audit.yml

name: Audit
on:
  pull_request:
    paths:
    - .github/workflows/audit.yml
    - '*.go'
    - go.mod
    - go.sum
  push:
    branches:
    - main
  schedule:
  - cron: 0 2 * * *
  workflow_dispatch: ~

permissions: read-all

jobs:
  capabilities:
    name: Capabilities
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      with:
        persist-credentials: false
    - name: Install Go
      uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
      with:
        go-version-file: go.mod
    - name: Audit
      run: go run tasks.go audit-capabilities
  vulnerabilities:
    name: Vulnerabilities
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout repository
      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      with:
        persist-credentials: false
    - name: Install Go
      uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
      with:
        go-version-file: go.mod
    - name: Audit
      run: go run tasks.go audit-vulnerabilities