gosec.yml

name: gosec

on:
  push:
    branches:
      - master
      - develop
  pull_request:
    branches:
      - master
      - develop
jobs:
  gosec:
    name: gosec
    strategy:
      matrix:
        go-version: [1.22.x]
        os: [ubuntu-latest]
    runs-on: ${{ matrix.os }}
    env:
      GOPRIVATE: github.com/bnb-chain
      GH_ACCESS_TOKEN: ${{ secrets.GH_TOKEN }}
    steps:
      - uses: actions/setup-go@v3
        with:
          go-version: ${{ matrix.go-version }}
      - uses: actions/checkout@v3
      - name: Setup GitHub Token
        run: git config --global url.https://$GH_ACCESS_TOKEN@github.com/.insteadOf https://github.com/
      - uses: actions/cache@v3
        with:
          # In order:
          # * Module download cache
          # * Build cache (Linux)
          # * Build cache (Mac)
          # * Build cache (Windows)
          path: |
            ~/go/pkg/mod
            ~/.cache/go-build
            ~/Library/Caches/go-build
            %LocalAppData%\go-build
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            ${{ runner.os }}-go-
      - run: |
          go mod tidy
          go mod download
      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: -quiet -confidence high -severity high ./...