Integrating CodeShip With Gosec for Go Security Analysis

Gosec exists to help spot problems right in your Go source code, such as hard coded passwords, personal access tokens, insecure random number seeds and more.

Their documentation does a great job of providing more information, in addition to the setup instructions below.

To use Gosec with your CloudBees CodeShip Basic project, you’ll need to build Go in your project’s setup commands. You can do this by selecting Go from the list of languages, or including a command similar to the below in your instructions:

From there, simply install Gosec and specify the rules you need via your project’s test or deployment commands, as seen below:

Note that this example uses a repo provided by a CloudBees team member, but you can develop your own repo for long-term use.

To use Gosec with your CloudBees CodeShip Pro project, you’ll need to have Go accessible either via an image you’re using or a Dockerfile you’re building in your codeship-services.yml file.

An example set of instructions to customize and include in your Dockerfile is below, if you’re not already including Go:

From there, simply install Gosec and specify the rules you need via a script you call in your project’s codeship-steps.yml file.

For instance, you can take the below code and store it as a script in your repository as gosec.sh:

Note that this example uses a repo provided by a CloudBees team member, but you can develop your own repo for long-term use.

Next, you can call this script as a step via your codeship-steps.yml file: