Merge branch 'ci-vulnerability-check' into 'main'

Add CI step for Go vulnerability check

See merge request !43

.gitlab-ci.yml

@@ -16,7 +16,7 @@ include:
   - template: 'Workflows/Branch-Pipelines.gitlab-ci.yml'
 
 lint:
-  image: golangci/golangci-lint:v1.44.2
+  image: golangci/golangci-lint:v1.49.0
   stage: test
   tags:
     - amd64-docker
@@ -28,13 +28,26 @@ lint:
     - cd /go/src/code.vereign.com/${CI_PROJECT_PATH}
 
 unit tests:
-  image: golang:1.17.7
+  image: golang:1.19
   extends: .gotest
   stage: test
   tags:
     - amd64-docker
   before_script: []
 
+govulncheck:
+  image: golang:1.19
+  stage: test
+  tags:
+    - amd64-docker
+  before_script:
+    - ln -s /builds /go/src/code.vereign.com
+    - cd /go/src/code.vereign.com/${CI_PROJECT_PATH}
+  script:
+    - go version
+    - go install golang.org/x/vuln/cmd/govulncheck@latest
+    - govulncheck ./...
+
 amd64:
   extends: .docker-build
   stage: build

.golangci.yml

@@ -12,7 +12,6 @@ linters:
   enable:
     - megacheck
     - govet
-    - deadcode
     - errcheck
     - goconst
     - gocyclo
@@ -22,10 +21,9 @@ linters:
     - ineffassign
     - nakedret
     - staticcheck
-    - structcheck
     - unconvert
-    - varcheck
     - vet
     - vetshadow
     - misspell
     - staticcheck
+    - unused

cmd/policy/main.go

@@ -166,11 +166,12 @@ func main() {
 
 	var handler http.Handler = mux
 	srv := &http.Server{
-		Addr:         cfg.HTTP.Host + ":" + cfg.HTTP.Port,
-		Handler:      handler,
-		IdleTimeout:  cfg.HTTP.IdleTimeout,
-		ReadTimeout:  cfg.HTTP.ReadTimeout,
-		WriteTimeout: cfg.HTTP.WriteTimeout,
+		Addr:              cfg.HTTP.Host + ":" + cfg.HTTP.Port,
+		Handler:           handler,
+		ReadHeaderTimeout: cfg.HTTP.ReadTimeout,
+		IdleTimeout:       cfg.HTTP.IdleTimeout,
+		ReadTimeout:       cfg.HTTP.ReadTimeout,
+		WriteTimeout:      cfg.HTTP.WriteTimeout,
 	}
 
 	g, ctx := errgroup.WithContext(context.Background())
@@ -236,7 +237,7 @@ func exposeMetrics(addr string, logger *zap.Logger) {
 	promMux := http.NewServeMux()
 	promMux.Handle("/metrics", promhttp.Handler())
 	logger.Info(fmt.Sprintf("exposing prometheus metrics at %s/metrics", addr))
-	if err := http.ListenAndServe(addr, promMux); err != nil {
+	if err := http.ListenAndServe(addr, promMux); err != nil { //nolint:gosec
 		logger.Error("error exposing prometheus metrics", zap.Error(err))
 	}
 }

deployment/ci/Dockerfile

-FROM golang:1.17.8-alpine3.15 as builder
+FROM golang:1.19-alpine3.15 as builder
 
 ENV GOPRIVATE=code.vereign.com
 

deployment/compose/Dockerfile

-FROM golang:1.17.8
+FROM golang:1.19
 
 ENV GO111MODULE=on
 ENV GOPRIVATE=code.vereign.com