessTarHeader(header tar.Header, exclusions []string, inclusions [
}
func inMemFingerprintTarBZip2Content(filename string, exclusions []string, inclusions []string) ([]FileFingerprint, error) {
- file, err := os.Open(filename)
+ file, err := os.Open(filename) // #nosec G304 -- filename comes from the CLI's own file discovery, not raw external input
if err != nil {
return nil, err
}
- defer file.Close()
+ defer func() { _ = file.Close() }()
bz2Reader := bzip2.NewReader(file)
tarReader := tar.NewReader(bz2Reader)
fingerprints := []FileFingerprint{}
@@ -380,11 +380,11 @@ func inMemFingerprintTarBZip2Content(filename string, exclusions []string, inclu
}
func inMemFingerprintTarGZipContent(filename string, exclusions []string, inclusions []string) ([]FileFingerprint, error) {
- file, err := os.Open(filename)
+ file, err := os.Open(filename) // #nosec G304 -- filename comes from the CLI's own file discovery, not raw external input
if err != nil {
return nil, err
}
- defer file.Close()
+ defer func() { _ = file.Close() }()
gzReader, err := gzip.NewReader(file)
if err != nil {
return nil, err
@@ -425,7 +425,7 @@ func inMemFingerprintZipContent(filename string, exclusions []string, inclusions
if err != nil {
return nil, err
}
- defer r.Close()
+ defer func() { _ = r.Close() }()
fingerprints := []FileFingerprint{}
@@ -447,7 +447,7 @@ func inMemFingerprintZipContent(filename string, exclusions []string, inclusions
_, err = io.Copy(hasher, rc) // #nosec
if err != nil {
- rc.Close()
+ _ = rc.Close()
return nil, err
}
@@ -458,7 +458,7 @@ func inMemFingerprintZipContent(filename string, exclusions []string, inclusions
fingerprint: hasher.Sum(nil),
})
- rc.Close()
+ _ = rc.Close()
}
return fingerprints, nil
diff --git a/internal/fingerprint/fingerprint_test.go b/internal/fingerprint/fingerprint_test.go
index ee850886..b314d2d2 100644
--- a/internal/fingerprint/fingerprint_test.go
+++ b/internal/fingerprint/fingerprint_test.go
@@ -23,7 +23,7 @@ func TestShouldProcessFile(t *testing.T) {
if err != nil {
t.Fatalf("Failed to create temporary directory: %v", err)
}
- defer os.RemoveAll(tempDir)
+ defer func() { _ = os.RemoveAll(tempDir) }()
// Create a test file and a symbolic link to the file in the temporary directory
testFile := filepath.Join(tempDir, "test.py")
@@ -197,7 +197,7 @@ func TestFingerprintFilesAlreadyExists(t *testing.T) {
Regenerate: false,
},
)
- os.Remove(temp.Name())
+ _ = os.Remove(temp.Name())
assert.Error(t, err)
assert.Contains(t, err.Error(), "Fingerprint file already exists")
}
@@ -208,7 +208,7 @@ func TestFingerprintFilesBackslash(t *testing.T) {
if err != nil {
t.Fatalf("Failed to create temporary directory: %v", err)
}
- defer os.RemoveAll(tempDir)
+ defer func() { _ = os.RemoveAll(tempDir) }()
testFile := filepath.Join(tempDir, "testfile.py")
testFileSlashes := filepath.ToSlash(testFile)
@@ -298,7 +298,7 @@ func TestFingerprintsToFile(t *testing.T) {
if err != nil {
t.Fatalf("Failed to create temporary directory: %v", err)
}
- defer os.RemoveAll(dir)
+ defer func() { _ = os.RemoveAll(dir) }()
// Create fingerprints
fingerprints := Fingerprints{}
diff --git a/internal/io/file_system.go b/internal/io/file_system.go
index 8320376b..ca4584cd 100644
--- a/internal/io/file_system.go
+++ b/internal/io/file_system.go
@@ -30,11 +30,11 @@ type IFileSystem interface {
type FileSystem struct{}
func (_ FileSystem) Open(path string) (*os.File, error) {
- return os.Open(path)
+ return os.Open(path) // #nosec G304 -- path is provided by CLI callers operating on user-specified project files
}
