name: Go Vulnerability Check

on:

schedule:

- cron: "0 0 * * *" # Every day at midnight UTC

workflow_dispatch:

jobs:

govulncheck:

runs-on: ubuntu-latest

permissions:

contents: read

security-events: write

steps:

- name: Check out code

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Set up Go

uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

with:

go-version-file: 'go.mod'

# `govulncheck -format sarif` exits successfully regardless of results, which are not in stdout.

# See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck#hdr-Exit_codes for more information on exit codes.

- name: Check Go vulnerabilities

run: |

govulncheck_version=$(grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' .github/govulncheck-version)

go run "golang.org/x/vuln/cmd/govulncheck@$govulncheck_version" -format sarif ./... > gh.sarif

- name: Upload SARIF report

uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3

with:

sarif_file: gh.sarif