Fix golangci-lint v2 config; emit govulncheck findings as CI annotations

- Fix .golangci.yml: move G204 exclusion to linters.settings.gosec.excludes
  (v2 schema dropped issues.exclude-rules in favour of per-linter settings)
- Remove now-redundant //nolint:gosec G204 annotations across all call sites
- govulncheck: parse JSON output and emit ::warning annotations so findings
  appear inline in the GitHub Actions UI and PR diff view

Author: parttimenerd

.github/workflows/build-and-snapshot.yml

@@ -77,13 +77,35 @@ jobs:
       - name: Run govulncheck
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
-          # Exit code 3 means vulnerabilities found; we report them but only fail on
-          # non-stdlib findings (stdlib-only issues require a Go toolchain major bump).
-          govulncheck -json . 2>&1 | tee govulncheck.json || true
-          if govulncheck . 2>&1 | grep -q "^Vulnerability"; then
-            echo "⚠️  govulncheck found vulnerabilities — review govulncheck.json"
-            govulncheck . 2>&1 || true
-          fi
+          # Run in JSON mode and emit GitHub Actions warning annotations for each finding.
+          # Exit code 3 means vulnerabilities found; remaining findings are stdlib-only
+          # (require Go 1.25.x) so we warn rather than fail.
+          govulncheck -json . 2>/dev/null | python3 -c "
+          import sys, json
+          for line in sys.stdin:
+              line = line.strip()
+              if not line:
+                  continue
+              try:
+                  obj = json.loads(line)
+              except json.JSONDecodeError:
+                  continue
+              finding = obj.get('finding')
+              if not finding:
+                  continue
+              osv_id = finding.get('osv', '')
+              summary = finding.get('summary', osv_id)
+              traces = finding.get('trace', [])
+              loc = ''
+              if traces:
+                  frame = traces[0]
+                  pos = frame.get('position', {})
+                  fname = pos.get('filename', '')
+                  line_no = pos.get('line', '')
+                  if fname:
+                      loc = f'file={fname},line={line_no},'
+              print(f'::warning {loc}title=govulncheck [{osv_id}]::{summary}')
+          " || true
 
       - name: Lint and format Go files
         run: ./scripts/lint-go.sh ci

.github/workflows/pr-validation.yml

@@ -49,13 +49,35 @@ jobs:
       - name: Run govulncheck
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
-          # Exit code 3 means vulnerabilities found; we report them but only fail on
-          # non-stdlib findings (stdlib-only issues require a Go toolchain major bump).
-          govulncheck -json . 2>&1 | tee govulncheck.json || true
-          if govulncheck . 2>&1 | grep -q "^Vulnerability"; then
-            echo "⚠️  govulncheck found vulnerabilities — review govulncheck.json"
-            govulncheck . 2>&1 || true
-          fi
+          # Run in JSON mode and emit GitHub Actions warning annotations for each finding.
+          # Exit code 3 means vulnerabilities found; remaining findings are stdlib-only
+          # (require Go 1.25.x) so we warn rather than fail.
+          govulncheck -json . 2>/dev/null | python3 -c "
+          import sys, json
+          for line in sys.stdin:
+              line = line.strip()
+              if not line:
+                  continue
+              try:
+                  obj = json.loads(line)
+              except json.JSONDecodeError:
+                  continue
+              finding = obj.get('finding')
+              if not finding:
+                  continue
+              osv_id = finding.get('osv', '')
+              summary = finding.get('summary', osv_id)
+              traces = finding.get('trace', [])
+              loc = ''
+              if traces:
+                  frame = traces[0]
+                  pos = frame.get('position', {})
+                  fname = pos.get('filename', '')
+                  line_no = pos.get('line', '')
+                  if fname:
+                      loc = f'file={fname},line={line_no},'
+              print(f'::warning {loc}title=govulncheck [{osv_id}]::{summary}')
+          " || true
 
       - name: Lint Go code
         run: ./scripts/lint-go.sh ci

.golangci.yml

@@ -45,6 +45,13 @@ linters:
     - gocritic
     - gosec            # Security-focused linter (shell commands, file perms, crypto)
 
