chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group #380

	name: "Security Scan"

	# Run workflow each time code is pushed to your repository and on a schedule.
	# The scheduled workflow runs every at 00:00 on Sunday UTC time.
	on:
	workflow_dispatch:
	push:
	branches:
	- main
	paths:
	- 'cmd/**'
	- 'internal/**'
	- 'tests/**'
	- 'go.mod'
	- 'go.sum'
	- '*/.go'
	pull_request:
	branches:
	- main
	schedule:
	- cron: '0 0 * * 0'

	permissions:
	contents: read

	env:
	GO_VERSION: "1.26.4"

	jobs:
	scan:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	steps:
	- name: Check out code
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Go
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: true

	- name: Run govulncheck
	run: \|
	go install golang.org/x/vuln/cmd/govulncheck@latest
	govulncheck ./...

	- name: Security Scan
	# Pinned to gosec v2.27.1 commit SHA to mitigate supply-chain risk.
	# Update this together with the version comment when bumping.
	uses: securego/gosec@9e6a9843d7a4a6e3e9a8539b02612c8a4aa3f889 # v2.27.1
	with:
	args: '-fmt sarif -out results.sarif ./...'

	- name: Temp sarif workaround
	if: always()
	shell: bash
	run: \|
	sed -i "/null/d" results.sarif

	- name: Upload SARIF file
	if: always()
	uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
	with:
	sarif_file: results.sarif

Provide feedback