build(security): add nightly run of govulncheck, move it out of depen…

…dency review (#2792)

.github/workflows/dependendy-review.yml

@@ -5,6 +5,7 @@
 # Source repository: https://github.com/actions/dependency-review-action
 # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 name: 'Dependency Review'
+
 on: [pull_request]
 
 permissions:
@@ -18,10 +19,3 @@ jobs:
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@v4
-      - id: govulncheck
-        name: 'Govulncheck'
-        uses: golang/govulncheck-action@3a32958c2706f7048305d5a2e53633d7e37e97d0 # v1.0.2
-        continue-on-error: true
-        with:
-          repo-checkout: false
-          cache: false

.github/workflows/govulncheck.yaml

@@ -0,0 +1,24 @@
+
+name: 'govulncheck'
+on:
+  ## Nightly
+  schedule:
+    - cron: '42 1 * * *'
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+      - id: govulncheck
+        name: 'Govulncheck'
+        uses: golang/govulncheck-action@3a32958c2706f7048305d5a2e53633d7e37e97d0 # v1.0.2
+        continue-on-error: ${{ github.event_name == 'pull_request' }}
+        with:
+          repo-checkout: false
+          cache: false