Convert golangci-lint report to gosec report

[alexpts]

I use gosec binary for scan project. Gosec is slow.
I wrapped gosec linter to golangci-lint for speed up. It work greate, speed up x10.

1. Can I convert golangci-lint report to gosec format report for backward compitability?
2. Can I write extra report to file for gosec as original format for backward compitability?

[bombsimon]

There's no way to convert to linter specific formats. Available output formats are visible from golangci-lint run --help, currently one of colored-line-number, line-number, json, tab, checkstyle, code-climate, html, junit-xml, github-actions, teamcity (default "colored-line-number")

Sounds weird that a linter aggregator should be 10x faster than the standalone linter though, have you considered filing an issue to gosec? A similar issue was filed not too long ago in #4039 which resulted in an upstream ticket to gosec.

[alexpts]

I saw available formatters. Json formatter does not contain some information from the linter, for example severity and confidence.

I try latest version gosec.

My usecase gosec in project golangci-lint (with build cache):

time gosec --nosec=true -exclude-generated -confidence low -severity low -show-ignored -terse  ./...

Result:

Summary:
  Gosec  : 2.19.0
  Files  : 267
  Lines  : 23897
  Nosec  : 0
  Issues : 49
  
  10,95s user 13,84s system 149% cpu 16,530 total

My config for golangci-lint:

output:
  print-linter-name: true
  print-issued-lines: false
  uniq-by-line: false

run:
  show-stats: true
  print-resources-usage: true

linters-settings:
  gosec:
    exclude-generated: true
    confidence: low
    severity: low
    config:
      global:
        nosec: true
        show-ignored: false

linters:
  disable-all: true
  enable:
    - gosec

issues:
  max-same-issues: 0
  exclude-use-default: false
  exclude-rules:
    - path: /
      linters: [typecheck]

Result:

50 issues:
* gosec: 50
INFO File cache stats: 21 entries of total size 116.5KiB
INFO Memory: 17 samples, avg is 33.5MB, max is 47.0MB
INFO Execution took 1.569478792s

1,20s user 1,38s system 154% cpu 1,669 total

[alexpts]

I made traces for both utilities, it is clear that they work completely differently.

gosec:
gosec.trace.log

golangci-lint:
golangci.trace.log

[alexpts]

Asked to join the discussion project gosec - securego/gosec#1110