govulncheck #61

	name: govulncheck

	# Weekly scan catches new vulnerabilities even when the code hasn't changed.
	on:
	schedule:
	- cron: '0 9 * * 1' # Every Monday at 9:00 UTC
	workflow_dispatch:

	permissions:
	contents: read
	issues: write

	jobs:
	govulncheck:
	name: govulncheck
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v7
	with:
	persist-credentials: false

	- uses: actions/setup-go@v6
	with:
	go-version-file: go.mod

	- uses: golang/govulncheck-action@v1
	with:
	go-version-file: go.mod

	# Open a GitHub issue when the scheduled scan finds vulnerabilities.
	notify:
	needs: govulncheck
	runs-on: ubuntu-latest
	if: failure() && github.event_name == 'schedule'
	steps:
	- uses: actions/github-script@v9
	with:
	script: \|
	await github.rest.issues.create({
	owner: context.repo.owner,
	repo: context.repo.repo,
	title: 'govulncheck: vulnerability detected',
	body: [
	'The weekly [govulncheck scan](' + context.serverUrl + '/' + context.repo.owner + '/' + context.repo.repo + '/actions/runs/' + context.runId + ') found vulnerabilities.',
	'',
	'Review the workflow run and update affected dependencies.'
	].join('\n'),
	labels: ['security']
	});

Provide feedback