Repository navigation

Bump actions/setup-go from 6.2.0 to 6.4.0 (#14) #116

	name: gopresubmit

	on:
	push:
	branches:
	- main
	pull_request:
	types: [opened, reopened, synchronize]

	permissions:
	contents: read

	jobs:
	build:
	name: Go presubmit
	runs-on: ubuntu-latest
	strategy:
	matrix:
	go-version: ['1.22']
	steps:
	- name: Install Go ${{ matrix.go-version }}
	uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
	with:
	go-version: ${{ matrix.go-version }}
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Security scan for dangerous Go patterns
	run: \|
	# Detect go:generate directives (potential code execution)
	if grep -rn '//go:generate' --include='*.go' .; then
	echo "::error::Detected //go:generate directive - requires manual review"
	exit 1
	fi
	# Detect CGo usage (native code execution during build)
	if grep -rn 'import "C"' --include='*.go' .; then
	echo "::error::Detected CGo import - requires manual review"
	exit 1
	fi
	# Detect #cgo directives
	if grep -rn '#cgo' --include='*.go' .; then
	echo "::error::Detected #cgo directive - requires manual review"
	exit 1
	fi

	- uses: creachadair/go-presubmit-action@4f7a734aa8275675a945fbf589734f8cf7dda58a # v2.0.3
	with:
	staticcheck-version: "2023.1.6"