From 1d67a42dacc2efa5f5382447fe44b5eaaec340a1 Mon Sep 17 00:00:00 2001
From: Vlad Durnea <vlad@durnea.com>
Date: Sat, 31 Oct 2026 11:07:05 +0200
Subject: [PATCH] better-setup-govulncheck v1: pinned go install

---
 README.md  |  8 ++++++++
 action.yml | 14 ++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 README.md
 create mode 100644 action.yml

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..293f5a9
--- /dev/null
+++ b/README.md
@@ -0,0 +1,8 @@
+# better-setup-govulncheck
+
+Pinned `golang.org/x/vuln/cmd/govulncheck` via `go install` (run it after better-setup-go).
+
+```yaml
+- uses: https://git.madapes.com/actions/better-setup-govulncheck@v1
+  with: { version: "v1.9.0" }
+```
diff --git a/action.yml b/action.yml
new file mode 100644
index 0000000..567b23c
--- /dev/null
+++ b/action.yml
@@ -0,0 +1,14 @@
+name: better-setup-govulncheck
+description: Install a pinned golang.org/x/vuln govulncheck binary via go install (requires Go on PATH) — no package manager needed, Forgejo/act runner safe.
+inputs:
+  version:
+    description: Exact golang.org/x/vuln version (vX.Y.Z).
+    required: true
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        set -euo pipefail
+        GOBIN=/usr/local/bin go install "golang.org/x/vuln/cmd/govulncheck@${{ inputs.version }}"
+        govulncheck -version 2>/dev/null | head -2