I am running gosec on my project but it gives following error due to which our pipeline is failing
Golang errors in file: [/home/usr/exmaple/project.go]:
[line 22 : column 8] - could not import C (no metadata for C)
While go build command successfully builds the project means there is no golang error.
This seems to be a bug encoutered by other people as well. See this issue or this one. You should probably report an issue to gosec as well for this. Or maybe about the go/packages package in the Go repo directly.
This is not an issue.
We found out that our C code is present in .c and .h files in package directory, where .h file containing only function prototypes. And we are including only .h file in go files (cgo).
go build and go test commands are working because both of these commands when see .c and .h in package directory, compiles and link them. But gosec is a SAST tool, it doesn't compile .c and .h files present in package directory due to this gosec scan was getting only function prototypes not definition and was throwing Golang error could not import C (no metadata for C).
Including the whole code in comments (CGO) worked. Now gosec works fine.
