[arturre]

Signed-off-by: Artur Reznikov artur.reznikov@swirldslabs.com

• Enabled gosec in .golangci.yml, so it runs in the existing Code Style job. Fixed the real findings:
• The UC CR store (internal/uc/cr_store.go) and the platform-status state file (internal/uc/log_monitor.go) are now written with mode 0o600 instead of 0o640 and 0o644. Only the UC reads these files.
• networkupgradeprepare_controller.go compares the node count as int instead of casting it to int32, which could overflow (G115).
• Remaining findings are excluded by path in the config, not with inline //nolint:
  • Test files and test/.
  • G304 in internal/beacon and internal/uc: the file paths come from the operator's own CLI flags and config, and UC reads already refuse symlinks.
  • G404 in internal/controller: math/rand only shuffles the order registry candidates are tried in.
  • G101 in internal/registry/reasons.go: a reason-code name, not a credential.
• govulncheck (INFO-2): Added task vuln, which runs govulncheck pinned at golang.org/x/vuln v1.9.0. Added an enable-vuln-check input and a "Vulnerability Check" step to zxc-compile-code.yaml, and a vuln-check job to the pull request checks. The job fails only on vulnerabilities the code actually calls.
• Explicit workflow permissions (INFO-3): flow-pull-request-checks.yaml and flow-build-application.yaml now declare top-level permissions: instead of using the repository's default token permissions. The block grants exactly what the called workflows declare: id-token: write, contents: read, actions: read, pull-requests: write, checks: write, statuses: write. contents: read alone would break the called workflows, because a called workflow can only keep or reduce the caller's permissions.
• No code change needed:
  • INFO-1: govulncheck reports 0 vulnerabilities the code calls. oras-go is already at the fixed v2.6.2. cel-go v0.29.2 comes in through k8s.io/apiserver and controller-runtime, so it will be bumped with the next Kubernetes dependency update. x/crypto GO-2026-5932 has no fix yet.
  • INFO-4: committed example and test Secrets are either labeled with scanner allowlist markers or contain only REPLACE_WITH_… placeholders.
  • INFO-5: the stray local artifacts are gitignored and were deleted locally.

Related Issues

• Closes INFO misc issues based on security report #1285