ci: remove duplicate gosec & lint fixes

[julienrbrt]

Description

GoSec job is broken, and we already run it in golangci-lint.

---

Author Checklist

All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.

I have...

• included the correct type prefix in the PR title, you can find examples of the prefixes below:
• confirmed ! in the type prefix if API or client breaking change
• targeted the correct branch (see PR Targeting)
• provided a link to the relevant issue or specification
• reviewed "Files changed" and left comments if necessary
• included the necessary unit and integration tests
• added a changelog entry to CHANGELOG.md
• updated the relevant documentation or specification, including comments for documenting Go code
• confirmed all CI checks have passed

Reviewers Checklist

All items are required. Please add a note if the item is not applicable and please add
your handle next to the items reviewed if you only reviewed selected items.

Please see Pull Request Reviewer section in the contributing guide for more information on how to review a pull request.

I have...

• confirmed the correct type prefix in the PR title
• confirmed all author checklist items have been addressed
• reviewed state machine logic, API design and naming, documentation is accurate, tests and test coverage

Summary by CodeRabbit

• Bug Fixes

  • Improved error handling in various test functions to enhance robustness and clarity in error reporting.

• New Features

  • Updated dependencies to the latest versions, potentially introducing new features and improvements.

• Refactor

  • Streamlined configuration settings for security linting, focusing on specific vulnerabilities.
  • Removed unnecessary fields from data structures to reduce complexity.

• Chores

  • Removed obsolete GitHub Actions workflow for automated security scanning.

[coderabbitai]

Walkthrough

Walkthrough

The changes in this pull request involve the deletion of a GitHub Actions workflow for the Gosec security scanner, modifications to the configuration of the GolangCI linter, and various updates across multiple Go source files. These updates include the removal of function fields in a struct, enhancements to error handling in test functions, and adjustments to return types in service methods. Additionally, the dependency version in the go.mod file has been updated. Overall, these changes reflect a shift in security scanning practices and improvements in code quality and maintainability.

Changes

File Path	Change Summary
.github/workflows/gosec.yml	Deleted: GitHub Actions workflow for Gosec security scanning.
.golangci.yml	Modified: Adjusted gosec settings, streamlined exclusions, and reformatted build tags for readability.
collections/collections.go	Removed: keyEncoder and valueEncoder fields from collectionSchemaCodec struct.
collections/indexing.go	Modified: Simplified conditional statements in ensureFieldNames function for clarity.
indexer/postgres/tests/postgres_test.go	Added: t.Helper() to testPostgresIndexer function for improved error reporting.
orm/model/ormdb/module_test.go	Modified: Changed return types in OpenKVStore, OpenMemoryStore, and ProvideTestRuntime methods to corestore.
runtime/v2/go.mod	Updated: Dependency version for cosmossdk.io/core from v1.0.0-alpha.1 to v1.0.0-alpha.2.
server/v2/cometbft/abci_test.go	Modified: Added error handling in TestConsensus_Query and marked setUpConsensus as a helper function.
server/v2/cometbft/commands.go	Modified: Reorganized import statements for clarity.
server/v2/cometbft/internal/mock/mock_store.go	Modified: Improved error handling in Query method of MockStore.
testutil/rest.go	Removed: Suppressed linting comment from GetRequest and PostRequest functions.

Possibly related PRs

• test(server/v2/cometbft): Add abci unit tests #21020: Adds unit tests for ABCI functionalities, enhancing robustness and security.
• refactor: decouple comet from modules #21382: Refactors the Comet module, potentially affecting security checks integration.
• build(deps): bump to core v1.0.0-alpha.1 and remove replaces #21603: Updates core dependency version, likely incorporating security features and fixes.
• fix(x/accounts/lockup): prevent double withdraw #21619: Removes Viper dependency from server components, simplifying configuration management.
• refactor: remove viper as a direct dependency #21635: Continues the effort to remove Viper, enhancing security through better dependency management.
• refactor(server/v2): kill viper from server components #21663: Further removes Viper, reducing reliance on external libraries and improving security posture.
• refactor(server/v2/cometbft): use only protov1 and backport #21084 #21681: Refactors CometBFT server to use only protov1, improving security and maintainability.

