False positive G307: Deferring unsafe method "Close" on type "*os.File" (gosec) linting error

[atc0005]

These linting errors were surfaced from an upgraded golangci-lint:

internal/config/file.go:43:3: G307: Deferring unsafe method "Close" on type "*os.File" (gosec)
		defer func() {
			if err := fh.Close(); err != nil {
				// Ignore "file already closed" errors
				if !errors.Is(err, os.ErrClosed) {
					c.Log.Error().Msgf(
						"failed to close file %q: %s",
						file,
						err.Error(),
					)
				}
			}
		}()
internal/files/report.go:103:2: G307: Deferring unsafe method "Close" on type "*os.File" (gosec)
	defer func(filename string) {
		if err := f.Close(); err != nil {
			// Ignore "file already closed" errors
			if !errors.Is(err, os.ErrClosed) {
				logger.Error().
					Err(err).
					Str("filename", filename).
					Msg("failed to close file")
			}
		}
	}(reportFilePath)
cmd/list-emails/main.go:65:2: G307: Deferring unsafe method "Close" on type "*os.File" (gosec)
	defer func(filename string) {
		if err := cfg.LogFileHandle.Close(); err != nil {
			// Ignore "file already closed" errors
			if !errors.Is(err, os.ErrClosed) {
				// We're using the standalone Err function from rs/zerolog/log
				// as we have the main logger set to write to a log file,
				// which we just failed to close. By default, this message
				// will go to stderr and should be decipherable by the user.
				zlog.Error().
					Err(err).
					Str("filename", filename).
					Msg("failed to close file")
			}
		}
	}(cfg.LogFileHandle.Name())

[atc0005]

Looks like a false-positive.

Upstream bug report here:

securego/gosec#714

The workaround appears to be disabling the specific linting rule, so will go that route vs waiting for upstream to fix the issue on their end.

[atc0005]

Looks to be relevant:

• https://github.com/golangci/golangci-lint/releases/tag/v1.43.0
• build(deps): bump github.com/securego/gosec/v2 from 2.8.1 to 2.9.1 golangci/golangci-lint#2299

[atc0005]

Fixed by #235.