ci: document how the embedded gosec policy differs from the standalone gate

[cristim]

Closes #2152

Summary

I compared the gosec linter embedded in golangci-lint against the standalone gosec gate, scripts/run-gosec.sh, which CI, pre-commit and make security-scan-go all use. The embedded set turns out to be a deliberate subset of the standalone gate. Neither has a mistake to fix, so this PR documents the difference instead of changing either one. It adds a 7-line comment above the gosec settings in .golangci.yml and changes no config values.

	Embedded (golangci)	Standalone (run-gosec.sh)
Rules	G104 excluded (.golangci.yml:52-53); the legacy and common-false-positives presets also drop G301/G302/G304, among others	all default rules, no config file
Severity / confidence	medium and above (:54-55)	no threshold
Tests	_test.go excluded (:94-99)	not scanned (-tests defaults to false)
Generated files	_gen.go and generated: lax excluded	not excluded
#nosec	honored	honored

The comment states that a clean golangci run does not imply a clean gosec run, and names scripts/run-gosec.sh as the enforcing gate. Nothing about the security gate changes.

Evidence

• Fixture, run through both callers (golangci-lint v2.10.1 and the pinned gosec v2.28.0, in a scratch module that has since been deleted):
  • golangci reported G501, G401 and G115.
  • Standalone reported those three plus G304, G302, G301 and G104 (twice).
  • Both honored a #nosec G304 line.
  • Neither reported the _test.go file.
• Checks: golangci-lint run ./... reports 0 issues, golangci-lint config verify passes, pre-commit run --files .golangci.yml passes, and scripts/test-git-secrets-allowlist.sh passes 44/44.
• Review: an independent non-author reviewer (sonnet, high) checked every sentence of the comment against .golangci.yml, run-gosec.sh, and the golangci-lint v2.10.1 preset source (exclusion_presets.go), across two passes. No actionable findings at ef116d2f.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 38 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 67 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 1f37f13c-4bb6-428e-b19e-20c79f27f92e

📥 Commits

Reviewing files that changed from the base of the PR and between b514b37 and da334d6.

📒 Files selected for processing: 1

• .golangci.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent review verdict: CLEAN at da334d6

Reviewer: fresh Claude agent (Sonnet, high effort), not the author, cold brief. Coordinator: claude-cc-reviewer.

Comment-only: the diff of .golangci.yml is +7 comment lines (44-50), with no key changes.

Claims checked against the config:

• Standalone gate: ci.yml:371-382 runs scripts/run-gosec.sh, which pre-commit (gosec-hook.sh:18) and the Makefile (:87) also call. It passes only -fmt and -out (run-gosec.sh:44-54), so "all rules, all severities, no config file, tests omitted" is true.
• Embedded: G104 is excluded (:52-53), severity and confidence are medium (:54-55), and gosec is skipped in _test.go (:93-99). All of this matches the comment.
• ci: assess embedded gosec policy against the standalone gate #2152: it asks to assess and then document or align, so a documentation PR closing it is fair.

Notes (non-blocking):

1. Lines 47-48 list the golangci-lint presets as dropping G301/G302/G304. In v2.10.1 (exclusion_presets.go) they also drop G103, G204 and G307. G204 is subprocess-with-variable, which matters for a security-tuning reader. The comment is incomplete rather than wrong; a one-line follow-up would make it complete.
2. The embedded config also sets a custom G101 pattern (:56-59) that the standalone scan lacks. The comment doesn't mention it.

Gate: labels are mirrored from #2152. Merge once CI is green and the CodeRabbit gate is met. (claude-cc-reviewer)

[cristim]

CR waived: quota, adversarial review + local verification + green CI (per CLAUDE.md:172-173). CodeRabbit posted 'Review limit reached'. Gate at da334d6: CLEAN verdict, CI green, mergeability CLEAN. (claude-cc-reviewer)