feat: testing for actions PR 53

.github/workflows/govulncheck.yml

@@ -13,7 +13,10 @@ permissions:
 
 jobs:
   check:
-    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@5a0ca6e79ffd9f8db2b517beb176039628d22095 # github-actions under test (seantronsen/feat/release-attestation)
+    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@9aa4f9e5a010d45cec4d108baacd1cdcb2aef40e # github-actions under test (seantronsen/feat/sarif-govulncheck)
+    permissions:
+      contents: read
+      security-events: write  # SARIF upload to GHAS
 
   govulncheck:
     if: ${{ always() }}

README.md

@@ -68,5 +68,7 @@ the result; `make generate-check` is what CI runs.
 - **Release mode**: push a `v*` tag (e.g. `v0.0.1`). Tag freely.
 - **Docs links**: a PR that changes docs runs `lint-docs`; broken links show
   up as code scanning comments on the PR. On `main`, they go to an issue.
+- **Go vulnerabilities**: `govulncheck` uploads findings to code scanning and
+  fails when a vulnerable symbol is called.
 - **Another github-actions ref**: update the pinned SHA in
   `.github/workflows/*.yml`.

cmd/server/vulntest.go

@@ -0,0 +1,13 @@
+// Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+//
+// SPDX-License-Identifier: MIT
+
+// Calls a known-vulnerable symbol (GO-2020-0017) so govulncheck reports a
+// called vulnerability. Testing only for OpenCHAMI/github-actions#53; revert.
+package main
+
+import jwt "github.com/dgrijalva/jwt-go"
+
+func init() {
+	_ = jwt.MapClaims{}.VerifyAudience("", false)
+}

go.mod

@@ -3,6 +3,7 @@ module github.com/openchami/github-actions-testbed
 go 1.26.10
 
 require (
+	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/getkin/kin-openapi v0.151.0
 	github.com/go-chi/chi/v5 v5.5.0
 	github.com/openchami/fabrica v0.4.11

go.sum

@@ -4,6 +4,8 @@ github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6N
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=