hack: Bump gosec to v2.22.9

With go1.24 as a oldstable release, it is recommended to use a gosec
version supporting go1.24 (from v2.22.1[1]) to avoid any unexpected
errors. Additionally fix/ignore the newly reported gosec errors.

[1] https://github.com/securego/gosec/releases/tag/v2.22.1

Signed-off-by: Anoop C S <[email protected]>

Author: anoopcs9

hack/install-tools.sh

@@ -52,7 +52,7 @@ _install_yq() {
 }
 
 _install_gosec() {
-	_install_tool github.com/securego/gosec/v2/cmd/gosec@v2.20.0
+	_install_tool github.com/securego/gosec/v2/cmd/gosec@v2.22.9
 }
 
 _install_gitlint() {

internal/planner/properties.go

@@ -99,7 +99,7 @@ func (pl *Planner) ClusterSize() int32 {
 	if pl.SmbShare.Spec.Scaling == nil {
 		return 1
 	}
-	return int32(pl.SmbShare.Spec.Scaling.MinClusterSize)
+	return int32(pl.SmbShare.Spec.Scaling.MinClusterSize) // #nosec G115
 }
 
 // Grouping returns the logical grouping mode and group name.

internal/resources/metrics.go

@@ -53,7 +53,7 @@ func buildSmbMetricsContainer(image string,
 		Name:    "samba-metrics",
 		Command: []string{"/bin/smbmetrics"},
 		Ports: []corev1.ContainerPort{{
-			ContainerPort: int32(portnum),
+			ContainerPort: int32(portnum), // #nosec G115 – safe constant 8080
 			Name:          "smbmetrics",
 		}},
 		VolumeMounts: volmnts,
@@ -111,11 +111,11 @@ func (m *SmbShareManager) getOrCreateMetricsService(
 			Ports: []corev1.ServicePort{
 				{
 					Name:     defaultMetricsPortName,
-					Port:     int32(defaultMetricsPort),
+					Port:     int32(defaultMetricsPort), // #nosec G115 – safe constant 8080
 					Protocol: corev1.ProtocolTCP,
 					TargetPort: intstr.IntOrString{
 						Type:   intstr.Int,
-						IntVal: int32(defaultMetricsPort),
+						IntVal: int32(defaultMetricsPort), // #nosec G115 – safe constant 8080
 					},
 				},
 			},

internal/resources/pods.go

@@ -464,7 +464,7 @@ func buildSmbdCtr(
 		Args:            planner.Args().Run("smbd"),
 		Env:             env,
 		Ports: []corev1.ContainerPort{{
-			ContainerPort: int32(portnum),
+			ContainerPort: int32(portnum), // #nosec G115 – safe constant 445
 			Name:          "smb",
 		}},
 		VolumeMounts: mounts,

internal/resources/services.go

@@ -36,9 +36,11 @@ func newServiceForSmb(planner *pln.Planner, ns string) *corev1.Service {
 		Spec: corev1.ServiceSpec{
 			Type: toServiceType(planner.ServiceType()),
 			Ports: []corev1.ServicePort{{
-				Name:       "smb",
-				Protocol:   corev1.ProtocolTCP,
-				Port:       int32(planner.GlobalConfig.SmbServicePort),
+				Name:     "smb",
+				Protocol: corev1.ProtocolTCP,
+				// revive:disable:line-length-limit gosec rule ignore
+				Port: int32(planner.GlobalConfig.SmbServicePort), // #nosec G115 – safe constant 445
+				// revive:enable:line-length-limit
 				TargetPort: intstr.FromInt(planner.GlobalConfig.SmbdPort),
 			}},
 			Selector: map[string]string{

internal/resources/smbshare.go

@@ -373,7 +373,9 @@ func (m *SmbShareManager) updateClusteredState(
 
 	resized, err := m.updateStatefulSetSize(
 		ctx, statefulSet,
-		int32(planner.SmbShare.Spec.Scaling.MinClusterSize))
+		// revive:disable:line-length-limit gosec rule ignore
+		int32(planner.SmbShare.Spec.Scaling.MinClusterSize)) // #nosec G115
+	// revive:enable:line-length-limit
 	if err != nil {
 		return Result{err: err}
 	}