[security] audit repository tooling

[codeboten]

The security SIG is looking to ensure that security tooling is setup consistently across the organization. As a result, we're asking maintainers to ensure the following tools are enabled in each repository:

• CodeQL enabled via GitHub Actions
• Static code analysis tool (the collector uses govulncheck [https://pkg.go.dev/golang.org/x/vuln] on every build)
• Repository security settings
  • Security Policy ✅
  • Security advisories ✅
  • Private vulnerability reporting ✅
  • Dependabot alerts ✅
  • Code scanning alerts ✅

Parent issue: open-telemetry/sig-security#12

[MadVikingGod]

Our current CodeQL is schedule to run at 1:30am every day, where the collector runs on pushes to main, and PRs. Should we update it?

[codeboten]

The recommendation is to run it on push to main and on PRs open-telemetry/sig-security#15

[pellared]

I think we can also use this issue to adopt the same tooling/automation in https://github.com/open-telemetry/opentelemetry-go-contrib

[sakshi-1505]

Hello Team, I think we have already added codeQL. On the staticcheck front, please allow me to suggest golangcilint or staticcheck(https://staticcheck.io/docs/getting-started/), this is one of the most verbose & efficient staticcode checker as well a vulnerability analyser I have worked with. I can open a draftPR with it's integration if we are all on same page @pellared @MadVikingGod

[pellared]

@sakshi-1505, we want to use govulncheck. See: https://pkg.go.dev/golang.org/x/vuln

[sakshi-1505]

Thanks @pellared for the update, I will open a PR for this.

[sakshi-1505]

/assign

[pellared]

Please check how other tools are versioned, installed and used via Makefile and internal/tools Go module.

[sakshi-1505]

@pellared @codeboten We can close this issue now, we are all green!

[pellared]

I think we can also use this issue to adopt the same tooling/automation in https://github.com/open-telemetry/opentelemetry-go-contrib

open-telemetry/opentelemetry-go-contrib#4413 is created.

Closing this issue.