lfreleng-actions/🛡️ Go Audit
Runs govulncheck, gosec and staticcheck security audits
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- None
Pinned Snippet
uses: lfreleng-actions/go-audit-action@3164e5b31c230a782e4e8bb0e21f313307f703a9 # v0.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| go_version | Explicit Go version to install; takes precedence over go_version_file | no | "" |
| go_version_file | File to read the Go version from, relative to path_prefix | no | go.mod |
| path_prefix | Project directory; must resolve within the workspace | no | . |
| govulncheck | Run govulncheck: 'true' or 'false' | no | true |
| gosec | Run gosec: 'true' or 'false' | no | false |
| staticcheck | Run staticcheck: 'true' or 'false' | no | false |
| govulncheck_version | golang.org/x/vuln version to install, e.g. v1.5.0; never 'latest' | no | v1.5.0 |
| gosec_version | securego/gosec version to install, e.g. v2.27.1; never 'latest' | no | v2.27.1 |
| staticcheck_version | honnef.co/go/tools version to install, e.g. v0.7.0; never 'latest' | no | v0.7.0 |
| permit_fail | Report tool findings without failing the action: 'true' or 'false' | no | false |
| output_directory | Audit report directory, within workspace or runner temp | no | . |
Outputs
| name | description |
|---|---|
| govulncheck_passed | govulncheck result: 'true', 'false' or 'skipped' |
| gosec_passed | gosec result: 'true', 'false' or 'skipped' |
| staticcheck_passed | staticcheck result: 'true', 'false' or 'skipped' |
| reports_directory | Absolute path to the directory holding audit reports |