Merge pull request #28 from hrodrig/feat/1.4-plan-sitemap-featured #240

	# Security scans before merging to main: run on PR/push to develop and main.
	# Fix or acknowledge any reported vulnerabilities before merging develop → main.

	name: Security

	permissions:
	contents: read

	on:
	push:
	branches: [main, develop]
	pull_request:
	branches: [main, develop]

	jobs:
	govulncheck:
	name: Go vulnerabilities
	permissions:
	contents: read
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version-file: go.mod

	- name: Install govulncheck
	run: go install golang.org/x/vuln/cmd/govulncheck@latest

	- name: Run govulncheck
	run: govulncheck ./...

	grype:
	name: Grype (container image)
	permissions:
	contents: read
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Build timestamp
	id: ts
	run: echo "b=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"

	- name: Build image
	uses: docker/build-push-action@v6
	with:
	context: .
	load: true
	push: false
	tags: gghstats:scan
	file: ./Dockerfile
	build-args: \|
	VERSION=ci
	COMMIT=${{ github.sha }}
	BUILDDATE=${{ steps.ts.outputs.b }}

	# Same as `make docker-scan` fallback: official image + --pull=always (no stale :latest cache).
	- name: Run Grype on image
	run: \|
	docker run --rm --pull=always \
	-v /var/run/docker.sock:/var/run/docker.sock \
	anchore/grype:latest \
	gghstats:scan --fail-on high

Navigation Menu