Run govulncheck on CI

Author: sue445

.github/workflows/build.yml

@@ -149,6 +149,45 @@ jobs:
           status: ${{ job.status }}
           webhook-url: ${{ secrets.SLACK_WEBHOOK }}
 
+  go-govulncheck:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ruby
+          bundler-cache: true
+
+      - name: export CGO_CFLAGS for govulncheck
+        run: bundle exec rake go:build_envs[CGO_CFLAGS] >> $GITHUB_ENV
+      - run: echo $CGO_CFLAGS
+
+      - name: export BUILD_TAG for govulncheck
+        run: echo "BUILD_TAG=$(bundle exec rake go:build_tag)" >> $GITHUB_ENV
+      - run: echo $BUILD_TAG
+
+      # FIXME: golang/govulncheck-action@v1 doesn't support `-tags` arg
+      # - uses: golang/govulncheck-action@v1
+      #   with:
+      #     go-version-file: go.mod
+      - run: govulncheck -format text -tags "${BUILD_TAG}" ./...
+
+      - name: Slack Notification (not success)
+        uses: act10ns/slack@v2
+        if: "! success()"
+        continue-on-error: true
+        with:
+          status: ${{ job.status }}
+          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
+
   ruby-lint:
     runs-on: ubuntu-latest
 
@@ -230,6 +269,7 @@ jobs:
     needs:
       - build-and-test
       - go-lint
+      - go-govulncheck
       - ruby-lint
       - ruby-rbs
       - go_gem