Run govulncheck in CI (#9)

Adds govulncheck to the CI workflow and tests against the same versions of golang as [boulder](https://github.com/letsencrypt/boulder/blob/cf770dfdef141c94507200ca803576d530481504/.github/workflows/boulder-ci.yml#L38-L40).
letsencrypt · Jul 20, 2023 · 52168b2 · 52168b2
1 parent 6cc6ce5
commit 52168b2
Showing 1 changed file with 28 additions and 6 deletions.
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -12,11 +12,14 @@ permissions:
   contents: read
 
 jobs:
-
   integration-tests:
+    strategy:
+      matrix:
+        containerGoVer:
+          - "1.20"
+          - "1.21-rc"
     runs-on: ubuntu-latest
-    container: golang:1.20
-
+    container: golang:${{ matrix.containerGoVer }}
     services:
       mysql:
         image: mariadb:10.5
@@ -30,7 +33,6 @@ jobs:
           --health-interval 10s
           --health-timeout 5s
           --health-retries 10
-
     steps:
       - uses: actions/checkout@v3
         with:
@@ -40,16 +42,36 @@ jobs:
         run: ./test_all.sh
 
   quick-tests:
+    strategy:
+      matrix:
+        containerGoVer:
+          - "1.20"
+          - "1.21-rc"
     runs-on: ubuntu-latest
-    container: golang:1.20
+    container: golang:${{ matrix.containerGoVer }}
     steps:
     - uses: actions/checkout@v3
       with:
         persist-credentials: false
 
-
     - name: Go Build
       run: go build -v ./...
 
     - name: Unit Tests
       run: go test -v ./...
+
+  govulncheck:
+    strategy:
+      matrix:
+        containerGoVer:
+          - "1.20"
+          - "1.21-rc"
+    runs-on: ubuntu-latest
+    container: golang:${{ matrix.containerGoVer }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+
+      - name: Run govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...