build: add govulncheck for released binary checks #4

	name: Audit Released Binary

	on:
	pull_request:
	branches:
	- master
	schedule:
	- cron: '0 0 * * *'
	workflow_dispatch:

	jobs:
	scan_binary:
	runs-on: ubuntu-latest
	env:
	GH_TOKEN: ${{ github.token }}
	steps:
	- name: Set up Go environment
	uses: actions/setup-go@v5
	with:
	go-version: 'stable'

	- name: Install govulncheck
	run: \|
	go install golang.org/x/vuln/cmd/govulncheck@latest
	echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

	- uses: actions/checkout@v7
	with:
	sparse-checkout: \|
	README.md

	- name: Fetch latest release binary
	run: \|
	ASSET_NAME=$(gh release view --json assets -q '.assets[].name' \| grep 'linux' \| head -n 1)
	if [ -z "$ASSET_NAME" ]; then echo "No binary found"; exit 1; fi
	gh release download --pattern "$ASSET_NAME"
	tar -xzf "$ASSET_NAME" --strip-components=1

	- name: Run govulncheck on Asset
	run: \|
	govulncheck -mode=binary sql_exporter > govulncheck_output.txt \|\| true

	- name: Show govulncheck output in GitHub summary
	uses: actions/github-script@v7
	with:
	script: \|
	const fs = require('fs');
	const output = fs.readFileSync('govulncheck_output.txt', 'utf8');
	github.rest.issues.createComment({
	owner: context.repo.owner,
	repo: context.repo.repo,
	issue_number: context.issue.number,
	body: `### govulncheck Output\n\`\`\`\n${output}\n\`\`\``
	});

Navigation Menu