security.yml

name: security

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 5 * * 6'

permissions:
  contents: read

jobs:
  govulncheck:
    name: govulncheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Get Go version
        id: vars
        run: |
          goVersion=$(grep '^FROM go' .github/go/Dockerfile | cut -d ' ' -f 2 | cut -d ':' -f 2)
          echo "go_version=${goVersion}" >> $GITHUB_OUTPUT

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ steps.vars.outputs.go_version }}

      - name: Run govulncheck
        uses: golang/govulncheck-action@v1
        with:
          go-version-input: ${{ steps.vars.outputs.go_version }}
          go-package: ./...
          repo-checkout: false

  trivy:
    name: trivy
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'table'
          severity: 'CRITICAL,HIGH,MEDIUM'
          ignore-unfixed: true