Release #28

	name: Release

	on:
	pull_request:
	paths:
	- '.github/workflows/release.yml'
	- 'govulncheck-with-excludes.sh'
	push:
	paths:
	- '.github/workflows/release.yml'
	- 'govulncheck-with-excludes.sh'
	schedule:
	- cron: 0 0 * * 0
	workflow_dispatch:

	defaults:
	run:
	shell: 'bash -Eeuo pipefail -x {0}'

	jobs:
	test:
	name: govulncheck
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: download
	run: \|
	# find and download the latest release for testing
	tags="$(git ls-remote --tags https://github.com/tianon/gosu.git \| cut -d/ -f3 \| cut -d^ -f1 \| sort -urV)"
	for tag in $tags; do
	echo >&2 "checking $tag ..."
	url="https://github.com/tianon/gosu/releases/download/$tag"
	if wget -O SHA256SUMS "$url/SHA256SUMS" && [ -s SHA256SUMS ]; then
	files="$(grep -oE '[ ]gosu-[^.]+$' SHA256SUMS \| grep -oE 'gosu-.$')"
	for file in $files; do
	wget -O "$file" "$url/$file"
	done
	if grep -E '[ *]gosu-[^.]+$' SHA256SUMS \| sha256sum --strict --check -; then
	echo >&2 "success with $tag !"
	exit 0
	fi
	fi
	done

	echo >&2 'error: failed to find latest release'

	- name: govulncheck
	run: \|
	for gosu in gosu-*; do
	./govulncheck-with-excludes.sh -mode=binary "$gosu"
	done

Provide feedback