diff --git a/.github/workflows/audit-go.yml b/.github/workflows/audit-go.yml index c23cffe..938c5c6 100644 --- a/.github/workflows/audit-go.yml +++ b/.github/workflows/audit-go.yml @@ -3,11 +3,17 @@ name: Audit Go on: workflow_call: inputs: + # TODO: Remove on next major version. go-version-file: - description: Path to the go.mod or go.work file. + description: Depercated. Path to the go.mod or go.work file. default: go.mod type: string + tags: + description: 'Comma-separated list of build tags.' + default: '' + type: string + go-experiment: default: '' type: string @@ -21,15 +27,34 @@ jobs: contents: read actions: read runs-on: ubuntu-slim - env: - GOEXPERIMENT: ${{ inputs.go-experiment }} steps: - - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + background: true + + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - output-format: sarif - output-file: govulncheck.sarif + go-version: stable + + - name: Install govulncheck + run: go install golang.org/x/vuln/cmd/govulncheck@latest + env: + GOOS: '' + GOARCH: '' + shell: bash + + - wait-all: + + - name: Run govulncheck and save to file + run: govulncheck -format=sarif -test -tags="${TAGS}" ./... > "${OUTPUT_FILE}" + env: + TAGS: ${{ inputs.tags }} + GOEXPERIMENT: ${{ inputs.go-experiment }} + OUTPUT_FILE: ${{ runner.temp }}/govulncheck.sarif + shell: bash - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: - sarif_file: govulncheck.sarif + sarif_file: ${{ runner.temp }}/govulncheck.sarif category: govulncheck