govulncheck: Accept build tags & Always analyze test files

.github/workflows/audit-go.yml

@@ -3,11 +3,17 @@ name: Audit Go
 on:
   workflow_call:
     inputs:
+      # TODO: Remove on next major version.
       go-version-file:
-        description: Path to the go.mod or go.work file.
+        description: Depercated. Path to the go.mod or go.work file.
         default: go.mod
         type: string
 
+      tags:
+        description: 'Comma-separated list of build tags.'
+        default: ''
+        type: string
+
       go-experiment:
         default: ''
         type: string
@@ -21,15 +27,34 @@ jobs:
       contents: read
       actions: read
     runs-on: ubuntu-slim
-    env:
-      GOEXPERIMENT: ${{ inputs.go-experiment }}
     steps:
-      - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+        background: true
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          output-format: sarif
-          output-file: govulncheck.sarif
+          go-version: stable
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+        env:
+          GOOS: ''
+          GOARCH: ''
+        shell: bash
+
+      - wait-all:
+
+      - name: Run govulncheck and save to file
+        run: govulncheck -format=sarif -test -tags="${TAGS}" ./... > "${OUTPUT_FILE}"
+        env:
+          TAGS: ${{ inputs.tags }}
+          GOEXPERIMENT: ${{ inputs.go-experiment }}
+          OUTPUT_FILE: ${{ runner.temp }}/govulncheck.sarif
+        shell: bash
 
       - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
-          sarif_file: govulncheck.sarif
+          sarif_file: ${{ runner.temp }}/govulncheck.sarif
           category: govulncheck