From 11e9206c21eccd0d8e6acbe874a87ffb4d40ae88 Mon Sep 17 00:00:00 2001 From: sneak Date: Fri, 7 Aug 2026 17:00:20 +0000 Subject: [PATCH] fix: suppress gosec G703 false positive on state_dir probe removal The pinned CI linter (golangci-lint v2.10.1) flags os.Remove(probePath) in ensureStateDirWritable as G703 path traversal via taint analysis. probePath comes from os.CreateTemp inside the StateDir that the probe just validated, so the taint finding is a false positive; suppress it with a justified nolint comment matching the existing precedent in loadConfigFile. Verified against the pinned linter version via the Dockerfile lint stage (0 issues). --- internal/config/config.go | 1 + 1 file changed, 1 insertion(+) diff --git a/internal/config/config.go b/internal/config/config.go index 00b1061..6a3af39 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -206,6 +206,7 @@ func (c *Config) ensureStateDirWritable() error { "state_dir", probePath, err) } + //nolint:gosec // G703: probePath comes from os.CreateTemp inside the just-validated StateDir if err := os.Remove(probePath); err != nil { return fmt.Errorf("config key %q: cannot remove probe file %q: %w", "state_dir", probePath, err)