Check gosec results in CI

The KinD tests action will now run the gosec-scan, and that target will
fail if any vulnerabilities are found. The target was also configured to
ignore the test code.

Signed-off-by: Justin Kulikauskas <[email protected]>

Author: JustinKuli

.github/workflows/kind.yml

@@ -47,11 +47,12 @@ jobs:
       run: |
         go mod verify
 
-    - name: Verify format
+    - name: Some quality checks
       run: |
         make fmt
         git diff --exit-code
         make lint
+        make gosec-scan
 
     - name: Verify deploy/operator.yaml
       run: |

Makefile

@@ -177,7 +177,7 @@ gosec:
 
 .PHONY: gosec-scan
 gosec-scan: gosec
-	$(GOSEC) -fmt sonarqube -out gosec.json -no-fail -exclude-dir=.go ./...
+	$(GOSEC) -fmt sonarqube -out gosec.json -stdout -exclude-dir=.go -exclude-dir=test ./...
 
 ############################################################
 # build section