From 99684738efa5148948939e55c405d0fa1e6ee40a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Mar 2026 23:31:36 +0000
Subject: [PATCH 1/3] ci: add govulncheck workflow for dependency vulnerability
 scanning

---
 .github/workflows/govulncheck.yml | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .github/workflows/govulncheck.yml

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
new file mode 100644
index 0000000000..5acbd9b0eb
--- /dev/null
+++ b/.github/workflows/govulncheck.yml
@@ -0,0 +1,28 @@
+name: govulncheck
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - master
+  pull_request:
+  schedule:
+    - cron: '0 9 * * 1' # Every Monday at 9:00 UTC
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: go.mod
+      - name: Run govulncheck
+        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4

From 039e72c7b32cdebb25c4b738e8aa0d362f1e795e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Mar 2026 23:36:24 +0000
Subject: [PATCH 2/3] fix: let govulncheck-action handle checkout and Go setup
 internally

The action performs its own checkout and Go setup, so the explicit
steps caused a duplicate Authorization header error (HTTP 400).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/govulncheck.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 5acbd9b0eb..9f5e452bd4 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -18,11 +18,7 @@ jobs:
     name: govulncheck
     runs-on: ubuntu-latest
     steps:
-      - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
-        with:
-          go-version-file: go.mod
       - name: Run govulncheck
         uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
+        with:
+          go-version-file: go.mod

From 645feebc2449a724700a8a942b2c6974f49f7978 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Mar 2026 23:44:38 +0000
Subject: [PATCH 3/3] fix: add GOEXPERIMENT=jsonv2 for govulncheck (required by
 trivy dependency)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/govulncheck.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 9f5e452bd4..fd79a2f215 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -22,3 +22,5 @@ jobs:
         uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
         with:
           go-version-file: go.mod
+        env:
+          GOEXPERIMENT: jsonv2