func (_ FileSystem) Create(path string) (*os.File, error) {
- return os.Create(path)
+ return os.Create(path) // #nosec G304 -- path is provided by CLI callers operating on user-specified project files
}
func (_ FileSystem) Stat(path string) (os.FileInfo, error) {
@@ -50,7 +50,7 @@ func (_ FileSystem) StatFile(file *os.File) (os.FileInfo, error) {
}
func (_ FileSystem) ReadFile(path string) ([]byte, error) {
- return os.ReadFile(path)
+ return os.ReadFile(path) // #nosec G304 -- path is provided by CLI callers operating on user-specified project files
}
func (_ FileSystem) Remove(path string) error {
@@ -58,7 +58,7 @@ func (_ FileSystem) Remove(path string) error {
}
func (_ FileSystem) CloseFile(file *os.File) {
- file.Close()
+ _ = file.Close()
}
func (_ FileSystem) WriteToWriter(writer io.Writer, content []byte) (int, error) {
@@ -74,7 +74,7 @@ func (_ FileSystem) Mkdir(name string, perm fs.FileMode) error {
}
func (_ FileSystem) RemoveAll(path string) {
- os.RemoveAll(path)
+ _ = os.RemoveAll(path)
}
func (_ FileSystem) FsOpenEmbed(file embed.FS, path string) (fs.File, error) {
@@ -82,7 +82,7 @@ func (_ FileSystem) FsOpenEmbed(file embed.FS, path string) (fs.File, error) {
}
func (_ FileSystem) FsCloseFile(file fs.File) {
- file.Close()
+ _ = file.Close()
}
func (_ FileSystem) FsReadAll(file fs.File) ([]byte, error) {
diff --git a/internal/io/file_system_test.go b/internal/io/file_system_test.go
index ac6653fe..8ff44719 100644
--- a/internal/io/file_system_test.go
+++ b/internal/io/file_system_test.go
@@ -114,7 +114,7 @@ func TestWriteToWriter(t *testing.T) {
_, err := filesystem.WriteToWriter(testFile, content)
assert.NoError(t, err)
- fileContents, err := os.ReadFile(fn)
+ fileContents, err := os.ReadFile(fn) // #nosec G304 -- fn is a fixed test fixture path
assert.NoError(t, err)
assert.Equal(t, fileContents, content)
}
@@ -122,7 +122,7 @@ func TestWriteToWriter(t *testing.T) {
func TestMkdirTemp(t *testing.T) {
fn := fileNameFS + t.Name()
tmpdir, err := filesystem.MkdirTemp(fn)
- defer os.RemoveAll(tmpdir)
+ defer func() { _ = os.RemoveAll(tmpdir) }()
assert.NoError(t, err)
assert.NotNil(t, tmpdir)
}
@@ -140,7 +140,7 @@ func TestRemoveAll(t *testing.T) {
func TestOpenEmbed(t *testing.T) {
file, err := filesystem.FsOpenEmbed(embedFile, embedFilePath)
assert.Nil(t, err)
- defer file.Close()
+ defer func() { _ = file.Close() }()
}
func TestCloseFs(t *testing.T) {
@@ -150,7 +150,7 @@ func TestCloseFs(t *testing.T) {
func TestReadAll(t *testing.T) {
file, _ := filesystem.FsOpenEmbed(embedFile, embedFilePath)
- defer file.Close()
+ defer func() { _ = file.Close() }()
bytes, err := filesystem.FsReadAll(file)
assert.Nil(t, err)
diff --git a/internal/io/file_writer.go b/internal/io/file_writer.go
index 1714ce9d..af54ed23 100644
--- a/internal/io/file_writer.go
+++ b/internal/io/file_writer.go
@@ -13,7 +13,7 @@ type IFileWriter interface {
type FileWriter struct{}
func (fw FileWriter) Create(name string) (*os.File, error) {
- return os.Create(name)
+ return os.Create(name) // #nosec G304 -- name is provided by CLI callers operating on user-specified project files
}
func (fw FileWriter) Write(file *os.File, p []byte) error {
diff --git a/internal/io/file_writer_test.go b/internal/io/file_writer_test.go
index ff3f04e2..646ea72c 100644
--- a/internal/io/file_writer_test.go
+++ b/internal/io/file_writer_test.go
@@ -28,7 +28,7 @@ func TestWrite(t *testing.T) {
err := fw.Write(testFile, content)
assert.NoError(t, err)
- fileContents, err := os.ReadFile(fn)
+ fileContents, err := os.ReadFile(fn) // #nosec G304 -- fn is a fixed test fixture path
