govulncheck.yml

name: Nightly govulncheck
on:
  workflow_call: # allows to reuse this workflow
    inputs:
      ref:
        description: 'The branch to run the workflow on'
        required: true
        type: string
  push:
    branches:
      - main
      - release-v*
  schedule:
    - cron: '00 00 * * *'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  govulncheck-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Get Go version from go.mod file
        id: go-version
        run: echo "version=$(go mod edit -json | jq -r .Go)" >> "${GITHUB_OUTPUT}"
      - name: Checkout Go
        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ steps.go-version.outputs.version }}
      - name: Install govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
      - name: Run govulncheck
        run: govulncheck ./...