constellation/.github/workflows/test-govulncheck.yml

name: Govulncheck

on:
  push:
    branches:
      - main
    paths:
      - "**.go"
  pull_request:
    paths:
      - "**.go"

# Abort runs of *this* workflow, if a new commit with the same ref is pushed.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  govulncheck:
    name: govulncheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Install Dependencies
        run: sudo apt-get update && sudo apt-get -y install libcryptsetup-dev libvirt-dev

      - name: Setup Go environment
        uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f
        with:
          go-version: "1.19.2"
          cache: true

      - name: Get Go submodules
        id: submods
        shell: bash
        run: |
          mods=$(go list -f '{{.Dir}}/...' -m | xargs)
          echo "Found mods: $mods"
          echo "submods=${mods} >> $GITHUB_OUTPUT"

      - name: Govulncheck
        shell: bash
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          GOMEMLIMIT=5GiB govulncheck $(go list -f '{{.Dir}}/...' -m | xargs)