vulnerability.yml

name: "Vulnerability scan"
on:
  push:
    tags:
      - v*
    branches:
      - main
  pull_request:
    paths-ignore:
    - '**.yaml'
    - '**.yml'
  workflow_dispatch:
  schedule:
    # every day at 7am UTC
    - cron: '0 7 * * *'
permissions:
  contents: read
jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@v4
        with:
          show-progress: false
      - name: "Dependency Review"
        uses: actions/dependency-review-action@v4
        with:
          base-ref: ${{ github.event.pull_request.base.sha || github.event.before || github.sha }}
          head-ref: ${{ github.event.pull_request.head.sha || github.sha }}
  govulncheck:
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@v4
        with:
          show-progress: false
      - name: govulncheck
        uses: golang/govulncheck-action@v1
        with:
          check-latest: true
          repo-checkout: false
          go-version-file: go.mod
      - name: govulncheck for release module
        uses: golang/govulncheck-action@v1
        with:
          check-latest: true
          repo-checkout: false
          cache: false # cache will be already setup by previous step
          work-dir: release/cli
          go-version-file: release/cli/go.mod