🛡️ Security automation w. Google `OSV-Scanner` CI/CD Action

[adriens]

❔ About

While making some review on osv benefits I found some issues that trivy could not find :

• 🛡️ Security > google-osv and multiple vulnerabilities in the stdlib package #124

... then I manually found them, built a report and patch operation to fix them :

• 🛡️ Security > google OSV and multiple vulnerabilities in the stdlib package #125

Which also pointed that we were not in the latest Go runtime.

👉 The point here is to automate this while keep improving base code security.

🎯 Action

Implement OSV-Scanner CI/CD Action :

• A workflow that triggers a scan with each pull request and will only report new vulnerabilities introduced through the pull request.
• A workflow that performs a full vulnerability scan, which can be configured to scan on pushes or a regular schedule.

📑 Resources

• https://github.com/google/osv.dev
• https://osv.dev/
• https://github.com/google/osv-scanner-action