From 5432b86e7c1f434f7d4492b24e905b4af31f5fe7 Mon Sep 17 00:00:00 2001
From: Kentrow <22888702+Kentrow@users.noreply.github.com>
Date: Sat, 24 Oct 2026 20:02:39 +0200
Subject: [PATCH] ci: check for known vulnerabilities every day

---
 .github/workflows/vulnerabilities.yml | 33 +++++++++++++++++++++++++++
 RELEASING.md                          |  3 ++-
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/vulnerabilities.yml

diff --git a/.github/workflows/vulnerabilities.yml b/.github/workflows/vulnerabilities.yml
new file mode 100644
index 0000000..3dedbc1
--- /dev/null
+++ b/.github/workflows/vulnerabilities.yml
@@ -0,0 +1,33 @@
+name: Vulnerabilities
+
+# CI runs govulncheck on every push and pull request, so a vulnerability published in Go or a
+# dependency while nothing is being pushed would go unnoticed until the next change. This runs the
+# same check every day on main: a failed run is reported by GitHub to whoever maintains the
+# schedule, and calls for a patch release built with the fixed version.
+
+on:
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  GOVULNCHECK_VERSION: v1.8.0
+
+jobs:
+  govulncheck:
+    name: Known vulnerabilities
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run govulncheck
+        run: go run "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}" ./...
diff --git a/RELEASING.md b/RELEASING.md
index 0d2d5e6..c4be818 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -10,7 +10,8 @@ Releases are cut by the maintainer. The steps below assume the `gh` CLI is logge
 
 ## Which number
 
-- **Patch** (`0.3.1`): fixes only, security fixes included.
+- **Patch** (`0.3.1`): fixes only, security fixes included. One is due whenever the daily
+  Vulnerabilities workflow fails: the release rebuilds the image with the fixed Go or dependency.
 - **Minor** (`0.4.0`): anything a user can see that is not a fix.
 - **Major** (`2.0.0`): anything that breaks what the Compatibility section of the README lists.
 - The image gets `X.Y.Z`, `X.Y`, `X` and `latest`. Releases before 1.0 published no major tag,