From 8b39d45efb0be062e8de118215e29d5d2a1cdae6 Mon Sep 17 00:00:00 2001 From: Jonathan West Date: Fri, 23 Oct 2026 08:06:46 -0400 Subject: [PATCH] chore: fix new unnecessary gosec warnings Signed-off-by: Jonathan West --- argocd-operator/controllers/argocd/dex.go | 2 +- argocd-operator/controllers/argocd/image_updater.go | 2 +- .../controllers/argocdagent/agent/deployment.go | 2 +- argocd-operator/controllers/argocdagent/deployment.go | 4 ++-- .../tests/auxiliary/smtplistener/cmd/listener/serve.go | 8 ++++++-- argocd-operator/tests/ginkgo/fixture/argocd/fixture.go | 1 + argocd-operator/tests/ginkgo/fixture/gitserver/repo.go | 1 + 7 files changed, 13 insertions(+), 7 deletions(-) diff --git a/argocd-operator/controllers/argocd/dex.go b/argocd-operator/controllers/argocd/dex.go index 963cdb1dfeb..06a0d514b7d 100644 --- a/argocd-operator/controllers/argocd/dex.go +++ b/argocd-operator/controllers/argocd/dex.go @@ -290,7 +290,7 @@ func (r *ReconcileArgoCD) getOpenShiftDexConfig(cr *argoproj.ArgoCD) (string, er Config: map[string]any{ "issuer": "https://kubernetes.default.svc", // TODO: Should this be hard-coded? "clientID": getDexOAuthClientID(cr), - "clientSecret": "$oidc.dex.clientSecret", + "clientSecret": "$oidc.dex.clientSecret", // #nosec G101 -- this is a Dex config reference placeholder resolved at runtime, not a credential "redirectURI": redirectURI, "insecureCA": true, // TODO: Configure for openshift CA, "groups": groups, diff --git a/argocd-operator/controllers/argocd/image_updater.go b/argocd-operator/controllers/argocd/image_updater.go index 1dd6a65dfc7..bb2ad0c81ac 100644 --- a/argocd-operator/controllers/argocd/image_updater.go +++ b/argocd-operator/controllers/argocd/image_updater.go @@ -701,7 +701,7 @@ func (r *ReconcileArgoCD) reconcileImageUpdaterDeployment(cr *argoproj.ArgoCD, s Name: "ssh-signing-key", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "ssh-git-creds", + SecretName: "ssh-git-creds", // #nosec G101 -- this is a Secret resource name, not a credential Optional: new(true), }, }, diff --git a/argocd-operator/controllers/argocdagent/agent/deployment.go b/argocd-operator/controllers/argocdagent/agent/deployment.go index 9862eb5b3fd..f0163d7ab35 100644 --- a/argocd-operator/controllers/argocdagent/agent/deployment.go +++ b/argocd-operator/controllers/argocdagent/agent/deployment.go @@ -199,7 +199,7 @@ func buildVolumes() []corev1.Volume { Name: "userpass-passwd", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-agent-agent-userpass", + SecretName: "argocd-agent-agent-userpass", // #nosec G101 -- this is a Secret resource name, not a credential Items: []corev1.KeyToPath{ { Key: "credentials", diff --git a/argocd-operator/controllers/argocdagent/deployment.go b/argocd-operator/controllers/argocdagent/deployment.go index dab1e6918e6..65ed63b7bfe 100644 --- a/argocd-operator/controllers/argocdagent/deployment.go +++ b/argocd-operator/controllers/argocdagent/deployment.go @@ -221,7 +221,7 @@ func buildVolumes() []corev1.Volume { Name: "jwt-secret", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-agent-jwt", + SecretName: "argocd-agent-jwt", // #nosec G101 -- this is a Secret resource name, not a credential Items: []corev1.KeyToPath{ { Key: "jwt.key", @@ -236,7 +236,7 @@ func buildVolumes() []corev1.Volume { Name: "userpass-passwd", VolumeSource: corev1.VolumeSource{ Secret: &corev1.SecretVolumeSource{ - SecretName: "argocd-agent-principal-userpass", + SecretName: "argocd-agent-principal-userpass", // #nosec G101 -- this is a Secret resource name, not a credential Items: []corev1.KeyToPath{ { Key: "passwd", diff --git a/argocd-operator/tests/auxiliary/smtplistener/cmd/listener/serve.go b/argocd-operator/tests/auxiliary/smtplistener/cmd/listener/serve.go index 1a623479240..8cc3911c42b 100644 --- a/argocd-operator/tests/auxiliary/smtplistener/cmd/listener/serve.go +++ b/argocd-operator/tests/auxiliary/smtplistener/cmd/listener/serve.go @@ -102,9 +102,13 @@ func sigHandler() { // Keep the daemon busy by waiting for signals to come for sig := range signalChannel { if sig == syscall.SIGHUP { - d.ReloadConfigFile(configPath) + if err := d.ReloadConfigFile(configPath); err != nil { + mainlog.WithError(err).Error("Failed reloading config file") + } } else if sig == syscall.SIGUSR1 { - d.ReopenLogs() + if err := d.ReopenLogs(); err != nil { + mainlog.WithError(err).Error("Failed reopening logs") + } } else if sig == syscall.SIGTERM || sig == syscall.SIGQUIT || sig == syscall.SIGINT { mainlog.Infof("Shutdown signal caught") d.Shutdown() diff --git a/argocd-operator/tests/ginkgo/fixture/argocd/fixture.go b/argocd-operator/tests/ginkgo/fixture/argocd/fixture.go index d5955a051a6..b1c578dbf5a 100644 --- a/argocd-operator/tests/ginkgo/fixture/argocd/fixture.go +++ b/argocd-operator/tests/ginkgo/fixture/argocd/fixture.go @@ -360,6 +360,7 @@ func StreamFromArgoCDEventSourceURL(ctx context.Context, eventSourceAPIURL strin req = req.WithContext(ctx) + // #nosec G124 -- this is an outbound request cookie (client to server); Secure/HttpOnly/SameSite are response-only attributes and don't apply here cookie := &http.Cookie{ Name: "argocd.token", Value: sessionToken, // session token diff --git a/argocd-operator/tests/ginkgo/fixture/gitserver/repo.go b/argocd-operator/tests/ginkgo/fixture/gitserver/repo.go index bbb3a57ddbd..10c88596784 100644 --- a/argocd-operator/tests/ginkgo/fixture/gitserver/repo.go +++ b/argocd-operator/tests/ginkgo/fixture/gitserver/repo.go @@ -139,6 +139,7 @@ func (r *Repo) git(args ...string) (string, error) { return "", fmt.Errorf("repository has not been cloned") } + // #nosec G204 cmd := exec.Command("git", args...) cmd.Dir = r.cloneDir.Name() if r.transport == TransportHTTPS {