ci: consolidate release pipeline and add PR security gate

.github/workflows/security.yml

@@ -0,0 +1,43 @@
+name: Security
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  gosec:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@v2.25.0
+        with:
+          args: '-severity medium -confidence medium ./...'
+
+  bandit:
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Run Bandit Security Scanner
+        run: |
+          uv tool run --from 'bandit[toml]' bandit \
+            -r data_platform/pipelines \
+            --severity-level medium \
+            --confidence-level medium

.goreleaser.yml

@@ -60,6 +60,9 @@ changelog:
     exclude:
       - "^docs:"
       - "^test:"
+      - "^ci:"
+      - "^chore:"
+      - "^build:"
 
 homebrew_casks:
   - name: poke-cli

Dockerfile

@@ -15,6 +15,7 @@ FROM rust:1-alpine AS rust-build
 
 WORKDIR /build
 
+# hadolint ignore=DL3018
 RUN apk add --no-cache build-base
 
 COPY services/Cargo.toml services/Cargo.lock ./services/
@@ -26,6 +27,7 @@ RUN cargo build --release --manifest-path services/Cargo.toml --bin poke-cache
 FROM alpine:3.24
 
 # Installing only necessary packages and remove them after use
+# hadolint ignore=DL3018
 RUN apk add --no-cache shadow && \
     addgroup -S poke_group && adduser -S poke_user -G poke_group && \
     sed -i 's/^root:.*/root:!*:0:0:root:\/root:\/sbin\/nologin/' /etc/passwd && \

cli.go

@@ -214,7 +214,7 @@ func runCLI(args []string) int {
 var exit = os.Exit
 
 func isInteractive() bool {
-	return term.IsTerminal(int(os.Stdin.Fd())) && term.IsTerminal(int(os.Stdout.Fd()))
+	return term.IsTerminal(int(os.Stdin.Fd())) && term.IsTerminal(int(os.Stdout.Fd())) // #nosec G115
 }
 
 func saveConfig(cfg flags.Config) {

cmd/types/damage_table.go

@@ -40,7 +40,7 @@ func DamageTable(typesName string, endpoint string) (string, error) {
 	out.WriteString(styling.StyleBold.Render("Damage Chart:"))
 	out.WriteString("\n")
 
-	physicalWidth, _, _ := term.GetSize(uintptr(int(os.Stdout.Fd())))
+	physicalWidth, _, _ := term.GetSize(uintptr(int(os.Stdout.Fd()))) // #nosec G115
 	doc := strings.Builder{}
 
 	// Helper function to build list items

cmd/utils/web.go

@@ -22,13 +22,13 @@ func Open(url string) tea.Cmd {
 		switch runtime.GOOS {
 		case "windows":
 			browserCmd = "cmd"
-			openCmd = exec.Command("cmd", "/c", "start", url) //nolint:gosec
+			openCmd = exec.Command("cmd", "/c", "start", url) // #nosec G204
 		case "darwin":
 			browserCmd = "open"
-			openCmd = exec.Command("open", url)
+			openCmd = exec.Command("open", url) // #nosec G204
 		default:
 			browserCmd = "xdg-open"
-			openCmd = exec.Command("xdg-open", url)
+			openCmd = exec.Command("xdg-open", url) // #nosec G204
 		}
 
 		if _, err := exec.LookPath(browserCmd); err != nil {

connections/cache.go

@@ -71,7 +71,7 @@ func cachedFetch(url string) ([]byte, error) {
 		warnNoCache()
 		return directFetch(url)
 	}
-	out, err := exec.Command(path, "get", url).Output()
+	out, err := exec.Command(path, "get", url).Output() // #nosec G204
 	if err != nil {
 		return directFetch(url)
 	}

docs/Infrastructure_Guide/local-deployment.md

@@ -196,7 +196,7 @@ The above `yml` defines the structure for the raw `series` table from the `stagi
 Soda and its components needed for the project can be installed with `uv`:
 
 1. Install Soda Core with PostgreSQL connector since Supabase uses PostgreSQL.
-   Other [connectors](https://github.com/sodadata/soda-core/blob/main/docs/installation.md#compatibility) can be used.
+   Other [connectors](https://github.com/sodadata/soda-core/blob/v3/docs/installation.md#compatibility) can be used.
 ```shell
    uv add soda-core-postgres
 ```

flags/config.go

@@ -75,7 +75,7 @@ func Load() (Config, bool, error) {
 
 func LoadFrom(path string) (Config, bool, error) {
 	cfg := Defaults()
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) // #nosec G304
 	if errors.Is(err, fs.ErrNotExist) {
 		return cfg, true, nil
 	}
@@ -105,7 +105,7 @@ func SaveTo(path string, cfg Config) error {
 		return err
 	}
 	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return err
 	}
 	tmp, err := os.CreateTemp(dir, "config-*.toml")

styling/styling.go

@@ -110,7 +110,7 @@ func init() {
 }
 
 func HasDarkBackground() bool {
-	if !term.IsTerminal(int(os.Stdin.Fd())) || !term.IsTerminal(int(os.Stdout.Fd())) {
+	if !term.IsTerminal(int(os.Stdin.Fd())) || !term.IsTerminal(int(os.Stdout.Fd())) { // #nosec G115
 		return true
 	}
 	return lipgloss.HasDarkBackground(os.Stdin, os.Stdout)