From eab3b088ac474fe62ac6a08fe3fbe00906abb96f Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 26 Aug 2026 07:25:53 +0000
Subject: [PATCH] fix: suppress gosec G117 on credential marshals

Add #nosec G117 annotations where structs legitimately carry
secrets in JSON: docker/git credential tunnel responses, the
localhost git credentials request, persisted client config, and
test fixture credentials.
---
 cmd/internal/git_credentials.go        | 1 +
 pkg/agent/tunnelserver/tunnelserver.go | 2 ++
 pkg/dockercredentials/helper_test.go   | 2 ++
 pkg/platform/client/client.go          | 1 +
 4 files changed, 6 insertions(+)

diff --git a/cmd/internal/git_credentials.go b/cmd/internal/git_credentials.go
index 6e630e98d..542d81a76 100644
--- a/cmd/internal/git_credentials.go
+++ b/cmd/internal/git_credentials.go
@@ -148,6 +148,7 @@ func doRequest(
 	credentials *gitcredentials.GitCredentials,
 	url string,
 ) (*gitcredentials.GitCredentials, error) {
+	// #nosec G117 -- credentials request legitimately carries the password.
 	rawJSON, err := json.Marshal(credentials)
 	if err != nil {
 		return nil, fmt.Errorf("error marshalling credentials: %w", err)
diff --git a/pkg/agent/tunnelserver/tunnelserver.go b/pkg/agent/tunnelserver/tunnelserver.go
index 7386280bd..be0b4aa2a 100644
--- a/pkg/agent/tunnelserver/tunnelserver.go
+++ b/pkg/agent/tunnelserver/tunnelserver.go
@@ -222,6 +222,7 @@ func (t *tunnelServer) DockerCredentials(
 			return nil, err
 		}
 
+		// #nosec G117 -- docker credential response legitimately carries the secret.
 		out, err := json.Marshal(credentials)
 		if err != nil {
 			return nil, err
@@ -299,6 +300,7 @@ func (t *tunnelServer) GitCredentials(
 		return nil, err
 	}
 
+	// #nosec G117 -- git credential response legitimately carries the password.
 	out, err := json.Marshal(credentials)
 	if err != nil {
 		return nil, err
diff --git a/pkg/dockercredentials/helper_test.go b/pkg/dockercredentials/helper_test.go
index 527d2ddcd..c7cec361e 100644
--- a/pkg/dockercredentials/helper_test.go
+++ b/pkg/dockercredentials/helper_test.go
@@ -30,6 +30,7 @@ func (s *HelperTestSuite) TestGet_Success() {
 		s.NoError(err)
 		s.Equal("docker.io", request.ServerURL)
 
+		// #nosec G117 -- test fixture credentials.
 		_ = json.NewEncoder(w).Encode(&Credentials{
 			ServerURL: "docker.io",
 			Username:  "testuser",
@@ -92,6 +93,7 @@ func (s *HelperTestSuite) TestGet_WorkspaceServerFallback() {
 			s.NoError(err)
 			s.Equal("docker.io", request.ServerURL)
 
+			// #nosec G117 -- test fixture credentials.
 			_ = json.NewEncoder(w).Encode(&Credentials{
 				ServerURL: "docker.io",
 				Username:  "workspaceuser",
diff --git a/pkg/platform/client/client.go b/pkg/platform/client/client.go
index e02516b64..f81f43574 100644
--- a/pkg/platform/client/client.go
+++ b/pkg/platform/client/client.go
@@ -199,6 +199,7 @@ func (c *client) Save() error {
 		return err
 	}
 
+	// #nosec G117 -- persisted client config legitimately carries the access key.
 	out, err := json.Marshal(c.config)
 	if err != nil {
 		return err