dependency-check.yml

name: Dependency Vulnerability Check

on:
  push:

jobs:
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    outputs:
      changes: ${{ steps.changes.outputs.src }}
    steps:
      - name: Checkout the repo
        uses: actions/checkout@v4.2.1
      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: |
            src:
              - '**/*go.sum'
              - '**/*go.mod'
              - '.github/workflows/dependency-check.yml'
  Go:
    runs-on: ubuntu-latest
    needs: [changes]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4.2.1

      - name: Set up Go
        if: needs.changes.outputs.src == 'true'
        uses: ./.github/actions/setup-go
        with:
          go-version-file: 'go.mod'
          only-modules: 'true'

      - name: Write Go Modules list
        if: needs.changes.outputs.src == 'true'
        run: go list -json -m all > go.list

      - name: Check vulnerabilities
        if: needs.changes.outputs.src == 'true'
        uses: sonatype-nexus-community/nancy-github-action@726e338312e68ecdd4b4195765f174d3b3ce1533 # v1.0.3
        with:
          nancyVersion: "v1.0.39"