Add staticcheck to golang type about sast-scan

[prabhu]

Correct. Will add this issue to my list for the week.

[prabhu]

Still not done with SARIF for staticcheck. Actually, got distracted and trying to build a test tool for testing sast-scan since I am currently check all project types and CI integrations manually :(

But here is a secret. If you create a local .sastscanrc you can override pretty much anything including replacing or including staticcheck in addition to gosec for golang.

https://github.com/AppThreat/sast-scan/blob/master/docs/TRICKS.md#config-file

For the key golang, if the value is a list then it is considered as a single tool. If instead the value is a map (for eg: depscan) then the tool would execute one tool at a time.

So the config for golang would resemble

"golang": {
  "gosec": [go sec args],
  "staticcheck": [static check args]
}

Let me know if this workaround helps for now.

[prabhu]

staticcheck is now available with version 1.1.1

tool         description                        critical    high    medium    low  status      total
-----------  -------------------------------  ----------  ------  --------  -----  --------  -------
staticcheck  Go static analysis                        7       0         0      0  ❌               7
gosec        Golang security checks by gosec           0       0         1      0  ✅               1