Description

To stay on top of security issues in gh we would like to periodically run govulncheck in CI and be notified of any failures.

govulncheck can be incorporated in a number of ways to cli/cli repository:

1. Expand lint workflow to include run govulncheck, failing pull requests if a Go security vulnerability is detected

2. Create a scheduled workflow that runs gvulncheck and uploads the resulting SARIF file to GitHub for code scanning alerts

Expected outcomes

• gh is scanned for Go vulnerabilities as part of SDLC process
• CLI maintainers have notification of new vulnerabilities via #cli-activity Slack channel