Security Fix: Unhandled error in semver.go (alert #477)

[github-actions]

Security Fix: Unhandled Error in semver.go

Alert Number: #477
Severity: LOW
Rule: G104 - Improper Check or Handling of Exceptional Conditions

Vulnerability Description

The gosec security scanner identified an unhandled error from fmt.Sscanf on line 58-59 in pkg/workflow/semver.go:58. The extractMajorVersion function was calling fmt.Sscanf to parse version numbers without properly acknowledging the intentionally ignored error return value.

Fix Applied

Moved the #nosec G104 directive to be inline on the same line as the fmt.Sscanf call (line 59) to properly suppress the gosec warning. This is a false positive since:

1. The error is intentionally ignored - the function is designed to default to 0 for non-numeric version parts
2. This behavior is documented in the function comment (line 49)
3. The same pattern is already used consistently elsewhere in the file (lines 29 and 32)

Change made:

• Moved #nosec G104 comment from standalone line 58 to inline on line 59 where the actual code is located
• Kept the explanatory comment on line 58 to document why the error is being ignored

Security Best Practices

The inline #nosec directive is the recommended approach for gosec suppressions as it:

• Clearly associates the suppression with the specific code being flagged
• Prevents accidental suppression of other security issues
• Makes code review easier by keeping the suppression close to the code

Testing Considerations

• Existing unit tests for extractMajorVersion continue to pass
• The function behavior remains unchanged - it still correctly defaults to 0 for non-numeric version parts
• The change only affects the security scanner suppression, not the runtime behavior

Related

This is the third attempt to fix alert #477:

• First attempt (workflow run 20754292055): Added explicit _, _ error ignoring
• Second attempt (workflow run 20760678588): Added #nosec G104 on line 58
• This attempt: Moved #nosec G104 inline to line 59 where gosec is flagging the code

Reference: https://github.com/githubnext/gh-aw/security/code-scanning/477

AI generated by Security Fix PR