feat(workflows)!: step 11, upload govulncheck findings as SARIF

.github/workflows/govulncheck.yml

@@ -5,7 +5,8 @@ name: govulncheck
 
 # Reusable workflow that runs the Go team's vulnerability scanner against
 # the caller's module. Detects known CVEs in the import graph (including
-# transitive deps) and reports them as workflow annotations.
+# transitive deps), uploads them to GitHub Advanced Security as SARIF, and
+# fails the job when a vulnerable symbol is called.
 #
 # Pair with the actionlint/zizmor lint workflow for a "static security
 # baseline" wave; pair with dependency-review for PR-time gating.
@@ -31,6 +32,7 @@ on:
 
 permissions:
   contents: read   # baseline for checkout
+  security-events: write  # for SARIF upload to GHAS
 
 jobs:
   govulncheck:
@@ -44,3 +46,16 @@ jobs:
           go-version-file: ${{ inputs.go-version == '' && 'go.mod' || '' }}
           go-version-input: ${{ inputs.go-version }}
           go-package: ${{ inputs.go-package }}
+          output-format: sarif
+          output-file: govulncheck.sarif
+
+      - name: Upload SARIF to GHAS
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          sarif_file: govulncheck.sarif
+          category: govulncheck
+
+      # SARIF mode exits 0 on findings; fail on called vulnerabilities (level
+      # "error") like the default text mode does.
+      - name: Fail on called vulnerabilities
+        run: jq -e '[.runs[].results[]? | select(.level == "error")] | length == 0' govulncheck.sarif

docs/workflows.md

@@ -355,6 +355,9 @@ on:
 jobs:
   govulncheck:
     uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@v4.0
+    permissions:
+      contents: read
+      security-events: write  # SARIF upload to GHAS
     # Optional overrides:
     # with:
     #   go-version: 1.26.7  # default: read from go.mod