Security #72

	# Security — runs govulncheck and gosec on every PR, every push to main,
	# and weekly (Mondays 06:00 UTC). gosec uploads SARIF to the GitHub
	# Security tab; govulncheck fails CI on HIGH/CRITICAL findings.
	#
	# Q13: every third-party action `uses:` reference is pinned to a 40-char
	# commit SHA with a `# vN.x.y` comment for human readability.
	name: Security

	on:
	pull_request:
	push:
	branches:
	- main
	schedule:
	- cron: '0 6 * * 1'

	permissions:
	contents: read

	jobs:
	govulncheck:
	name: govulncheck
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Setup Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version-file: go.mod

	- name: Install govulncheck
	run: go install golang.org/x/vuln/cmd/govulncheck@latest

	- name: Run govulncheck
	run: govulncheck ./...

	gosec:
	name: gosec
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Setup Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version-file: go.mod

	- name: Run gosec
	uses: securego/gosec@5e5517beec77b8228ba43ec8d7cc22d82ed31924 # v2.25.0
	with:
	args: '-no-fail -fmt sarif -out gosec.sarif ./...'

	- name: Upload SARIF
	uses: github/codeql-action/upload-sarif@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4 (codeql-bundle-v2.25.4)
	with:
	sarif_file: gosec.sarif

Provide feedback