govulncheck.yml

name: Nightly govulncheck
on:
  workflow_call: # allows to reuse this workflow
    inputs:
      ref:
        description: 'The branch to run the workflow on'
        required: true
        type: string
  push:
    branches:
      - main
      - release-v*  
    tags-ignore:
      - 'contrib/**'
      - 'instrumentation/**'
  schedule:
    - cron: '00 00 * * *'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  govulncheck-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Checkout Go
        uses: actions/setup-go@v3
        with:
          go-version: 'stable'
      - name: Install govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
      - name: Run govulncheck
        run: govulncheck ./ddtrace/... ./appsec/... ./profiler/... ./internal/...
      - name: Run govulncheck-contribs
        run: |
          go list -f '{{.Dir}}' ./contrib/... | while read dir ; do
            govulncheck -C $dir .
          done