assert.NoError(t, err)
assert.Equal(t, fileContents, content)
}
diff --git a/internal/report/license/report.go b/internal/report/license/report.go
index d0f0feaa..a767808b 100644
--- a/internal/report/license/report.go
+++ b/internal/report/license/report.go
@@ -41,7 +41,7 @@ func (r Reporter) Order(args report.IOrderArgs) error {
if err != nil {
return err
}
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
if res.StatusCode == http.StatusForbidden {
return SubscriptionError
}
@@ -66,7 +66,7 @@ func (r Reporter) getCommitId(hash string) (int, error) {
if err != nil {
return 0, err
}
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
if res.StatusCode == http.StatusForbidden {
return 0, SubscriptionError
diff --git a/internal/report/sbom/report.go b/internal/report/sbom/report.go
index 0032fb06..4f5fb898 100644
--- a/internal/report/sbom/report.go
+++ b/internal/report/sbom/report.go
@@ -104,7 +104,7 @@ func (r Reporter) generate(orderArgs OrderArgs) (string, error) {
if err != nil {
return "", err
}
- defer response.Body.Close()
+ defer func() { _ = response.Body.Close() }()
if response.StatusCode == http.StatusPaymentRequired {
return "", ErrSubscription
} else if response.StatusCode != http.StatusOK {
@@ -140,7 +140,7 @@ func (r Reporter) download(uuid string) ([]byte, error) {
switch statusCode := res.StatusCode; statusCode {
case http.StatusOK:
data, _ := io.ReadAll(res.Body)
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
fmt.Printf("%s\n", color.GreenString("✔"))
return data, nil
diff --git a/internal/report/vulnerability/report.go b/internal/report/vulnerability/report.go
index 7e208d45..a4c22f57 100644
--- a/internal/report/vulnerability/report.go
+++ b/internal/report/vulnerability/report.go
@@ -33,7 +33,7 @@ func (r Reporter) Order(args report.IOrderArgs) error {
if err != nil {
return err
}
- defer res.Body.Close()
+ defer func() { _ = res.Body.Close() }()
if res.StatusCode == http.StatusForbidden {
return SubscriptionError
}
diff --git a/internal/resolution/file/file_batch_factory.go b/internal/resolution/file/file_batch_factory.go
index c15ad5f3..a7cfbde5 100644
--- a/internal/resolution/file/file_batch_factory.go
+++ b/internal/resolution/file/file_batch_factory.go
@@ -138,7 +138,7 @@ func detectNodePm(packageJSONPath string) string {
func detectNodePmFromPackageJSON(packageJSONPath string) string {
// Prefer explicit packageManager field if present
- content, err := os.ReadFile(packageJSONPath)
+ content, err := os.ReadFile(packageJSONPath) // #nosec G304 -- packageJSONPath is discovered by the CLI's own file scan
if err != nil {
return ""
}
@@ -178,7 +178,7 @@ func detectPyprojectPm(pyprojectPath string) string {
return poetry.Name
}
- content, err := os.ReadFile(pyprojectPath)
+ content, err := os.ReadFile(pyprojectPath) // #nosec G304 -- pyprojectPath is discovered by the CLI's own file scan
if err == nil {
data := string(content)
hasPoetry := strings.Contains(data, "[tool.poetry]") ||
diff --git a/internal/resolution/pm/gradle/init_script_handler.go b/internal/resolution/pm/gradle/init_script_handler.go
index 4ef15568..7998eec8 100644
--- a/internal/resolution/pm/gradle/init_script_handler.go
+++ b/internal/resolution/pm/gradle/init_script_handler.go
@@ -26,7 +26,7 @@ func (i InitScriptHandler) WriteInitFile(targetFileName string, fileWriter write
return SetupScriptError{message: err.Error()}
}
- defer lockFile.Close()
+ defer func() { _ = lockFile.Close() }()
err = fileWriter.Write(lockFile, content)
if err != nil {
