Add govulncheck GH Action (#235)

Author: paulwilljones

.github/workflows/build-test.yaml

@@ -20,14 +20,26 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
       - name: Setup Golang
-        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.0
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: go.mod
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804      # v4.0.0
         with:
           version: v1.54
           args: --timeout 10m --exclude SA5011 --verbose --issues-exit-code=0
           only-new-issues: true
 
+  govulncheck:
+    runs-on: ubuntu-latest
+    name: Run govulncheck
+    steps:
+      - id: govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+           go-version-file: go.mod
+           go-package: ./...
+
   test:
     name: Run unit tests for Go packages
     runs-on: ubuntu-latest
@@ -36,6 +48,8 @@ jobs:
       uses: actions/checkout@v3 # v3.5.3
     - name: Setup Go
       uses: actions/setup-go@v4
+      with:
+        go-version-file: go.mod
 
     - name: Download and required packages
       run: |
@@ -44,13 +58,13 @@ jobs:
     - name: Run all unit tests
       run: make test
 
-    - name: check test coverage
-      uses: vladopajic/go-test-coverage@v2
-      with:
-        config: ./.testcoverage.yml
+    - name: Check test coverage
+      run: |
+        go install github.com/vladopajic/go-test-coverage/v2@latest
+        go-test-coverage --config=./.testcoverage.yml
 
     - name: Generate code coverage artifacts
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      uses: actions/upload-artifact@v4
       with:
         name: code-coverage
         path: coverage.out

go.mod

@@ -1,8 +1,6 @@
 module github.com/jetstack/version-checker
 
-go 1.22.0
-
-toolchain go1.22.3
+go 1.22.6
 
 // Do not remove this comment:
 // please place any replace statements here at the top for visibility and add a
@@ -60,10 +58,8 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/docker/cli v27.1.2+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker v27.1.2+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
-	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect