fix: suppress gosec G117 on credential marshals

cmd/internal/git_credentials.go

@@ -148,6 +148,7 @@ func doRequest(
 	credentials *gitcredentials.GitCredentials,
 	url string,
 ) (*gitcredentials.GitCredentials, error) {
+	// #nosec G117 -- credentials request legitimately carries the password.
 	rawJSON, err := json.Marshal(credentials)
 	if err != nil {
 		return nil, fmt.Errorf("error marshalling credentials: %w", err)

pkg/agent/tunnelserver/tunnelserver.go

@@ -222,6 +222,7 @@ func (t *tunnelServer) DockerCredentials(
 			return nil, err
 		}
 
+		// #nosec G117 -- docker credential response legitimately carries the secret.
 		out, err := json.Marshal(credentials)
 		if err != nil {
 			return nil, err
@@ -299,6 +300,7 @@ func (t *tunnelServer) GitCredentials(
 		return nil, err
 	}
 
+	// #nosec G117 -- git credential response legitimately carries the password.
 	out, err := json.Marshal(credentials)
 	if err != nil {
 		return nil, err

pkg/dockercredentials/helper_test.go

@@ -30,6 +30,7 @@ func (s *HelperTestSuite) TestGet_Success() {
 		s.NoError(err)
 		s.Equal("docker.io", request.ServerURL)
 
+		// #nosec G117 -- test fixture credentials.
 		_ = json.NewEncoder(w).Encode(&Credentials{
 			ServerURL: "docker.io",
 			Username:  "testuser",
@@ -92,6 +93,7 @@ func (s *HelperTestSuite) TestGet_WorkspaceServerFallback() {
 			s.NoError(err)
 			s.Equal("docker.io", request.ServerURL)
 
+			// #nosec G117 -- test fixture credentials.
 			_ = json.NewEncoder(w).Encode(&Credentials{
 				ServerURL: "docker.io",
 				Username:  "workspaceuser",

pkg/platform/client/client.go

@@ -199,6 +199,7 @@ func (c *client) Save() error {
 		return err
 	}
 
+	// #nosec G117 -- persisted client config legitimately carries the access key.
 	out, err := json.Marshal(c.config)
 	if err != nil {
 		return err