chore(ci): Add govulncheck to checks.yaml

.github/workflows/checks.yaml

@@ -62,6 +62,11 @@ jobs:
       - run: go work use .
         if: env.IS_RELEASE_BRANCH == 'true'
         working-directory: ${{ matrix.directory }}
+      - name: govluncheck
+        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee
+        with:
+          go-version-input: "1.24.1"
+          work-dir: ${{ matrix.directory }}
       - name: golangci-lint
         uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837
         with:

.github/workflows/vulnerability-check.yaml

@@ -16,7 +16,6 @@ jobs:
         directory:
           - examples
           - sdk
-          - lib/ocrypto
           - service
     steps:
       - name: govluncheck

Makefile

@@ -21,6 +21,7 @@ toolcheck:
 	@which protoc-gen-doc > /dev/null || (echo "protoc-gen-doc not found, run 'go install github.com/pseudomuto/protoc-gen-doc/cmd/[email protected]'" && exit 1)
 	@golangci-lint --version | grep "version v\?1.6[456]" > /dev/null || (echo "golangci-lint version must be v1.64 or later [$$(golangci-lint --version)]" && exit 1)
 	@which goimports >/dev/null || (echo "goimports not found, run 'go install golang.org/x/tools/cmd/goimports@latest'")
+	@govulncheck -version >/dev/null || (echo "govulncheck not found, run 'go install golang.org/x/vuln/cmd/govulncheck@latest'")
 
 fix: tidy fmt
 
@@ -33,7 +34,7 @@ tidy:
 license:
 	for m in $(MODS); do (cd $$m && go run github.com/google/[email protected] check --disallowed_types=forbidden --include_tests ./) || exit 1; done
 
-lint: proto-lint go-lint
+lint: proto-lint go-lint govulncheck
 
 proto-lint:
 	buf lint service || (exit_code=$$?; \
@@ -51,6 +52,15 @@ go-lint:
 		(cd "$$m" && golangci-lint run $(LINT_OPTIONS) --path-prefix="$$m" ) || status=1; \
 	done; \
 	exit $$status
+
+govulncheck:
+	status=0; \
+	for m in $(MODS); do \
+		echo "govulncheck module: $$m"; \
+		(cd "$$m" && govulncheck ./...) || status=1; \
+	done; \
+	exit $$status
+
 proto-generate:
 	rm -rf protocol/go/[a-fh-z]* docs/grpc docs/openapi
 	buf generate service