fix(gosec): use 0750 instead of 0755 for MkdirAll (G301)#262
Merged
Conversation
gosec G301 expects directory permissions 0750 or less. The //nolint:gosec directive only works for golangci-lint, not for the standalone gosec Security Scan CI job.
isaquepinheiro
added a commit
to isaquepinheiro/boss
that referenced
this pull request
Jul 22, 2026
…ect writers
golangci-lint flagged this PR's additions to root.go/new.go for funlen,
gocognit, nestif, goconst, gosec and revive. The fixes are behaviour
preserving:
root.go
- Execute() was 108 lines (funlen limit 100). The command wiring and the
help-group pass moved into registerCommands/applyCommandGroups, and the
help/version fast-path detection into isHelpOrVersionInvocation. The
ordering guarantee that the comment already documented is kept: every
command, config.RegisterCmd included, is registered before the grouping
pass, so none of them ends up in cobra's "Additional Commands" block.
- Command names and group identifiers are now constants shared with the
command files, instead of literals repeated across the switch (goconst).
new.go
- doCreateProject had cognitive complexity 37 and a 16-deep nested block.
The per-IDE file writing moved into writeLazarusProjectFiles and
writeDelphiProjectFiles; the decision logic is untouched.
- Generated project files are written with 0600 instead of 0644 (gosec
G306), matching the mode already used everywhere else in the repo and
the 0750 MkdirAll convention adopted upstream in HashLoad#262.
- "src", "lazarus" and "delphi" became constants; packageJsonPath became
packageJSONPath (revive var-naming).
- The long <Import> line in dprojTemplate carries a //nolint:lll: wrapping
it would change the generated .dproj.
dependencies.go
- The --version flag name uses the shared flagNameVersion constant so the
literal no longer trips goconst.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
isaquepinheiro
added a commit
to isaquepinheiro/boss
that referenced
this pull request
Jul 22, 2026
… tighten modes
Two real defects the linters surfaced, plus the complexity/style debt of the
same files.
Defects
- runWorkspaceClone ended with os.Exit(1) while the manifest response body
was only closed by a defer, which os.Exit never runs (gocritic
exitAfterDefer). The HTTP call moved into fetchWorkspaceManifest, so the
body is closed before control returns to the function that may exit.
- Every response body Close and the directory handle in isDirPopulated had
their errors dropped silently (errcheck); they are now explicitly
discarded in a deferred closure.
Context propagation (noctx)
- The portal calls use http.NewRequestWithContext and every git/boss
subprocess uses exec.CommandContext, fed by cobra's cmd.Context(). No
behaviour changes today (the root command runs with a background
context), but the subprocesses and requests are now cancellable.
Complexity, without touching decision logic
- runWorkspaceClone (cognitive complexity 61) keeps its loop and its
success/skip/fail accounting; the per-repository work moved into
cloneWorkspaceRepo, createCodenameBranch and runBossInstall.
- runWorkspaceUpdate and runWorkspacePush had the same 4-level repository
discovery inlined twice; both now call discoverWorkspaceRepos, which
walks the directories in exactly the previous order.
- runWorkspaceStatus and injectDprojPaths delegate to findWorkspaceRootRepo,
collectDependencySearchPaths and mergeDprojSearchPaths.
- The status/ahead-behind git invocations share one gitCapture helper.
gosec
- MkdirAll 0755 -> 0750 and WriteFile 0644 -> 0600, following HashLoad#262 and the
modes already used across the repo. The .dproj rewrite keeps the mode of
the existing file, since os.WriteFile only applies perm on creation.
- G304/G703 on paths that come from the portal manifest, from a Glob inside
the cloned workspace or from an explicit --file/--spec flag, and G117 on
the config marshal (persisting the token locally is the point of the
file), are annotated with //nolint:gosec and a reason, as utils/hash.go
and git_native.go already do.
Style
- PortalBaseUrl/updatedXml/bossJsonPath/CloneUrl/SshUrl/PrUrl renamed to
the Go initialism spelling (revive); the JSON tags are untouched, so the
wire format with the portal is unchanged.
- Exported manifest types got doc comments; the status/HTTP if-else chains
became switches; long lines wrapped; the cra securityEmail package global
became a local flag variable passed to runCraInit.
- fmt.Printf/fmt.Print replaced by fmt.Fprint(f) on os.Stdout (forbidigo).
msg.Info was not an option: it appends a line break, and the CRA wizard
prompt has to stay on the same line as the answer.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes gosec G301 in Security Scan CI job.
The
//nolint:gosecdirective only works for golangci-lint, not for the standalone gosec (securego/gosec@master) used in the Security Scan CI job. Changing0755to0750satisfies both.