Vulnerability checks workflow (9seconds/mtg)

The Vulnerability checks workflow from 9seconds/mtg, explained and optimized by Latchkey.

CI health: C - fair

Point runs-on at Latchkey and get run de-duplication, job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: 9seconds/mtg.github/workflows/govulncheck.ymlLicense MITView source

What it does

This is the Vulnerability checks workflow from the 9seconds/mtg repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

---

name: Vulnerability checks

permissions:
  actions: read
  checks: read
  contents: read
  deployments: read
  issues: read
  discussions: read
  pull-requests: read
  repository-projects: read
  security-events: read
  statuses: read

on:
  push:
  pull_request:
  schedule: # daily at 10:22 UTC
    - cron: '22 10 * * *'
  workflow_dispatch:

jobs:
  vuln:
    name: Test vulnerabilities
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v6
      with:
        submodules: recursive

    - name: Setup Go
      uses: actions/setup-go@v6
      with:
        go-version-file: go.mod
        cache: true

    - name: Check for vulnerabilities
      run: |
        go run golang.org/x/vuln/cmd/govulncheck@latest ./...

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

---
 
name: Vulnerability checks
 
permissions:
  actions: read
  checks: read
  contents: read
  deployments: read
  issues: read
  discussions: read
  pull-requests: read
  repository-projects: read
  security-events: read
  statuses: read
 
on:
  push:
  pull_request:
  schedule: # daily at 10:22 UTC
    - cron: '22 10 * * *'
  workflow_dispatch:
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  vuln:
    timeout-minutes: 30
    name: Test vulnerabilities
    runs-on: latchkey-small
    steps:
    - name: Checkout
      uses: actions/checkout@v6
      with:
        submodules: recursive
 
    - name: Setup Go
      uses: actions/setup-go@v6
      with:
        go-version-file: go.mod
        cache: true
 
    - name: Check for vulnerabilities
      run: |
        go run golang.org/x/vuln/cmd/govulncheck@latest ./...

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cancel superseded runs when a branch or PR gets a newer push.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout actions/setup-go