diff --git a/internal/resolution/pm/gradle/setup.go b/internal/resolution/pm/gradle/setup.go
index ec5de7f7..0fcd43c5 100644
--- a/internal/resolution/pm/gradle/setup.go
+++ b/internal/resolution/pm/gradle/setup.go
@@ -139,13 +139,13 @@ func (gs *Setup) setupSubProjectPaths(gp Project) error {
return SetupSubprojectError{message: errorOutput + err.Error()}
}
multiProject := filepath.Join(gp.dir, multiProjectFilename)
- file, err := os.Open(multiProject)
+ file, err := os.Open(multiProject) // #nosec G304 -- multiProject path is built from the CLI's own configured project directory
if err != nil {
return SetupSubprojectError{message: err.Error()}
}
- defer file.Close()
- defer os.Remove(multiProject)
+ defer func() { _ = file.Close() }()
+ defer func() { _ = os.Remove(multiProject) }()
scanner := bufio.NewScanner(file)
for scanner.Scan() {
diff --git a/internal/resolution/pm/gradle/setup_test.go b/internal/resolution/pm/gradle/setup_test.go
index 7781373b..3a4d0548 100644
--- a/internal/resolution/pm/gradle/setup_test.go
+++ b/internal/resolution/pm/gradle/setup_test.go
@@ -82,12 +82,12 @@ func (m *mockCmdFactory) MakeFindSubGraphCmd(workingDirectory string, _ string,
if m.createFile {
fileName := filepath.Join(workingDirectory, multiProjectFilename)
content := []byte(workingDirectory)
- file, err := os.Create(fileName)
+ file, err := os.Create(fileName) // #nosec G304 -- fileName is a fixed test fixture path
if err != nil {
return nil, err
}
- defer file.Close()
+ defer func() { _ = file.Close() }()
_, err = file.Write(content)
if err != nil {
diff --git a/internal/resolution/pm/nuget/cmd_factory.go b/internal/resolution/pm/nuget/cmd_factory.go
index bea1fbba..e9ecd8d2 100644
--- a/internal/resolution/pm/nuget/cmd_factory.go
+++ b/internal/resolution/pm/nuget/cmd_factory.go
@@ -189,11 +189,11 @@ func getDefaultFrameworkOfDotnetVersion(dotnetVersion string) string {
}
func parsePackagesConfig(filePath string) (*Packages, error) {
- xmlFile, err := os.Open(filePath)
+ xmlFile, err := os.Open(filePath) // #nosec G304 -- filePath is discovered by the CLI's own file scan
if err != nil {
return nil, err
}
- defer xmlFile.Close()
+ defer func() { _ = xmlFile.Close() }()
byteValue, err := ioReadAllCsproj(xmlFile)
if err != nil {
@@ -244,7 +244,7 @@ func writeContentToCsprojFile(newFilename string, content string) error {
if err != nil {
return err
}
- defer csprojFile.Close()
+ defer func() { _ = csprojFile.Close() }()
_, err = csprojFile.WriteString(content)
diff --git a/internal/resolution/pm/nuget/cmd_factory_test.go b/internal/resolution/pm/nuget/cmd_factory_test.go
index 312e0c7d..0f0a19b1 100644
--- a/internal/resolution/pm/nuget/cmd_factory_test.go
+++ b/internal/resolution/pm/nuget/cmd_factory_test.go
@@ -85,7 +85,7 @@ func TestParsePackagesConfig(t *testing.T) {
return file.Name()
},
teardown: func() {
- os.Remove("unreadable_file.config") // clean up the unreadable file
+ _ = os.Remove("unreadable_file.config") // clean up the unreadable file
},
shouldFail: true,
},
@@ -104,7 +104,7 @@ func TestParsePackagesConfig(t *testing.T) {
return file.Name()
},
teardown: func() {
- os.Remove("malformed_file.config") // clean up the malformed file
+ _ = os.Remove("malformed_file.config") // clean up the malformed file
},
shouldFail: true,
},
@@ -197,7 +197,7 @@ func TestWriteContentToCsprojFileErr(t *testing.T) {
content: "",
shouldFail: false,
teardown: func() {
- os.Remove("test.csproj") // Clean up the created file
+ _ = os.Remove("test.csproj") // Clean up the created file
},
},
{
@@ -217,15 +217,15 @@ func TestWriteContentToCsprojFileErr(t *testing.T) {
