ci: add blocking Claude security review #55

	name: security

	on:
	push:
	branches: [main, master]
	pull_request:
	branches: [main, master]
	schedule:
	- cron: '0 5 * * 6'

	permissions:
	contents: read

	jobs:
	govulncheck:
	name: govulncheck
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Get Go version
	id: vars
	run: \|
	goVersion=$(grep '^FROM go' .github/go/Dockerfile \| cut -d ' ' -f 2 \| cut -d ':' -f 2)
	echo "go_version=${goVersion}" >> $GITHUB_OUTPUT

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ steps.vars.outputs.go_version }}

	- name: Run govulncheck
	uses: golang/govulncheck-action@v1
	with:
	go-version-input: ${{ steps.vars.outputs.go_version }}
	go-package: ./...
	repo-checkout: false

	trivy:
	name: trivy
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@v0.36.0
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'table'
	severity: 'CRITICAL,HIGH,MEDIUM'
	ignore-unfixed: true

Navigation Menu