# GitHub Actions workflow for govulncheck.
# This file is licensed under MIT License.
# https://github.com/fxamacker/cbor

name: govulncheck

# Revoke default permissions and grant what's needed in each job.
permissions: {}

on:
  workflow_dispatch:
  pull_request:
    # Run govulncheck on PR for all branches and paths.
  push:
    # Run govulncheck on push for all branches and paths.
  schedule:
    - cron: '45 12 * * *' # Daily at 12:45 UTC / 7:45 AM Central

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  Check:
    runs-on: ubuntu-latest
    permissions:
      # Grant permission to read content.
      contents: read
    steps:
    - name: Checkout source
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 1

    - name: Install Go and setup env
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
        go-version: 1.23
        check-latest: true
 
    - name: Install latest govulncheck
      run: go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 # v1.1.4

    - name: Run govulncheck
      run: govulncheck -show=traces ./...
