name: better-setup-govulncheck
description: Install a pinned golang.org/x/vuln govulncheck binary via go install (requires Go on PATH) — no package manager needed, Forgejo/act runner safe.
inputs:
  version:
    description: Exact golang.org/x/vuln version (vX.Y.Z).
    required: true
runs:
  using: composite
  steps:
    - shell: bash
      run: |
        set -euo pipefail
        GOBIN=/usr/local/bin go install "golang.org/x/vuln/cmd/govulncheck@${{ inputs.version }}"
        govulncheck -version 2>/dev/null | head -2