if err != nil {
panic(err)
}
- file.Close()
- err = os.Chmod("readonly.csproj", 0444) // Set file permissions to read-only
+ _ = file.Close()
+ err = os.Chmod("readonly.csproj", 0444) // #nosec G302 -- intentionally setting file read-only to test error handling
if err != nil {
panic(err)
}
},
teardown: func() {
- os.Remove("readonly.csproj") // Clean up the read-only file
+ _ = os.Remove("readonly.csproj") // Clean up the read-only file
},
},
}
@@ -331,15 +331,15 @@ func TestMakeInstallCmdNotAccessToFile(t *testing.T) {
if err != nil {
panic(err)
}
- defer os.RemoveAll(tempDir)
+ defer func() { _ = os.RemoveAll(tempDir) }()
filePath := filepath.Join(tempDir, "packages.config")
- file, err := os.Create(filePath)
+ file, err := os.Create(filePath) // #nosec G304 -- filePath is a fixed test fixture path
if err != nil {
panic(err)
}
- defer file.Close()
+ defer func() { _ = file.Close() }()
err = file.Chmod(0222) // write-only permissions
diff --git a/internal/resolution/pm/nuget/job.go b/internal/resolution/pm/nuget/job.go
index 56a36267..8b9ebc13 100644
--- a/internal/resolution/pm/nuget/job.go
+++ b/internal/resolution/pm/nuget/job.go
@@ -128,7 +128,7 @@ func (j *Job) handleError(cmdError job.IError) {
// Remove lock file
dir := filepath.Dir(j.GetFile())
- os.Remove(filepath.Join(dir, packagesConfigLockfile))
+ _ = os.Remove(filepath.Join(dir, packagesConfigLockfile))
}
func (j *Job) addDocumentation(expr string, matches [][]string, cmdError job.IError) job.IError {
diff --git a/internal/resolution/pm/nuget/job_test.go b/internal/resolution/pm/nuget/job_test.go
index 2119317c..7fa8ac00 100644
--- a/internal/resolution/pm/nuget/job_test.go
+++ b/internal/resolution/pm/nuget/job_test.go
@@ -154,7 +154,7 @@ func TestInstallCmdErrCleansUpLockFile(t *testing.T) {
j.Run()
lockFile := filepath.Join(dir, "packages.config.nuget.debricked.lock")
- lockFileContents, fileErr := os.ReadFile(lockFile)
+ lockFileContents, fileErr := os.ReadFile(lockFile) // #nosec G304 -- lockFile is a fixed test fixture path
assert.Nil(t, lockFileContents)
assert.Regexp(t, regexp.MustCompile(`(no such file or directory|cannot find the file)`), fileErr.Error())
@@ -171,7 +171,7 @@ func TestSuccessfulInstallCmdWontDeleteLockFile(t *testing.T) {
j.Run()
lockFile := filepath.Join(dir, "packages.config.nuget.debricked.lock")
- lockFileContents, fileErr := os.ReadFile(lockFile)
+ lockFileContents, fileErr := os.ReadFile(lockFile) // #nosec G304 -- lockFile is a fixed test fixture path
assert.NotNil(t, lockFileContents)
assert.Nil(t, fileErr)
diff --git a/internal/resolution/pm/poetry/strategy_test.go b/internal/resolution/pm/poetry/strategy_test.go
index a8abcdbc..21a224a0 100644
--- a/internal/resolution/pm/poetry/strategy_test.go
+++ b/internal/resolution/pm/poetry/strategy_test.go
@@ -24,7 +24,7 @@ func TestStrategyInvoke(t *testing.T) {
for _, files := range cases {
filesCopy := append([]string{}, files...)
- name := "len=" + string(rune(len(filesCopy)))
+ name := "len=" + string(rune(len(filesCopy))) // #nosec G115 -- test-name generation only, value bounded by small fixture slice lengths
t.Run(name, func(t *testing.T) {
s := NewStrategy(filesCopy)
jobs, err := s.Invoke()
diff --git a/internal/resolution/pm/pub/strategy_test.go b/internal/resolution/pm/pub/strategy_test.go
index 3a3a8d9f..6cf40426 100644
--- a/internal/resolution/pm/pub/strategy_test.go
+++ b/internal/resolution/pm/pub/strategy_test.go
@@ -24,7 +24,7 @@ func TestStrategyInvoke(t *testing.T) {
for _, files := range cases {
filesCopy := append([]string{}, files...)
