This lesson's interactive features are locked, please to keep using them

Dependency Maintenance

A security check helps only when it runs regularly and someone responds to its results. Continuous integration can enforce the same Go checks on every push and pull request:

name: Go checks

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          cache-dependency-path: go.sum
      - run: go test ./...
      - run: go vet ./...
      - run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...

This workflow also follows some security best practices by pinning third-party actions to their full commit hashes and granting the minimum permissions necessary (in this case read only). It takes the Go version from your go.mod file and caches dependencies for efficiency.

There are automated update tools like Dependabot that can propose newer modules, but they do not replace review. Treat their pull requests like any other dependency change: inspect the release, run the checks, and verify application behavior.

Assignment

Bearly Secure's Go checks rely on someone remembering to run them. Add a GitHub Actions workflow for pushes and pull requests.

Create .github/workflows/go-checks.yml with push and pull_request triggers and only contents: read permission.
Add a test job on ubuntu-latest.

Pin the actions below to their full commit SHAs and retain the version comments:

actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

Configure setup-go with go-version-file: go.mod and cache-dependency-path: go.sum.
Run go test ./..., go vet ./..., and govulncheck pinned to v1.7.0.
If actionlint is available, validate the workflow locally:
```
actionlint .github/workflows/go-checks.yml
```

Run and submit the CLI tests from the project root.