Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci(gosec): silence G101 false positives on PAT context keys and scope const

Browse Source 
gosec G101 flags apiTokenCtxKey, apiTokenLastUsedCtxKey, and the
ScopeNotificationGroupWrite identifier as hardcoded credentials. They are
context-key names and a scope string, not secrets. Annotate them with
#nosec G101 (matching the existing JWTSecretEnvKey precedent) so the
gosec CI step passes without disabling the rule globally.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-31 08:16:55 +00:00
co-authored by cloudcode
parent 18c044d959
commit 401713bab5
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/api_token.go
+2 -2
View File
@@ -18,8 +18,8 @@ import (
const (
apiTokenSecretLength = 32 // 明文 token 随机部分长度（hex 编码前）
apiTokenCtxKey = "nz_api_token" // gin context 里存 *model.APIToken 的 key
apiTokenLastUsedCtxKey = "nz_api_token_used_marker" // 标记是否需要异步更新 last_used
apiTokenCtxKey = "nz_api_token" // #nosec G101 -- gin context key name, not a credential
apiTokenLastUsedCtxKey = "nz_api_token_used_marker" // #nosec G101 -- gin context key name, not a credential
apiTokenAuthSchemePrefix = "Bearer "
)