v1.23.0

Highlights

This release makes glsec safer to run on repositories you don't control, fixes six rules that reported the wrong thing or missed something, and builds the release binaries with a current Go. There are no new rules; glsec stays at 85.

Upgrade note: Code Quality fingerprints change. The fingerprint is now a hash of the fields as a JSON array instead of joined by | (#647), and the messages of GL025, GL027, GL032 and GL043 changed. GitLab shows the affected findings as new once in the merge request widget after the upgrade, and the old ones as resolved.

Scanning repositories you don't trust

• New flag --no-repo-config: glsec ignores a .glsec.yml in the scanned directory, so a merge request can't turn rules off, lower severities or exclude files. A file passed with --config is still read. The README has a new section, "Scanning repositories you don't trust", on when to use it together with --no-ignores (#641)
• If exclude_paths or --exclude excludes every file, glsec warns that nothing was scanned instead of exiting 0 silently; with --strict it exits 2 (#643)
• A .glsec.yml or .glsec-ignore that is a symbolic link out of the working directory is refused (#644)
• The result cache is not used when it lies inside the scanned directory or is writable by others, and a link in place of a cache entry is never followed (#646)
• The plugin and pre-commit wrapper bin/glsec skips empty and relative PATH entries, only uses a glsec on PATH that is at least the pinned version, and verifies the download's SLSA provenance when cosign or gh is installed (#648)

Rules

• Scripts given as a single string (script: curl … | bash) or as nested lists from YAML anchors are now scanned by every script rule and by ShellCheck. Before, they weren't scanned at all, so expect new findings in such jobs (#642)
• GL078 reports characters that YAML counts as line breaks but editors and GitLab's file view don't: a lone CR, NEL, U+2028 and U+2029. They can make a finding point a reviewer at the wrong line (#645)
• GL027 reports a secret value committed in variables: (long form with value:) and points to Settings → CI/CD → Variables. It no longer reports a missing masked: key, which can't be set in a .gitlab-ci.yml (#698)
• GL025 checks each shell line on its own and doesn't report values passed with --data-urlencode or cleaned with tr/sed first (#697)
• GL043 reads escaped slashes as part of a regex, so =~ /^release\/.*/ is checked as one pattern (#700)
• GL008 knows the analyzer jobs the SAST, Dependency Scanning and IaC templates create, so switching one off (semgrep-sast: rules: [when: never]) is reported. It no longer reports allow_failure: true where the template already sets it, on sast-iac (a template, not a job) or on the configuration-only sast and dependency_scanning jobs (#673, thanks @tyza66)
• GL032 now suggests a file-type variable or a here-string (ssh-add - <<< "$KEY") instead of echo "$KEY" | ssh-add -, which set -x prints in full (#696)

Build and release

• The release binaries are built with Go 1.27.3; 1.22.0 was built with Go 1.26.0 and contained known standard library vulnerabilities. govulncheck runs with the same Go version (#664)
• The Claude Code plugin is installed from a release commit instead of main (#694)

Project

• Every trigger example in the rule docs is tested to make the rule fire, and every safe alternative not to; the severities in docs/rules.md and the flags in the README are tested against the code (#696)
• The repository follows the REUSE specification and CI runs reuse lint (#684)
• Changes to agent configuration, workflows, hooks and the plugin need a maintainer label before they can be merged (#691), and agent configuration files are scanned in CI (#688)
• New tests for config errors and CLI selections (#683, thanks @Sinkleberg) and for internal/color (#660, thanks @sonurust)

Changelog

• 92aee11 build(deps): bump google/osv-scanner-action/osv-scanner-action (#662)
• ba7d877 build(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 (#663)
• 835b0bc build(deps): bump reuse from 5.0.2 to 6.2.0 in /.github/requirements (#687)
• 972333b build(deps): bump zizmor from 1.30.1 to 1.31.0 in /.github/requirements (#661)
• 5a81a1b build(deps): bump zizmor from 1.31.0 to 1.31.1 in /.github/requirements (#686)
• f5f2483 build: build with Go 1.27.3 and run govulncheck with it (#664) (#665)
• 8d2a292 build: pin the Claude Code plugin to the release commit (#694) (#695)
• 304a058 ci: cfgaudit 1.18.1 with the config outside the workspace and Markdown docs (#708) (#709)
• 6593ded ci: keep the header check pattern out of reuse lint (#684) (#690)
• 23c5218 ci: require a maintainer label for changes to sensitive paths (#691) (#692)
• c1998c9 ci: scan agent configuration files with cfgaudit (#688) (#689)
• f5b1540 feat: --no-repo-config ignores a .glsec.yml in the scanned directory (#641) (#652)
• ca54db0 feat: GL078 reports line breaks only YAML sees (#645) (#655)
• 358f826 feat: warn when exclude_paths excludes every file (#643) (#653)
• 8315d5a fix: GL008 wrong job names and misleading allow_failure findings (#680)
• be696ec fix: GL025 checks each shell line and skips --data-urlencode values (#697) (#699)
• 10abb58 fix: GL027 reports committed secret values instead of a missing masked: key (#698) (#703)
• 0841214 fix: GL043 reads escaped slashes as part of the pattern (#700) (#701)
• 64dc15c fix: encode Code Quality fingerprint fields unambiguously (#647) (#658)
• 0482cbf fix: harden the plugin wrapper's binary lookup and download check (#648) (#656)
• 83136e2 fix: harden the result cache against planted entries and links (#646) (#659)
• 41da468 fix: refuse .glsec.yml and .glsec-ignore that link out of the working directory (#644) (#654)
• befd6d8 fix: scan script sections given as a string or as nested lists (#642) (#651)