govulncheck.yml

name: govulncheck

on:
  workflow_call:
    inputs:
      go-version:
        required: false
        type: string
        default: stable
      cache:
        required: false
        type: boolean
        default: true
      run:
        required: false
        type: string
    secrets:
      gh_pat:
        required: false

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    env:
      GH_PAT: ${{ secrets.gh_pat }}
      RUN: ${{ inputs.run }}
    steps:
      - run: |
          git config --global url."https://${{ secrets.gh_pat }}@github.com/charmbracelet".insteadOf "https://github.com/charmbracelet"
          git config --global url."https://${{ secrets.gh_pat }}@github.com/charmcli".insteadOf "https://github.com/charmcli"
        if: env.GH_PAT != null
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ inputs.go-version }}
          cache: ${{ inputs.cache }}
      - run: ${{ inputs.run }}
        if: env.RUN != null
      - name: govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...