Problem

See https://go.dev/blog/vuln for details on this tool. In short, it's a Go code vulnerability scanner.

The problem this solves it that we want to be alerted to potential security issues in our codebase ASAP so we can fix them.

Solution

We want to run this tool in CI.

Impact

This will let us spot security issues as soon as possible without relying on people reading blogs, CVE announcements, etc.

Acceptance Criteria

• Add a static analysis task to run this tool.
• Decide what to do with its output. Do we fail CI on some or all vulnerabilities? If not, how can we be alerted to vulnerabilities?