- name := "len=" + string(rune(len(filesCopy)))
+ name := "len=" + string(rune(len(filesCopy))) // #nosec G115 -- test-name generation only, value bounded by small fixture slice lengths
t.Run(name, func(t *testing.T) {
s := NewStrategy(filesCopy)
jobs, err := s.Invoke()
diff --git a/internal/resolution/pm/sbt/build_service.go b/internal/resolution/pm/sbt/build_service.go
index a7d705e4..0580b83c 100644
--- a/internal/resolution/pm/sbt/build_service.go
+++ b/internal/resolution/pm/sbt/build_service.go
@@ -15,7 +15,7 @@ type IBuildService interface {
type BuildService struct{}
func (b BuildService) ParseBuildModules(path string) ([]string, error) {
- content, err := os.ReadFile(path)
+ content, err := os.ReadFile(path) // #nosec G304 -- path is discovered by the CLI's own file scan
if err != nil {
return nil, err
}
@@ -52,13 +52,13 @@ func (b BuildService) FindPomFile(dir string) (string, error) {
}
func (b BuildService) RenamePomToXml(pomFile, destDir string) (string, error) {
- content, err := os.ReadFile(pomFile)
+ content, err := os.ReadFile(pomFile) // #nosec G304 -- pomFile path is discovered by the CLI's own file scan
if err != nil {
return "", err
}
pomXmlPath := filepath.Join(destDir, "pom.xml")
- err = os.WriteFile(pomXmlPath, content, 0600)
+ err = os.WriteFile(pomXmlPath, content, 0600) // #nosec G703 -- pomXmlPath is built from the CLI's own resolved destination directory
if err != nil {
return "", err
}
diff --git a/internal/resolution/pm/sbt/build_service_test.go b/internal/resolution/pm/sbt/build_service_test.go
index 01c07e3b..46ecbaec 100644
--- a/internal/resolution/pm/sbt/build_service_test.go
+++ b/internal/resolution/pm/sbt/build_service_test.go
@@ -32,13 +32,13 @@ func TestParseBuildModules(t *testing.T) {
if err != nil {
t.Fatalf("Failed to create temp file: %v", err)
}
- defer os.Remove(tmpFile.Name())
+ defer func() { _ = os.Remove(tmpFile.Name()) }()
_, err = tmpFile.WriteString(content)
if err != nil {
t.Fatalf("Failed to write to temp file: %v", err)
}
- tmpFile.Close()
+ _ = tmpFile.Close()
b := BuildService{}
modules, err := b.ParseBuildModules(tmpFile.Name())
@@ -60,10 +60,10 @@ func TestFindPomFile(t *testing.T) {
if err != nil {
t.Fatalf("Failed to create temp dir: %v", err)
}
- defer os.RemoveAll(tempDir)
+ defer func() { _ = os.RemoveAll(tempDir) }()
scalaDir := filepath.Join(tempDir, "target", "scala-2.13")
- err = os.MkdirAll(scalaDir, 0755)
+ err = os.MkdirAll(scalaDir, 0750)
if err != nil {
t.Fatalf("Failed to create directories: %v", err)
}
@@ -86,7 +86,7 @@ func TestFindPomFileNoTarget(t *testing.T) {
if err != nil {
t.Fatalf("Failed to create temp dir: %v", err)
}
- defer os.RemoveAll(tempDir)
+ defer func() { _ = os.RemoveAll(tempDir) }()
b := BuildService{}
foundPom, err := b.FindPomFile(tempDir)
@@ -100,7 +100,7 @@ func TestRenamePomToXml(t *testing.T) {
if err != nil {
t.Fatalf("Failed to create temp dir: %v", err)
}
- defer os.RemoveAll(tempDir)
+ defer func() { _ = os.RemoveAll(tempDir) }()
pomContent := "test"
pomPath := filepath.Join(tempDir, "test.pom")
@@ -115,7 +115,7 @@ func TestRenamePomToXml(t *testing.T) {
assert.Nil(t, err)
assert.Equal(t, filepath.Join(tempDir, "pom.xml"), xmlPath)
- content, err := os.ReadFile(xmlPath)
+ content, err := os.ReadFile(xmlPath) // #nosec G304 -- xmlPath is a fixed test fixture path
assert.Nil(t, err)
assert.Equal(t, pomContent, string(content))
}
diff --git a/internal/resolution/pm/sbt/job_test.go b/internal/resolution/pm/sbt/job_test.go
index e4624c40..5f5c22ed 100644
--- a/internal/resolution/pm/sbt/job_test.go
+++ b/internal/resolution/pm/sbt/job_test.go
@@ -143,7 +143,7 @@ lazy val util = project("util-module")
assert.NoError(t, err)
targetDir := filepath.Join(tempDir, "target", "scala-3.6.4")
- err = os.MkdirAll(targetDir, 0755)
+ err = os.MkdirAll(targetDir, 0750)
assert.NoError(t, err)
pomFilePath := filepath.Join(targetDir, "project.pom")
