👷 [skip ci] gosec code scanner

.github/workflows/dashboard.yml

@@ -11,6 +11,7 @@ on:
       - "*.md"
       - ".*"
       - ".github/workflows/agent.yml"
+      - ".github/workflows/gosec.yml"
 
 jobs:
   deploy:
@@ -31,18 +32,13 @@ jobs:
           registry: registry.cn-shanghai.aliyuncs.com
           username: ${{ secrets.ALI_USER }}
           password: ${{ secrets.ALI_PAT }}
-      
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
-        
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
-        
+
-      - name: Code Test
-        run: |
-          go env
-          go test -v ./...
-      
       - name: Set up image name
         run: |
           GHRC_IMAGE_NAME=$(echo "ghcr.io/${{ github.repository_owner }}/nezha-dashboard" | tr '[:upper:]' '[:lower:]')
@@ -53,7 +49,7 @@ jobs:
           echo "::set-output name=GHRC_IMAGE_NAME::$GHRC_IMAGE_NAME"
           echo "::set-output name=ALI_IMAGE_NAME::$ALI_IMAGE_NAME"
         id: image-name
-        
+
       - name: Build dasbboard image And Push
         uses: docker/build-push-action@v2
         with:
@@ -64,7 +60,7 @@ jobs:
           tags: |
             ${{ steps.image-name.outputs.GHRC_IMAGE_NAME }}
             ${{ steps.image-name.outputs.ALI_IMAGE_NAME }}
-      
+
       - name: Purge jsdelivr cache
         run: |
           curl -s https://purge.jsdelivr.net/gh/${{ github.repository_owner }}/nezha@master/script/install.sh

.github/workflows/test.yml

@@ -0,0 +1,22 @@
+name: Run Test
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    env:
+      GO111MODULE: on
+    steps:
+      - uses: actions/checkout@v2
+      - name: Unit test
+        run: |
+          go test -v ./...
+      - name: Run Gosec Security Scanner
+        uses: securego/gosec@master
+        with:
+          args: ./...