feat: obo-exchange #42

	# Runs Go's official vulnerability scanner against project dependencies.
	# Fails the job if any known vulnerabilities affect the code.
	# See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck

	name: govulncheck

	on:
	push:
	branches: [main]
	pull_request:
	# Weekly scan catches new vulnerabilities even when the code hasn't changed.
	schedule:
	- cron: '0 9 * * 1' # Every Monday at 9:00 UTC

	permissions:
	contents: read
	issues: write

	jobs:
	govulncheck:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	with:
	persist-credentials: false

	- uses: actions/setup-go@v6
	with:
	go-version-file: go.mod

	# golang/govulncheck-action runs govulncheck against all packages (./...).
	# With the default text output format, the job fails if vulnerabilities are found.
	- uses: golang/govulncheck-action@v1
	with:
	go-version-file: go.mod

	# Open a GitHub issue when the scheduled scan finds vulnerabilities.
	# Only runs on cron failures — PR and push failures are visible in the checks UI.
	notify:
	needs: govulncheck
	runs-on: ubuntu-latest
	if: failure() && github.event_name == 'schedule'
	steps:
	- uses: actions/github-script@v8
	with:
	script: \|
	await github.rest.issues.create({
	owner: context.repo.owner,
	repo: context.repo.repo,
	title: 'govulncheck: vulnerability detected',
	body: [
	'The weekly [govulncheck scan](' + context.serverUrl + '/' + context.repo.owner + '/' + context.repo.repo + '/actions/runs/' + context.runId + ') found vulnerabilities.',
	'',
	'Review the workflow run and update affected dependencies.'
	].join('\n'),
	labels: ['security']
	});

Provide feedback