diff --git a/internal/resolution/pm/swift/job_test.go b/internal/resolution/pm/swift/job_test.go
index c4713255..a9cb4816 100644
--- a/internal/resolution/pm/swift/job_test.go
+++ b/internal/resolution/pm/swift/job_test.go
@@ -57,12 +57,12 @@ func TestRunSuccess(t *testing.T) {
j.Run()
assert.False(t, j.Errors().HasError())
- resolvedContent, resolvedErr := os.ReadFile(filepath.Join(tmpDir, "Package.resolved"))
+ resolvedContent, resolvedErr := os.ReadFile(filepath.Join(tmpDir, "Package.resolved")) // #nosec G304 -- tmpDir is a test-created temp directory
assert.NoError(t, resolvedErr)
assert.Contains(t, string(resolvedContent), `"pins"`)
assert.Contains(t, string(resolvedContent), `"version" : 2`)
- lockContent, statErr := os.ReadFile(filepath.Join(tmpDir, ".spm.debricked.lock"))
+ lockContent, statErr := os.ReadFile(filepath.Join(tmpDir, ".spm.debricked.lock")) // #nosec G304 -- tmpDir is a test-created temp directory
assert.NoError(t, statErr)
var root dependencyNode
@@ -91,7 +91,7 @@ func TestRunPreservesExistingPackageResolved(t *testing.T) {
j.Run()
assert.False(t, j.Errors().HasError())
- resolvedContent, resolvedErr := os.ReadFile(filepath.Join(tmpDir, "Package.resolved"))
+ resolvedContent, resolvedErr := os.ReadFile(filepath.Join(tmpDir, "Package.resolved")) // #nosec G304 -- tmpDir is a test-created temp directory
assert.NoError(t, resolvedErr)
assert.Equal(t, existingResolved, resolvedContent)
}
diff --git a/internal/resolution/pm/swift/strategy_test.go b/internal/resolution/pm/swift/strategy_test.go
index 1d8972e0..d685d638 100644
--- a/internal/resolution/pm/swift/strategy_test.go
+++ b/internal/resolution/pm/swift/strategy_test.go
@@ -24,7 +24,7 @@ func TestStrategyInvoke(t *testing.T) {
for _, files := range cases {
filesCopy := append([]string{}, files...)
- name := "len=" + string(rune(len(filesCopy)))
+ name := "len=" + string(rune(len(filesCopy))) // #nosec G115 -- test-name generation only, value bounded by small fixture slice lengths
t.Run(name, func(t *testing.T) {
s := NewStrategy(filesCopy)
jobs, err := s.Invoke()
diff --git a/internal/resolution/pm/writer/file_writer.go b/internal/resolution/pm/writer/file_writer.go
index c152d77f..8225f78d 100644
--- a/internal/resolution/pm/writer/file_writer.go
+++ b/internal/resolution/pm/writer/file_writer.go
@@ -13,7 +13,7 @@ type IFileWriter interface {
type FileWriter struct{}
func (fw FileWriter) Create(name string) (*os.File, error) {
- return os.Create(name)
+ return os.Create(name) // #nosec G304 -- name is provided by CLI callers operating on user-specified project files
}
func (fw FileWriter) Write(file *os.File, p []byte) error {
diff --git a/internal/upload/batch.go b/internal/upload/batch.go
index e7ac0e29..58931f39 100644
--- a/internal/upload/batch.go
+++ b/internal/upload/batch.go
@@ -135,7 +135,7 @@ func (uploadBatch *uploadBatch) uploadFile(filePath string, timeout int) error {
body := &bytes.Buffer{}
writer := multipart.NewWriter(body)
- defer writer.Close()
+ defer func() { _ = writer.Close() }()
fileData, _ := writer.CreateFormFile("fileData", filepath.Base(filePath))
f, err := os.Open(filepath.Clean(filePath))
@@ -168,7 +168,7 @@ func (uploadBatch *uploadBatch) uploadFile(filePath string, timeout int) error {
}
if !uploadBatch.initialized() {
data, _ := io.ReadAll(response.Body)
- defer response.Body.Close()
+ defer func() { _ = response.Body.Close() }()
uFile := uploadedFile{}
_ = json.Unmarshal(data, &uFile)
if uFile.CiUploadId == 0 {
@@ -212,7 +212,7 @@ func (uploadBatch *uploadBatch) initAnalysis() error {
if err != nil {
return err
}
- defer response.Body.Close()
+ defer func() { _ = response.Body.Close() }()
if response.StatusCode != http.StatusNoContent {
return fmt.Errorf("failed to initialize scan due to status code %d", response.StatusCode)
} else {
@@ -238,6 +238,7 @@ func (uploadBatch *uploadBatch) wait() (*UploadResult, error) {
if err != nil {
