From 35fc24e2b2da6745db9cd8fb0bb8e0353fa3624f Mon Sep 17 00:00:00 2001 From: naiba Date: Tue, 26 May 2026 05:27:46 +0000 Subject: [PATCH] ci(gosec): mark jwt secret env var name as non-secret Gosec G101 treats the environment variable name NZ_JWTSECRETKEY as a hardcoded secret value. Keep the env-first JWT secret behavior unchanged and annotate the constant so CI only suppresses this false positive. Co-authored-by: naiba/CloudCode Co-authored-by: cloudcode --- model/config.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/model/config.go b/model/config.go index b0fc1e36..c939a583 100644 --- a/model/config.go +++ b/model/config.go @@ -21,7 +21,7 @@ import ( // signing key. When set, the dashboard never writes the key to disk and the // version-driven rotation in RotateJWTSecretKeyIfNeeded is skipped so that // rotation is fully controlled by the operator / KMS. -const JWTSecretEnvKey = "NZ_JWTSECRETKEY" +const JWTSecretEnvKey = "NZ_JWTSECRETKEY" // #nosec G101 -- environment variable name, not a hardcoded secret value. const ( ConfigUsePeerIP = "NZ::Use-Peer-IP"