bot: Update dependencies (bulk dependabot PRs) 2026-09-01 #9726

	# Copyright 2023 Democratized Data Foundation
	#
	# Use of this software is governed by the Business Source License
	# included in the file licenses/BSL.txt.
	#
	# As of the Change Date specified in that file, in accordance with
	# the Business Source License, use of this software will be governed
	# by the Apache License, Version 2.0, included in the file
	# licenses/APL.txt.

	name: Check Vulnerabilities Workflow

	on:
	pull_request:
	branches:
	- master
	- develop

	push:
	tags:
	- 'v[0-9]+.[0-9]+.[0-9]+'
	branches:
	- master
	- develop

	jobs:
	check-vulnerabilities:
	name: Check vulnerabilities job

	runs-on: ubuntu-latest

	steps:
	- name: Checkout code into the directory
	uses: actions/checkout@v6

	- name: Setup Go environment explicitly
	uses: actions/setup-go@v6
	with:
	go-version-file: 'go.mod'
	check-latest: true
	cache: false

	- name: Install govulncheck
	run: make deps:vulncheck

	- name: Run govulncheck scan
	run: govulncheck -C . -format text ./... \| tee govulncheck.txt

	- name: Check if only known vulnerabilities were found (there are new vulnerabilities if this fails)
	run: \|
	diff -u \
	<(sed -n '/^GO-/p' .github/known-vulnerabilities.txt \| sort) \
	<(sed -n 's/^Vulnerability #[0-9][0-9]*: //p' govulncheck.txt \| sort)

	# Remove allowlisted findings as compatible upstream fixes become available.
	#steps:
	# - name: Run govulncheck
	# uses: golang/govulncheck-action@v1
	# with:
	# go-version-file: 'go.mod'
	# check-latest: true
	# cache: false
	# go-package: ./...

Navigation Menu