name: govulncheck
on:
  push:
    paths:
      - go.sum
      - .github/workflows/govulncheck.yml
  pull_request:
    paths:
      - go.sum
      - .github/workflows/govulncheck.yml
  schedule:
    - cron: "0 0 * * *"

permissions: read-all

jobs:
  govulncheck:
    name: govulncheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin@v7.0.0
        with:
          persist-credentials: false
      - name: Add variables to environment file
        run: cat ".github/env" >> "$GITHUB_ENV"
      - name: Setup Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # pin@6.5.0
        with:
          go-version: '${{ env.GOLANG_VERSION }}'
          check-latest: true
      - name: govulncheck
        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # pin@032d455 (from main 2026-07-06)
        with:
          go-package: ./...