vuln-scan.yaml

name: Vulnerability scan

on:
  pull_request:
  push:
    branches:
      - 'master'
  release:
    types: [ published ]

jobs:
  vulnerability-scan:
    name: Vulnerability scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Install Go
        uses: ./.github/actions/setup-go
      - name: Install govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
      - name: Run govulncheck
        run: |
          govulncheck ./...
      - name: Install OSV Scanner
        run: |
          go install github.com/google/osv-scanner/cmd/osv-scanner@v1
      - name: Run OSV Scanner
        run: |
          osv-scanner -r .