name: govulncheck
on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "0 2 * * *"
permissions:
  contents: read
concurrency:
  group: govulncheck-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
jobs:
  govulncheck:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
        with:
          output-format: sarif
          output-file: results.sarif
      - uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
        with:
          sarif_file: results.sarif
