From 5fe3fdd73cc5133cb25a1b3371c5f1ddebf9453b Mon Sep 17 00:00:00 2001
From: 9seconds <nineseconds@yandex.ru>
Date: Tue, 24 Feb 2026 14:21:16 +0100
Subject: [PATCH] Check for vulnerabilities

---
 .github/workflows/govulncheck.yml | 38 +++++++++++++++++++++++++++++++
 .mise.toml                        |  5 ++++
 mise.lock                         |  4 ++++
 3 files changed, 47 insertions(+)
 create mode 100644 .github/workflows/govulncheck.yml

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
new file mode 100644
index 0000000..a0f91cd
--- /dev/null
+++ b/.github/workflows/govulncheck.yml
@@ -0,0 +1,38 @@
+---
+
+name: Vulnerability checks
+
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  issues: read
+  discussions: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
+on:
+  push:
+  pull_request:
+  schedule: # daily at 10:22 UTC
+    - cron: '22 10 * * *'
+  workflow_dispatch:
+
+jobs:
+  vuln:
+    name: Test vulnerabilities
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6
+      with:
+        submodules: recursive
+
+    - uses: jdx/mise-action@v3
+      name: Install mise
+
+    - name: Run tests
+      run: mise tasks run vuln
diff --git a/.mise.toml b/.mise.toml
index 06b9ea5..7d6978f 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -1,6 +1,7 @@
 [tools]
 "go:golang.org/x/pkgsite/cmd/pkgsite" = "latest"
 "go:golang.org/x/tools/gopls" = "latest"
+"go:golang.org/x/vuln/cmd/govulncheck" = "latest"
 "go:mvdan.cc/gofumpt" = "latest"
 go = "latest"
 golangci-lint = "latest"
@@ -26,6 +27,10 @@ run = [
 description = "Run linter"
 run = "golangci-lint run"
 
+[tasks.vuln]
+description = "Test for vulnerabilities"
+run = "govulncheck ./..."
+
 [tasks.test]
 description = "Run tests"
 run = "go test -v ./..."
diff --git a/mise.lock b/mise.lock
index d6b2d74..ac22b61 100644
--- a/mise.lock
+++ b/mise.lock
@@ -15,6 +15,10 @@ backend = "go:golang.org/x/pkgsite/cmd/pkgsite"
 version = "0.21.1"
 backend = "go:golang.org/x/tools/gopls"
 
+[[tools."go:golang.org/x/vuln/cmd/govulncheck"]]
+version = "1.1.4"
+backend = "go:golang.org/x/vuln/cmd/govulncheck"
+
 [[tools."go:mvdan.cc/gofumpt"]]
 version = "0.9.2"
 backend = "go:mvdan.cc/gofumpt"