go-deps-audit-and-gitleaks-allowlist

Answer

Part A — Go dependency audit & batch bump

The audit (direct-dep-filtered go list -u -m): parse only the require block from go.mod, drop // indirect lines, cross-reference against go list -u -m all, and group results by module family so coordinated bumps can be batched safely.

#!/usr/bin/env bash
# audit-deps.sh — find actionable (direct + outdated) deps
set -euo pipefail
GOMOD="${1:-go.mod}"

# 1) Direct deps: require block minus // indirect (handles block + single-line forms)
awk -v gomod="$GOMOD" '
  /^require \(/            {inblock=1; next}
  inblock && /^\)/         {inblock=0; next}
  inblock && !/\/\/ indirect/ { if ($1 != "") print $1 " " $2 }
  !inblock && /^require / && !/\/\/ indirect/ { print $2 " " $3 }
' "$GOMOD" > /tmp/direct-deps.txt

# 2) Modules with available updates:  "mod curver [latest]"
go list -u -m all | awk '$3 ~ /^\[/ { gsub(/[\[\]]/,"",$3); print $1, $2, $3 }' > /tmp/updates.txt

# 3) Join: direct AND outdated = actionable
awk 'NR==FNR {direct[$1]=$2; next}
     $1 in direct { printf "%-70s %-12s -> %s\n", $1, $2, $3 }' /tmp/direct-deps.txt /tmp/updates.txt

The fix — batch the whole otel family in one go get invocation (one MVS resolution pass → consistent module graph + go.sum), then tidy and run the full gate:

#!/usr/bin/env bash
# bump-otel.sh — coordinated same-family minor bump
set -euo pipefail
go get \
  go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.70.0 \
  go.opentelemetry.io/otel@v1.45.0 \
  go.opentelemetry.io/otel/exporters/stdout/stdoutmetric@v1.45.0 \
  go.opentelemetry.io/otel/exporters/stdout/stdouttrace@v1.45.0 \
  go.opentelemetry.io/otel/metric@v1.45.0 \
  go.opentelemetry.io/otel/sdk@v1.45.0 \
  go.opentelemetry.io/otel/sdk/metric@v1.45.0 \
  go.opentelemetry.io/otel/trace@v1.45.0

go mod tidy          # prune stale indirects + go.sum
go build ./... && go vet ./... && go test ./...

This is safe to batch because every target is a same-family coordinated minor bump (otel 1.44.x→1.45.x, otelhttp 0.69.x→0.70.x) with a single shared release line — verified by the family grouping in the audit output. Avoid go get -u ./... here: it would bump unrelated graph deps (e.g. golang.org/x/net) that the direct-dep filter deliberately left alone.

Part B — Gitleaks allowlist narrowing

The bug — .gitleaks.toml auto-generated by gitreins init masks every first-party doc/spec/markdown file:

title = "gitleaks config"
[extend]
useDefault = true
[allowlist]
description = "auto-generated by gitreins init"
paths = [            # <- path-targeted; docs/specs/markdown are FIRST-PARTY, must be scanned
  '''specs/''',
  '''docs/''',
  '''.*\.spec\.md$''',
  '''.*\.md$''',
]

The fix — keep only dependency dirs (vendor/, third_party/), anchored so a first-party file merely named vendor-* is not masked:

title = "gitleaks config"
[extend]
useDefault = true
[allowlist]
description = "Narrowed: dependency dirs only; first-party docs/specs/markdown are scanned"
paths = [
  '''(^|/)vendor/''',
  '''(^|/)third_party/''',
  # add '''(^|/)node_modules/''' for JS repos — nothing else
]

Then re-scan before trusting PASS: gitleaks detect --source . --config .gitleaks.toml --log-opts=-1 and confirm exit 1 (leaks found) or a report with zero findings only after the real secrets are remediated. Note for gitleaks v8.30: path allowlisting goes in paths = [...]; regexTarget = "path" is rejected (only match/line), so don't try to express these as regexes.