Nightly Vulnerability Scan #4

	name: Nightly Vulnerability Scan

	on:
	schedule:
	# Schedule to run every night at midnight
	- cron: '0 0 * * *'
	workflow_dispatch:

	permissions: {}

	jobs:
	vulnerability-scan:
	runs-on: ubuntu-24.04

	permissions:
	contents: read
	issues: write # create issues via gh CLI

	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
	with:
	egress-policy: audit

	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod

	- name: Set up govulncheck
	env:
	GOVULNCHECK_VERSION: v1.6.0
	run: go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}"

	# govulncheck reports reachable vulnerabilities only, so a finding here means
	# the helper actually calls the affected code
	- name: Scan the module
	id: scan
	run: govulncheck ./... \| tee govulncheck-output.txt

	- name: Create an issue for the findings
	if: failure() && steps.scan.conclusion == 'failure'
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	gh issue create \
	--title "Vulnerabilities found in nightly scan" \
	--body-file govulncheck-output.txt

Navigation Menu