chore(cicd): bump the github-actions-minor-patch group across 1 directory with 4 updates #9

	name: security

	on:
	push:
	branches: [main, master]
	pull_request:
	branches: [main, master]
	schedule:
	- cron: '0 5 * * 6'

	permissions:
	contents: read

	jobs:
	govulncheck:
	name: govulncheck
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

	- name: Get Go version
	id: vars
	run: \|
	goVersion=$(grep '^FROM go' .github/go/Dockerfile \| cut -d ' ' -f 2 \| cut -d ':' -f 2)
	echo "go_version=${goVersion}" >> $GITHUB_OUTPUT

	- name: Set up Go
	uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
	with:
	go-version: ${{ steps.vars.outputs.go_version }}

	- name: Run govulncheck
	uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f
	with:
	go-version-input: ${{ steps.vars.outputs.go_version }}
	go-package: ./...
	repo-checkout: false

	trivy:
	name: trivy
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'table'
	severity: 'CRITICAL,HIGH,MEDIUM'
	ignore-unfixed: true

Navigation Menu