action.yml

name: 'golang-govulncheck-action'
description: 'Run govulncheck'
inputs:
  go-version-input: # version of Go to use for govulncheck
    description: 'Version of Go to use for govulncheck'
    required: false
    default: 'stable'
  check-latest:
    description: 'Set this option to true if you want the action to always check for the latest available Go version that satisfies the version spec'
    required: false
    default: true
  cache:
    description: 'Used to specify whether Go caching is needed. Set to true, if you would like to enable caching.'
    required: false
    default: true
  cache-dependency-path:
    description: 'Used to specify the path to a dependency file (for monorepos) - go.sum'
    required: false
    default: ''
  go-package:
    description: 'Go Package to scan with govulncheck'
    required: false
    default: './...'
  work-dir:
    description: 'Directory in which to run govulncheck'
    required: false
    default: '.'
  repo-checkout:
    description: "Checkout the repository"
    required: false
    default: true
  go-version-file:
    description: 'Path to the go.mod or go.work file.'
    required: false
  output-format:
    description: 'The format of the output'
    required: false
    default: 'text'
  output-file:
    description: 'The file to which the govulncheck output is saved'
    required: false
    default: ''
runs:
  using: "composite"
  steps:
    - if: inputs.repo-checkout != 'false' # only explicit false prevents repo checkout
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
      with:
        go-version: ${{ inputs.go-version-input }}
        check-latest: ${{ inputs.check-latest }}
        go-version-file: ${{ inputs.go-version-file }}
        cache: ${{ inputs.cache }}
        cache-dependency-path: ${{ inputs.cache-dependency-path }}
    - name: Install govulncheck
      run: go install golang.org/x/vuln/cmd/govulncheck@latest
      shell: bash
      env:
        GOOS: ''
        GOARCH: ''
    - if: inputs.output-file == ''
      name: Run govulncheck
      run: govulncheck -C "$WORK_DIR" -format "$OUTPUT_FORMAT" "$GO_PACKAGE"
      shell: bash
      env:
        WORK_DIR: ${{ inputs.work-dir }}
        OUTPUT_FORMAT: ${{ inputs.output-format }}
        GO_PACKAGE: ${{ inputs.go-package }}
    - if: inputs.output-file != ''
      name: Run govulncheck and save to file
      run: govulncheck -C "$WORK_DIR" -format "$OUTPUT_FORMAT" "$GO_PACKAGE" > "$OUTPUT_FILE"
      shell: bash
      env:
        WORK_DIR: ${{ inputs.work-dir }}
        OUTPUT_FORMAT: ${{ inputs.output-format }}
        GO_PACKAGE: ${{ inputs.go-package }}
        OUTPUT_FILE: ${{ inputs.output-file }}