From e211896d51ee599b6584d7a4a9620fc4cddd0d97 Mon Sep 17 00:00:00 2001
From: Kevin Pita <kpita@peersyst.com>
Date: Wed, 29 Apr 2026 09:02:36 +0200
Subject: [PATCH] ci: add govulncheck workflow

---
 .github/workflows/govulncheck.yml | 36 +++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .github/workflows/govulncheck.yml

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
new file mode 100644
index 0000000..36ea298
--- /dev/null
+++ b/.github/workflows/govulncheck.yml
@@ -0,0 +1,36 @@
+name: Govulncheck
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ["**"]
+  schedule:
+    # Weekly scan to catch newly disclosed CVEs in dependencies.
+    # 09:00 UTC Mondays = 10:00 CET (winter) / 11:00 CEST (summer).
+    - cron: "0 9 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  # Cancel old runs if there is a new commit in the same branch
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    name: Run govulncheck
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.25"
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - name: Run govulncheck
+        run: govulncheck ./...