Update go version, switch to Makefile-based gosec

.github/workflows/main.yml

@@ -10,18 +10,15 @@ on:
     branches:
       - "*"
 
-env:
-  GOLANG_VERSION: "1.21"
-
 jobs:
   unit-tests:
     name: Unit tests running
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: ${{ env.GOLANG_VERSION }}
+          go-version-file: './go.mod'
 
       - name: Checkout code
         uses: actions/[email protected]
@@ -31,13 +28,13 @@ jobs:
           make test
 
   linting:
-    name: Go code linting
+    name: Go code lint and gosec
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: ${{ env.GOLANG_VERSION }}
+          go-version-file: './go.mod'
 
       - name: Checkout code
         uses: actions/[email protected]
@@ -48,31 +45,22 @@ jobs:
           version: latest
           args: --verbose --timeout 6m
 
+      - name: Run gosec
+        run: |
+          make gosec
+
   build:
     name: Build creation
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: ${{ env.GOLANG_VERSION }}
+          go-version-file: './go.mod'
 
       - name: Checkout code
         uses: actions/[email protected]
 
       - name: Build creation
         run: |
           make build
-
-  gosec:
-    runs-on: ubuntu-latest
-    env:
-      GO111MODULE: on
-      GOFLAGS: -buildvcs=false
-    steps:
-      - name: Checkout Source
-        uses: actions/checkout@v3
-      - name: Run Gosec Security Scanner
-        uses: securego/gosec@master
-        with:
-          args: ./...

Makefile

@@ -34,3 +34,26 @@ test: ## Run tests.
 .PHONY: test-e2e
 test-e2e: ## Run e2e tests.
 	go test -v -p=1 -timeout=20m -race -count=1 -coverprofile=coverage.out ./tests/e2e
+
+.PHONY: gosec
+gosec: go_sec
+	$(GO_SEC) -exclude-dir=hack ./...
+
+GO_SEC = $(shell pwd)/bin/gosec
+go_sec: ## Download gosec locally if necessary.
+	$(call go-get-tool,$(GO_SEC),github.com/securego/gosec/v2/cmd/gosec@latest)
+
+# go-get-tool will 'go install' any package $2 and install it to $1.
+PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
+define go-get-tool
+@[ -f $(1) ] || { \
+set -e ;\
+TMP_DIR=$$(mktemp -d) ;\
+cd $$TMP_DIR ;\
+go mod init tmp ;\
+echo "Downloading $(2)" ;\
+GOBIN=$(PROJECT_DIR)/bin go install $(2) ;\
+rm -rf $$TMP_DIR ;\
+}
+endef
+