This lesson's interactive features are locked, please to keep using them

Dependency Maintenance

A security check only helps when it runs regularly and someone responds to its results. Continuous integration can enforce the same Go checks on every push and pull request:

name: Go checks

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum
      - run: go test ./...
      - run: go vet ./...
      - run: go run golang.org/x/vuln/cmd/[email protected] ./...

The workflow pins third-party actions to full commit SHAs, grants the GITHUB_TOKEN only read access, takes the Go version from go.mod, and keys dependency caching from go.sum. Full SHA pins prevent a moved tag from silently changing the action code; version comments keep the pins understandable.

Automated update tools can propose newer modules and action pins, but they do not replace review. Treat their pull requests like any other dependency change: inspect the release, run the checks, and verify the application.

Assignment

Bearly Secure's Go checks depend on someone remembering to run them. Add a least-privilege GitHub Actions workflow for pushes and pull requests.

Create .github/workflows/go-checks.yml with push and pull_request triggers and only contents: read permission.
Add a test job on ubuntu-latest.

Pin the actions below to their full commit SHAs and retain the version comments:

actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

Configure setup-go with go-version-file: go.mod and cache-dependency-path: go.sum.
Run go test ./..., go vet ./..., and the pinned govulncheck command from Lesson 8.12.
If actionlint is available, validate the workflow locally:
```
actionlint .github/workflows/go-checks.yml
```

Run and submit the CLI tests from the project root.