Add GoSec Security Scan

[kxyr]

Motivation

Follow up to issue open-telemetry/oteps#144

GoSec is a static analysis engine which scans go source code for security vulnerabilities. As the project grows and we near GA it might be useful to have a workflow which checks for security vulnerabilities so we can ensure every incremental change is following best development practices. Also passing basic security checks will also make sure that there aren't any glaring issues for our users.

Changes

This PR adds GoSec security checks to the repo

• After every run the workflow uploads the results to GitHub. Details on the run and security alerts will show up in the security tab of this repo.

Workflow Triggers

• daily cron job at 1:30am
• workflow_dispatch (in case maintainers want to trigger a security check manually)

cc @alolita

[djaglowski]

Thank you for adding this.

Just a minor note on the changelog format.

[tigrannajaryan]

Shouldn't this check be also perform for all PR builds?

[kxyr]

Shouldn't this check be also perform for all PR builds?

I wasn't sure, since the CodeQL / GoSec Actions in most other repos, including Go, Java, Javascript, Python were only using a cron job. The Collector switched over from a cron job to on committing to main. I haven't seen any examples of running on every PR, but that seems like a good check as well. Which triggers would the approvers of this repo prefer?

[djaglowski]

Which triggers would the approvers of this repo prefer?

Thanks, I'd certainly prefer this to be PR triggered so that we detect immediately if an issue is being introduced.

[jsirianni]

Can we do on PR and recurring against main branch?

Detecting known issues before they are merged is ideal, however, I think it could be possible for issues to be added to the detection engine after merge to main.

[kxyr]

Added. How should the GoSec scan errors in the CI be addressed?

[djaglowski]

@xukaren, I'll make a PR to your branch.

[djaglowski]

@xukaren I decided to just extend your PR, and opened #157, which will supersede this one.

[djaglowski]

I'm merging this, including the -no-fail flag, which I will remove in #157