From 054194cb10e6f56679f807158957626dc93ff2b4 Mon Sep 17 00:00:00 2001
From: Daniil Fedotov <daniil.fedotov@kasten.io>
Date: Wed, 27 Mar 2024 12:37:49 -0400
Subject: [PATCH] build(security): add nightly run of govulncheck, move it out
 of dependency review

---
 .github/workflows/dependendy-review.yml |  8 +-------
 .github/workflows/govulncheck.yaml      | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 7 deletions(-)
 create mode 100644 .github/workflows/govulncheck.yaml

diff --git a/.github/workflows/dependendy-review.yml b/.github/workflows/dependendy-review.yml
index f79ef91cbbb..f86d6985bac 100644
--- a/.github/workflows/dependendy-review.yml
+++ b/.github/workflows/dependendy-review.yml
@@ -5,6 +5,7 @@
 # Source repository: https://github.com/actions/dependency-review-action
 # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 name: 'Dependency Review'
+
 on: [pull_request]
 
 permissions:
@@ -18,10 +19,3 @@ jobs:
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@v4
-      - id: govulncheck
-        name: 'Govulncheck'
-        uses: golang/govulncheck-action@3a32958c2706f7048305d5a2e53633d7e37e97d0 # v1.0.2
-        continue-on-error: true
-        with:
-          repo-checkout: false
-          cache: false
diff --git a/.github/workflows/govulncheck.yaml b/.github/workflows/govulncheck.yaml
new file mode 100644
index 00000000000..3249b0e6147
--- /dev/null
+++ b/.github/workflows/govulncheck.yaml
@@ -0,0 +1,24 @@
+
+name: 'govulncheck'
+on:
+  ## Nightly
+  schedule:
+    - cron: '0 0 * * *'
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - id: govulncheck
+        name: 'Govulncheck'
+        uses: golang/govulncheck-action@3a32958c2706f7048305d5a2e53633d7e37e97d0 # v1.0.2
+        continue-on-error: ${{ github.event_name == 'pull_request' }}
+        with:
+          repo-checkout: false
+          cache: false
\ No newline at end of file