Security #76

	# SPDX-FileCopyrightText: Copyright 2026 Stacklok, Inc.
	# SPDX-License-Identifier: Apache-2.0

	name: Security

	on:
	workflow_call:
	schedule:
	# Run daily at 2 AM UTC
	- cron: '0 2 * * *'

	permissions:
	contents: read
	# TODO: Enable once repo is public for SARIF uploads
	# security-events: write

	jobs:
	govulncheck:
	name: Go Vulnerability Check
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Run govulncheck
	uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
	with:
	go-version-input: 'stable'
	go-package: ./...
	repo-checkout: false

	grype:
	name: Grype Vulnerability Scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Run Grype vulnerability scanner
	id: grype-scan
	uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
	with:
	path: "."
	output-format: "table"
	fail-build: true
	severity-cutoff: "high"
	only-fixed: true

	# TODO: Enable SARIF upload once repo is public
	# - name: Upload Grype scan results to GitHub Security tab
	# uses: github/codeql-action/upload-sarif@v3
	# if: always()
	# with:
	# sarif_file: ${{ steps.grype-scan.outputs.sarif }}
	# category: "grype"

Provide feedback