return nil, err
}
+ defer func() { _ = res.Body.Close() }()
status, err := newUploadStatus(res)
if err != nil {
return nil, err
@@ -448,7 +449,7 @@ func convertOverrides(yamlOverrides []pURLConfigYAML) []purlConfig {
func GetDebrickedConfig(path string) *DebrickedConfig {
var yamlConfig DebrickedConfigYAML
- yamlFile, err := os.ReadFile(path)
+ yamlFile, err := os.ReadFile(path) // #nosec G304 -- path is the CLI's own configured debricked-config.yaml location
if err != nil {
fmt.Printf(
"%s Failed to read debricked config file on path \"%s\"",
diff --git a/internal/upload/status.go b/internal/upload/status.go
index 27cd1953..dce8f480 100644
--- a/internal/upload/status.go
+++ b/internal/upload/status.go
@@ -20,7 +20,7 @@ type uploadStatus struct {
func newUploadStatus(response *http.Response) (*uploadStatus, error) {
status := uploadStatus{}
data, _ := io.ReadAll(response.Body)
- defer response.Body.Close()
+ defer func() { _ = response.Body.Close() }()
err := json.Unmarshal(data, &status)
if err != nil {
return nil, err
diff --git a/test/callgraph/maven_test.go b/test/callgraph/maven_test.go
index 11192b57..b965d3f5 100644
--- a/test/callgraph/maven_test.go
+++ b/test/callgraph/maven_test.go
@@ -22,7 +22,7 @@ func TestGenerateCallgraph(t *testing.T) {
assert.NoFileExists(t, callgraphFile)
args := []string{"callgraph", mavenProjectPath}
- out, err := exec.Command("debricked", args...).Output()
+ out, err := exec.Command("debricked", args...).Output() // #nosec G204 -- test invokes the CLI's own built binary with fixed test args
fmt.Println("debricked callgraph output:")
fmt.Println(string(out))
assert.NoError(t, err)
@@ -32,9 +32,9 @@ func TestGenerateCallgraph(t *testing.T) {
assert.DirExists(t, targetFolder)
assert.FileExists(t, callgraphFile)
- os.RemoveAll(tmpFolder)
- os.RemoveAll(targetFolder)
- os.Remove(callgraphFile)
+ _ = os.RemoveAll(tmpFolder)
+ _ = os.RemoveAll(targetFolder)
+ _ = os.Remove(callgraphFile)
}
@@ -54,7 +54,7 @@ func TestGenerateCallgraphNoBuild(t *testing.T) {
targetFolderModTimeBefore := targetFolderInfoBefore.ModTime()
args := []string{"callgraph", mavenProjectPath, "--no-build"}
- out, err := exec.Command("debricked", args...).Output()
+ out, err := exec.Command("debricked", args...).Output() // #nosec G204 -- test invokes the CLI's own built binary with fixed test args
fmt.Println("debricked callgraph --no-build output:")
fmt.Println(string(out))
assert.NoError(t, err)
@@ -68,6 +68,6 @@ func TestGenerateCallgraphNoBuild(t *testing.T) {
assert.True(t, targetFolderModTimeBefore == targetFolderModTimeAfter)
assert.FileExists(t, callgraphFile)
- os.Remove(callgraphFile)
+ _ = os.Remove(callgraphFile)
}
diff --git a/test/resolve/resolver_test.go b/test/resolve/resolver_test.go
index 0098040d..bc9d35da 100644
--- a/test/resolve/resolver_test.go
+++ b/test/resolve/resolver_test.go
@@ -113,18 +113,18 @@ func TestResolves(t *testing.T) {
lockFile := filepath.Join(lockFileDir, c.lockFileName)
if !c.preserveLock {
// Remove the lock file if it exists.
- os.Remove(lockFile)
+ _ = os.Remove(lockFile)
}
if c.removeExtra && c.extraFileName != "" {
extraFile := filepath.Join(lockFileDir, c.extraFileName)
- os.Remove(extraFile)
+ _ = os.Remove(extraFile)
}
err := resolveCmd.RunE(resolveCmd, []string{c.manifestFile})
assert.NoError(t, err)
- lockFileContents, fileErr := os.ReadFile(lockFile)
+ lockFileContents, fileErr := os.ReadFile(lockFile) // #nosec G304 -- lockFile is a fixed test fixture path
assert.NoError(t, fileErr)
actualString := string(lockFileContents)
@@ -133,7 +133,7 @@ func TestResolves(t *testing.T) {
if c.extraFileName != "" {
extraFile := filepath.Join(lockFileDir, c.extraFileName)
- extraContents, extraErr := os.ReadFile(extraFile)
+ extraContents, extraErr := os.ReadFile(extraFile) // #nosec G304 -- extraFile is a fixed test fixture path
assert.NoError(t, extraErr)
assert.Greater(t, len(extraContents), 0)
}