govulncheck.yml

# GitHub Actions workflow for govulncheck.
# This file is licensed under MIT License.
# https://github.com/fxamacker/cbor

name: govulncheck

# Revoke default permissions and grant what's needed in each job.
permissions: {}

on:
  workflow_dispatch:
  pull_request:
    # Run govulncheck on PR for all branches and paths.
  push:
    # Run govulncheck on push for all branches and paths.
  schedule:
    - cron: '45 12 * * *' # Daily at 12:45 UTC / 7:45 AM Central

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  Check:
    runs-on: ubuntu-latest
    permissions:
      # Grant permission to read content.
      contents: read
    steps:
    - name: Checkout source
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 1

    - name: Install Go and setup env
      uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
      with:
        go-version: 1.23
        check-latest: true
 
    - name: Install latest govulncheck
      run: go install golang.org/x/vuln/cmd/govulncheck@4ea4418106cea3bb2c9aa098527c924e9e1fbbb4 # v1.1.3

    - name: Run govulncheck
      run: govulncheck -show=traces ./...