govulncheck.yml

# GitHub Actions workflow for govulncheck.
# This file is licensed under MIT License.
# https://github.com/fxamacker/cbor

name: govulncheck

# Revoke default permissions and grant what's needed in each job.
permissions: {}

on:
  workflow_dispatch:
  pull_request:
      # Run on pull request for all branches.
  push:
      # Run on push for all branches.
  schedule:
    - cron: '45 12 * * *' # Run daily at 12:45 UTC / 7:45 AM Central.

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  Check:
    runs-on: ubuntu-latest
    permissions:
      # Grant permission to read content.
      contents: read
    steps:
    - name: Checkout source
      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
      with:
        fetch-depth: 1

    - name: Install Go and setup env
      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
      with:
        go-version: 1.23
        check-latest: true
 
    - name: Install latest govulncheck
      run: go install golang.org/x/vuln/cmd/govulncheck@4ea4418106cea3bb2c9aa098527c924e9e1fbbb4 # v1.1.3

    - name: Run govulncheck
      run: govulncheck -show=traces ./...