Suggested labels

C:core/testing, C:x/staking

---

Recent review details

Configuration used: .coderabbit.yml
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 766117c and 4e3350b.

Files ignored due to path filters (1)

• runtime/v2/go.sum is excluded by !**/*.sum

Files selected for processing (11)

• .github/workflows/gosec.yml (0 hunks)
• .golangci.yml (3 hunks)
• collections/collections.go (0 hunks)
• collections/indexing.go (1 hunks)
• indexer/postgres/tests/postgres_test.go (1 hunks)
• orm/model/ormdb/module_test.go (2 hunks)
• runtime/v2/go.mod (1 hunks)
• server/v2/cometbft/abci_test.go (3 hunks)
• server/v2/cometbft/commands.go (1 hunks)
• server/v2/cometbft/internal/mock/mock_store.go (1 hunks)
• testutil/rest.go (2 hunks)

Files not reviewed due to no reviewable changes (2)

• .github/workflows/gosec.yml
• collections/collections.go

Files skipped from review due to trivial changes (4)

• collections/indexing.go
• indexer/postgres/tests/postgres_test.go
• server/v2/cometbft/commands.go
• testutil/rest.go

Additional context used

Path-based instructions (3)

server/v2/cometbft/internal/mock/mock_store.go (1)

Pattern **/*.go: Review the Golang code for conformity with the Uber Golang style guide, highlighting any deviations.

orm/model/ormdb/module_test.go (2)

Pattern **/*.go: Review the Golang code for conformity with the Uber Golang style guide, highlighting any deviations.

---

Pattern **/*_test.go: "Assess the unit test code assessing sufficient code coverage for the changes associated in the pull request"

server/v2/cometbft/abci_test.go (2)

Pattern **/*.go: Review the Golang code for conformity with the Uber Golang style guide, highlighting any deviations.

---

Pattern **/*_test.go: "Assess the unit test code assessing sufficient code coverage for the changes associated in the pull request"

Additional comments not posted (9)

.golangci.yml (2)

6-8: LGTM!

The formatting change in the build-tags section improves readability without affecting functionality.

---

99-104: Verify the impact of the gosec configuration changes.

The modifications to the gosec settings seem reasonable and well-targeted. Excluding specific rules and adjusting confidence levels can help reduce false positives and focus on high-priority security issues. Setting exclude-generated to true is also a good practice to avoid unnecessary scrutiny of generated code.

However, it's important to verify that these changes do not inadvertently introduce security vulnerabilities in the codebase.

Please run the following script to analyze the impact of the gosec configuration changes:

This script runs gosec with the old and new configurations, stores the results, and compares them to identify any new issues introduced by the changes. Please review the diff output to ensure that no critical security vulnerabilities have been missed due to the configuration changes.

Verification successful

---

Verification of gosec Configuration Changes: No Critical Issues Found

The verification process indicates that the changes to the gosec configuration, specifically the exclusion of rules G101, G107, and G404, do not introduce significant security vulnerabilities into the codebase. The use of math/rand is primarily in test and simulation files, and no HTTP requests with variable URLs were found. The potential hardcoded credentials identified are likely variable names or constants rather than actual credentials.

• G101 (Hardcoded Credentials): No critical hardcoded credentials found.
• G107 (HTTP Requests with Variable URLs): No occurrences found.
• G404 (Weak Random Number Generator): Usage is limited to non-production code.

These findings support the decision to adjust the gosec configuration as proposed.

Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the impact of the `gosec` configuration changes on the codebase.

