gosec.yml

name: Gosec Security Scan

on:
    push:
        branches:
            - "master"
            - "main"
        paths-ignore:
            - "**.md"
            - LICENSE
            - ".github/ISSUE_TEMPLATE/*.yml"
            - ".github/dependabot.yml"
    pull_request:
        branches:
            - "*"
        paths-ignore:
            - "**.md"
            - LICENSE
            - ".github/ISSUE_TEMPLATE/*.yml"
            - ".github/dependabot.yml"

jobs:
    set-matrix:
        runs-on: ubuntu-latest
        outputs:
            matrix: ${{ steps.generate-matrix.outputs.matrix }}
        steps:
            - name: Fetch Repository
              uses: actions/checkout@v4
            - name: Generate Matrix
              id: generate-matrix
              run: |
                  SUBDIRS=$(find . -maxdepth 1 -type d -not -name '.*' -not -name 'internal' -not -empty | sed 's|./||' | tr '\n' ' ' | sed 's/ $//')
                  JSON_MATRIX=$(echo "$SUBDIRS" | jq -R -c -s 'split(" ") | map(select(. != "")) | .[-1] |= sub("\n$"; "")')
                  echo "matrix=$JSON_MATRIX" >> $GITHUB_OUTPUT

    gosec-scan:
        runs-on: ubuntu-latest
        needs: set-matrix
        strategy:
            matrix:
                directory: ${{fromJson(needs.set-matrix.outputs.matrix)}}
        env:
            GO111MODULE: on
        steps:
            - name: Fetch Repository
              uses: actions/checkout@v4
            - name: Install Go
              uses: actions/setup-go@v5
              with:
                  go-version: 'oldstable'
                  check-latest: true
                  cache: false
            - name: Install Gosec
              run: go install github.com/securego/gosec/v2/cmd/gosec@latest
            - name: Run Gosec for ${{ matrix.directory }}
              working-directory: ./${{ matrix.directory }}
              run: gosec -exclude-dir=example ./...