+  settings:
+    gosec:
+      # exec.Command("cf", ...) — "cf" is a hardcoded binary; only SSH/CF args vary.
+      # exec.Command(javaPath, ...) — resolved from JAVA_HOME/PATH, not user input.
+      excludes:
+        - G204  # Subprocess launched with variable
+
 
   disable:
     # Disabled as requested
@@ -72,11 +79,3 @@ linters:
     - cyclop           # Check cyclomatic complexity
     - funlen           # Check function length
     - revive           # Fast, configurable, extensible linter
-
-issues:
-  exclude-rules:
-    # exec.Command("cf", ...) — "cf" is a hardcoded binary name; only args vary.
-    # exec.Command(javaPath, ...) — javaPath is resolved from JAVA_HOME or PATH, not user input.
-    # This plugin is by design a command-line wrapper that passes user args to remote tools.
-    - linters: [gosec]
-      text: "G204"  # Subprocess launched with variable

cf_cli_java_plugin.go

@@ -185,7 +185,7 @@ func (c *JavaPlugin) checkSSHConnectivity(appName string, appInstanceIndex int)
 	testArgs = append(testArgs, "-c", "echo ok")
 
 	c.logVerbosef("Checking SSH connectivity to app '%s'", appName)
-	cmd := exec.Command("cf", testArgs...) //nolint:gosec // "cf" is a hardcoded binary; only SSH args vary
+	cmd := exec.Command("cf", testArgs...)
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		c.logVerbosef("SSH connectivity check failed: %v", err)
@@ -1143,7 +1143,7 @@ func (c *JavaPlugin) execute(_ plugin.CliConnection, args []string) (string, err
 
 	cmdArgs := append([]string{"cf"}, fullCommand...)
 	c.logVerbosef("Executing command: %v", cmdArgs)
-	cmd := exec.Command(cmdArgs[0], cmdArgs[1:]...) //nolint:gosec // cmdArgs[0] is always "cf"; args are CF SSH arguments
+	cmd := exec.Command(cmdArgs[0], cmdArgs[1:]...)
 	outputBytes, err := cmd.CombinedOutput()
 	output := strings.TrimRight(string(outputBytes), "\n")
 	if err != nil {

jstall.go

@@ -218,7 +218,7 @@ func (c *JavaPlugin) executeJstall(appName string, jstallArgs string, appInstanc
 			testArgs = append(testArgs, "--app-instance-index", strconv.Itoa(appInstanceIndex))
 		}
 		testArgs = append(testArgs, "-c", "echo ok")
-		testCmd := exec.Command("cf", testArgs...) //nolint:gosec // "cf" is a hardcoded binary; only SSH args vary
+		testCmd := exec.Command("cf", testArgs...)
 		testOutput, testErr := testCmd.CombinedOutput()
 		if testErr != nil {
 			outputStr := strings.TrimSpace(string(testOutput))
@@ -229,7 +229,7 @@ func (c *JavaPlugin) executeJstall(appName string, jstallArgs string, appInstanc
 		}
 	}
 
-	cmd := exec.Command(javaPath, args...) //nolint:gosec // javaPath is resolved from JAVA_HOME or PATH, not user input
+	cmd := exec.Command(javaPath, args...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	cmd.Stdin = os.Stdin

utils/cfutils.go

@@ -105,15 +105,15 @@ func readAppEnv(app string) ([]byte, error) {
 		return nil, err
 	}
 
-	env, err := exec.Command("cf", "curl", fmt.Sprintf("/v3/apps/%s/env", strings.Trim(string(guid), "\n"))).Output() //nolint:gosec // "cf" is hardcoded; GUID is from CF API output
+	env, err := exec.Command("cf", "curl", fmt.Sprintf("/v3/apps/%s/env", strings.Trim(string(guid), "\n"))).Output()
 	if err != nil {
 		return nil, err
 	}
 	return env, nil
 }
 
 func checkUserPathAvailability(app string, path string) (bool, error) {
-	output, err := exec.Command("cf", "ssh", app, "-c", "[[ -d \""+path+"\" && -r \""+path+"\" && -w \""+path+"\" ]] && echo \"exists and read-writeable\"").Output() //nolint:gosec // "cf" is hardcoded; path is user-supplied --container-dir validated by CF SSH
+	output, err := exec.Command("cf", "ssh", app, "-c", "[[ -d \""+path+"\" && -r \""+path+"\" && -w \""+path+"\" ]] && echo \"exists and read-writeable\"").Output()
 	if err != nil {
 		return false, err
 	}
@@ -160,7 +160,7 @@ func CheckRequiredTools(app string) (bool, error) {
 	if err != nil {
 		return false, errors.New(FindReasonForAccessError(app))
 	}
-	output, err := exec.Command("cf", "curl", "/v3/apps/"+strings.TrimSuffix(string(guid), "\n")+"/ssh_enabled").Output() //nolint:gosec // "cf" is hardcoded; GUID is from CF API output
+	output, err := exec.Command("cf", "curl", "/v3/apps/"+strings.TrimSuffix(string(guid), "\n")+"/ssh_enabled").Output()
 	if err != nil {
 		return false, err
 	}