QA: wrap gosec to golangci-lint speed up to 10x

[alexpts]

Summary

I described in the discussion golangci/golangci-lint#4411
case in which gosec is very slow compared to running a linger gosec in golangci-lint.

Please join to the discussion to figure out why the linter is slow

[ccojocar]

It sounds strange to me that is 10 times slower when you run it stand alone. Does this happens also when you run only gosec linter via golanci but not others litters which potentially runs before gosec?

The only reason I might think of is that the package AST gets cached by go package loader for others litters so that it doesn't need to be parsed again by gosec, which obviously is not the case when gosec runs stand-alone.

Could you provide more details what happens when it get wrapped?

[alexpts]

I described the methodology for running both binaries and the configurations in the discussion golangci/golangci-lint#4411 for project https://github.com/golangci/golangci-lint. I have the same speed effect on my project..

I run only gosec linter + typecheck. My golangci-lint config:

output:
  print-linter-name: true
  print-issued-lines: false
  uniq-by-line: false

run:
  show-stats: true
  print-resources-usage: true

linters-settings:
  gosec:
    exclude-generated: true
    confidence: low
    severity: low
    config:
      global:
        nosec: true
        show-ignored: false

linters:
  disable-all: true
  enable:
    - gosec

issues:
  max-same-issues: 0
  exclude-use-default: false
  exclude-rules:
    - path: /
      linters: [typecheck]

I don't think the AST cache takes up +900% of the time.

I saw different CPU utilization on traces:
gosec.trace.log

golangci.trace.log

[ccojocar]

Do you know which gosec version is currently packaged with golangci?

[ccojocar]

Cloud you try to clean up the cache of golangci-lint tool and run the following commands again:

# this should make sure that the golangci really does the scanning
golangci-lint cache clean

time golangci-lint run --disable-all -E gosec

and

time ./gosec -quiet ./...

It seems that golangci-lint is definetly slower when run with an empty cache against the gosec source code:

time ./gosec -quiet ./...
./gosec -quiet ./...  7.61s user 10.59s system 453% cpu 4.013 total

time golangci-lint run --disable-all -E gosec
golangci-lint run --disable-all -E gosec  25.20s user 4.44s system 801% cpu 3.696 total

[alexpts]

Do you know which gosec version is currently packaged with golangci?

I compared golangci-lint 1.56.2 (2.19.0) and gosec 2.19.0

https://github.com/golangci/golangci-lint/blob/58a724a05e33a040826b471b2e6a8a8fc970feb2/go.mod#L93

---

I describe in golangci/golangci-lint#4411 that I use tools with build cache.

I used both tools with prepared go build cache. First run warm up all caches for me. Without cache both tools are very slow for CI.

Golangci-lint also need gomod cache for correct work.

[ccojocar]

In this case, the difference is from caching strategy. gosec relies on go build cache while golangci seems to implement their own caching strategy on top, as far I can understand from this file https://github.com/golangci/golangci-lint/blob/6628d211b3ca57a1e03ac9b158a0bca6ea648899/pkg/golinters/goanalysis/runners.go#L45.

There is no plan to add any additional caching in gosec. You can use the golangci if you want a more aggressive caching strategy.

I am going to close this issue for now since there isn't any further action on gosec side.

[alexpts]

Thanks for check