version-bump/.github/workflows/vulnscans.yml at 86f0adac62cc10062c17d1eb0199cd89e396069a · sudo-bmitch/version-bump · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
name: Vulnerability Check

on:
  schedule:
    - cron: '0 06 * * 0' # 6am UTC on Sundays
  workflow_dispatch:

jobs:
  vulnerability-scans:
    name: Run vulnerability scans
    runs-on: ubuntu-latest
    env:
      RELEASE_GO_VER: "1.26"

    steps:
    - name: Check out code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

    - name: "Set up Go"
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: "${{ env.RELEASE_GO_VER }}"
        check-latest: true

    # intentionally not pinned to always run the latest scanner
    - name: "Install govulncheck"
      run: |
        go install golang.org/x/vuln/cmd/govulncheck@latest

    - name: "Run govulncheck"
      run: |
        govulncheck ./...

    # intentionally not pinned to always run the latest scanner
    - name: "Install OSV Scanner"
      run: |
        go install github.com/google/osv-scanner/cmd/osv-scanner@latest

    - name: "Run OSV Scanner"
      run: |
        osv-scanner scan --config .osv-scanner.toml -r --experimental-licenses="Apache-2.0,BSD-2-Clause,BSD-3-Clause,CC-BY-SA-4.0,ISC,MIT,MPL-2.0,UNKNOWN" .