name: Nightly govulncheck
on:
  workflow_call: # allows to reuse this workflow
    inputs:
      ref:
        description: 'The branch to run the workflow on'
        required: true
        type: string
  push:
    branches:
      - release-v*
      - mq-working-branch-**
    tags-ignore:
      - 'contrib/**'
      - 'instrumentation/**'
      - 'internal/**'
      - 'orchestrion/**'
      - 'scripts/**'
  schedule:
    - cron: '00 00 * * *'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  govulncheck-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          ref: ${{ inputs.ref || github.ref }}
      - name: Setup Go and development tools
        uses: ./.github/actions/setup-go
        with:
          go-version: stable
          tools-dir: ${{ github.workspace }}/_tools
          tools-bin: ${{ github.workspace }}/bin
      - name: Run govulncheck
        run: |-
          export PATH="${{ github.workspace }}/bin:${PATH}"
          govulncheck ./ddtrace/... ./appsec/... ./profiler/... ./internal/... ./instrumentation/...
      - name: Run govulncheck-contribs
        run: |-
          export PATH="${{ github.workspace }}/bin:${PATH}"
          ./.github/workflows/apps/govulncheck-contribs-v2.sh
