Johan Brandhorst-Satzkorn
0ef88d0f05
* Add semgrep rules Instrument our security scanner with the ability to use custom semgrep rules. This is inspired by the HVS teams use of semgrep. * semgrep: add rule to detect string interpolation in WithInfoMsg The event.WithInfoMsg function expects a set of key value tuples, but it can easily be misunderstood to accept string interpolation arguments. This check will error if any string interpolation verbs are used in calls to event.WithInfoMsg
25 lines
409 B
HCL
25 lines
409 B
HCL
# Copyright (c) HashiCorp, Inc.
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
repository {
|
|
go_modules = true
|
|
osv = true
|
|
secrets {
|
|
all = true
|
|
}
|
|
dependabot {
|
|
required = true
|
|
check_config = true
|
|
}
|
|
|
|
plugin "semgrep" {
|
|
use_git_ignore = true
|
|
exclude = ["*_test.go", "website/*", "testing/*"]
|
|
config = ["p/gosec", ".semgrep/"]
|
|
}
|
|
|
|
plugin "codeql" {
|
|
languages = ["go"]
|
|
}
|
|
}
|