build docker image and use it in action.yml

[kirbyquerby]

The action.yml currently still references the docker image made by securego/gosec:
https://github.com/informalsystems/gosec/blob/74c0f4d328d8723ac688fd1dee94e143695107fb/action.yml#L13

The release workflow also references publishing to the securego/securego docker image:
https://github.com/informalsystems/gosec/blob/74c0f4d328d8723ac688fd1dee94e143695107fb/.github/workflows/release.yml#L33

In general, a sweep should probably be done renaming securego where it makes sense:
https://github.com/search?q=securego+repo%3Ainformalsystems%2Fgosec&type=Code

For this issue, though, the following should be done to make a usable GitHub Action:

• Choose a repository to store the docker image (we could use Docker Hub like how securego/gosec does or use an alternative like GitHub Packages or Google Container Registry )
• Update the release workflow and action.yml to push to and reference the correct image
• Create a release so that an image gets build

[odeke-em]

Thank you @kirbyquerby! @kirbyquerby could you please help me with instructions for how to accomplish this to edit the permissions to allow the Docker image publishing on ghcr, Github's Container Registry?

[kirbyquerby]

https://docs.github.com/en/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility
https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions

[odeke-em]

Turns out that I don't have admin access to make those modifications to this repository, so I shall kindly ping @ebuchman to run the steps that @kirbyquerby highlighted in #26 (comment)

[odeke-em]

@greg-szabo and team could you please help us out with enabling the modifications listed above in #26 (comment)?

[greg-szabo]

Apologies for the late response here, I'm just back from leave.

The repo didn't really have an owner, so I made @odeke-em and @harveenSingh admin of the repo for now. This should take care of waiting on requests like this in the future.

It seems to me that you have to define a package first, before you can modify its properties. (I don't have any of the buttons described in the links either.) Try creating one using GitHub Actions first and then you should be able to change permissions on it.

Here's apalache's example of creating packages using GitHub Actions: https://github.com/informalsystems/apalache/blob/b627481fca3677b15457c704fdd6f8aab66b6d84/.github/workflows/container.yml (It's not perfect because it's compiling the dockerfile on the fly, but it's a good start.)

[odeke-em]

Alright, thank you very much @kirbyquerby @marbar3778 @ebuchman, after https://github.com/cosmos/gosec/releases/tag/v0.0.3 we now have ghcr.io/cosmos/gosec:latest hence I shall close this issue. @kirbyquerby could you please help send a PR to the cosmos-sdk to include some passes?

[kirbyquerby]

Not fixed. As specified in this issue, the action.yml still needs to be updated:

gosec/action.yml

Line 13 in 19d13d9

image: 'docker://securego/gosec'