icns

commit b77d8f9375bcff3810c7b3604e1c247648838afc
parent 7ed3aef71850d972b3d4dabf20c62f499e68d745
Author: Jack Mordaunt <jackmordaunt.dev@gmail.com>
Date:   Sun, 20 Sep 2026 07:23:57 -0300

ci: pin govulncheck to a release

At latest, a different scanner runs each week and a bad release reaches CI
the day it lands. Naming a version makes an upgrade a reviewed change; the
advisory data is still fetched at run time.

Diffstat:
M
.github/workflows/ci.yml
 | 
2
+-

1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -170,5 +170,5 @@ jobs:
       - run: go vet ./...
       - name: govulncheck
         run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          go install golang.org/x/vuln/cmd/govulncheck@v1.8.0
           govulncheck ./...