From 401713bab59f8110814d91f0c6e1f3d4854e195a Mon Sep 17 00:00:00 2001 From: naiba Date: Sun, 31 May 2026 08:16:55 +0000 Subject: [PATCH] ci(gosec): silence G101 false positives on PAT context keys and scope const gosec G101 flags apiTokenCtxKey, apiTokenLastUsedCtxKey, and the ScopeNotificationGroupWrite identifier as hardcoded credentials. They are context-key names and a scope string, not secrets. Annotate them with #nosec G101 (matching the existing JWTSecretEnvKey precedent) so the gosec CI step passes without disabling the rule globally. Co-authored-by: cloudcode --- cmd/dashboard/controller/api_token.go | 4 ++-- model/api_token.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/dashboard/controller/api_token.go b/cmd/dashboard/controller/api_token.go index d4da43b3..edb36f3a 100644 --- a/cmd/dashboard/controller/api_token.go +++ b/cmd/dashboard/controller/api_token.go @@ -18,8 +18,8 @@ import ( const ( apiTokenSecretLength = 32 // 明文 token 随机部分长度（hex 编码前） - apiTokenCtxKey = "nz_api_token" // gin context 里存 *model.APIToken 的 key - apiTokenLastUsedCtxKey = "nz_api_token_used_marker" // 标记是否需要异步更新 last_used + apiTokenCtxKey = "nz_api_token" // #nosec G101 -- gin context key name, not a credential + apiTokenLastUsedCtxKey = "nz_api_token_used_marker" // #nosec G101 -- gin context key name, not a credential apiTokenAuthSchemePrefix = "Bearer " ) diff --git a/model/api_token.go b/model/api_token.go index 030052b7..18e7be94 100644 --- a/model/api_token.go +++ b/model/api_token.go @@ -64,7 +64,7 @@ const ( ScopeNotificationDelete = "nezha:notification:delete" ScopeNotificationGroupRead = "nezha:notification-group:read" - ScopeNotificationGroupWrite = "nezha:notification-group:write" + ScopeNotificationGroupWrite = "nezha:notification-group:write" // #nosec G101 -- scope identifier, not a credential ScopeNotificationGroupDelete = "nezha:notification-group:delete" ScopeTransferRead = "nezha:transfer:read"