# Test 1: Run `gosec` with the old configuration and store the results.
cp .golangci.yml .golangci.yml.bak
git checkout HEAD~ .golangci.yml
golangci-lint run --no-config --disable-all -E gosec > gosec_old.txt

# Test 2: Run `gosec` with the new configuration and store the results.
mv .golangci.yml.bak .golangci.yml 
golangci-lint run --no-config --disable-all -E gosec > gosec_new.txt

# Test 3: Compare the results to identify any new issues introduced by the changes.
diff gosec_old.txt gosec_new.txt

# Cleanup
rm gosec_old.txt gosec_new.txt

Length of output: 477

---

Script:

#!/bin/bash
# Search for potential hardcoded credentials (G101)
rg --pcre2 '(?i)(password|secret|token|key)\s*=\s*["\']\w+["\']' -A 2

# Search for potential HTTP requests made with variable URLs (G107)
rg --pcre2 'http(s)?\.Client\s*\.\s*Do\s*\(' -A 2

# Search for use of weak random number generator (math/rand) (G404)
rg 'math/rand' -A 2

Length of output: 93

---

Script:

#!/bin/bash
# Search for potential hardcoded credentials (G101)
rg --pcre2 '(?i)(password|secret|token|key)\s*=\s*["\']\w+["\']' -A 2

# Search for potential HTTP requests made with variable URLs (G107)
rg --pcre2 'http(s)?\.Client\s*\.\s*Do\s*\(' -A 2

# Search for use of weak random number generator (math/rand) (G404)
rg 'math/rand' -A 2

Length of output: 93

---

Script:

#!/bin/bash
# Search for potential hardcoded credentials (G101)
rg --pcre2 "(?i)(password|secret|token|key)\s*=\s*['\"]\w+['\"]" -A 2

# Search for potential HTTP requests made with variable URLs (G107)
rg --pcre2 "http(s)?\.Client\s*\.\s*Do\s*\(" -A 2

# Search for use of weak random number generator (math/rand) (G404)
rg "math/rand" -A 2

Length of output: 20526

server/v2/cometbft/internal/mock/mock_store.go (1)

96-109: LGTM!

The error handling improvements in the Query method align with the best practices of the Go language. Returning an empty storev2.QueryResult along with the error is a common pattern in Go for indicating failures. The changes enhance the robustness of the method by ensuring proper error handling and do not introduce any new issues or deviate from the existing code style.

runtime/v2/go.mod (1)

17-17: Approve the dependency update but verify compatibility.

Updating the cosmossdk.io/core dependency to a newer alpha version (v1.0.0-alpha.2) is reasonable given the active development. However, it's important to ensure that this update doesn't introduce any breaking changes or compatibility issues in the runtime/v2 package.

I recommend reviewing the changelog or release notes of the cosmossdk.io/core module for any breaking changes introduced in v1.0.0-alpha.2. Also, consider running the existing tests of runtime/v2 package against this newer version to verify that everything still works as expected.

orm/model/ormdb/module_test.go (3)

363-365: LGTM!

The change in the return type from store.KVStore to corestore.KVStore is consistent with the alterations list and suggests a refactoring to streamline the store handling mechanisms.

---

367-369: LGTM!

The change in the return type from store.KVStore to corestore.KVStore is consistent with the alterations list and suggests a refactoring to streamline the store handling mechanisms, similar to the OpenKVStore method.

---

397-399: LGTM!

The change in the return type from store.KVStoreService to corestore.KVStoreService is consistent with the alterations list and reflects the refactoring to streamline the store handling mechanisms.

server/v2/cometbft/abci_test.go (2)

Line range hint 578-592: Improved error handling and alignment with Go's conventions.

The changes in the TestConsensus_Query function enhance the error handling and align with Go's idiomatic error handling conventions. Specifically:

• The error returned by ApplyChangeset is correctly captured and checked using require.NoError, ensuring the state changes are applied successfully.
• The assignment of the result from InitChain has been modified to capture the error, aligning with Go's error handling conventions.

These improvements contribute to the robustness and clarity of the test code.

---

Line range hint 594-635: Comprehensive test coverage.

The TestConsensus_Query function provides comprehensive test coverage for the Query method of the Consensus struct. It covers various scenarios, including:

• Testing an empty request
• Querying the store with a valid key
• Querying the store with a non-existent key

The test function verifies the expected behavior and error handling in each scenario using clear assertions. The comments provide good descriptions of each test case, enhancing the readability and maintainability of the test code.

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

• X
• Mastodon
• Reddit
• LinkedIn

Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai generate interesting stats about this repository and render them as a table.
  • @coderabbitai show all the console.log statements in this repository.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[alpe]

Nice cleanup! LGTM 👍