Performs vulnerability scan using govulncheck and afterwards uploads it as Sarif Report to Github

For a full list of currently known limitations please head over to here. Listed below are an important overview.

• Govulncheck only reads binaries compiled with Go 1.18 and later.
• Govulncheck only reports vulnerabilities that apply to the current Go build system and configuration (GOOS/GOARCH settings).

• Official Package Documentation: Link
• Introduction Blogpost: Link

name: My Workflow
on: [push, pull_request]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Running govulncheck
        uses: Templum/govulncheck-action@<version>
        with:
          go-version: 1.18
          vulncheck-version: latest
          package: ./...
          github-token: ${{ secrets.GITHUB_TOKEN }}

⚠️ Please be aware that go-version should be a valid tag name for the golang dockerhub image.

🔒 Please be aware if the token is not specified it uses github.token for more details on that check those docs