Update github workflows

[sergiught]

🔧 Changes

Updates to the CI pipeline:

• Move govulncheck to Security workflow
• Update go setup to v4.
• Remove deferred trigger PR workflow so the security jobs can trigger

📚 References

🔬 Testing

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[Widcket]

Should this be running on a cron?

[sergiught]

Yes, as otherwise it would only trigger when there is activity on this repo. But in case there isn't any, we still want to trigger this security check so we can get alerted if any dependencies have had vulnerabilities discovered.

[Widcket]

Thanks for the clarification.

[Widcket]

Shouldn't that be done by Dependabot and Snyk anyway?

[sergiught]

That's done also by Dependabot and Snyk, correct. From my understanding we need both snyk, semgrep and govulncheck to maximize the chance of being alerted on issues, so we don't have just a single point of failure for security checks.

I'll cc: @evansims and @poovamraj tho to confirm.

[evansims]

👋 Yup! Snyk is excellent, but its handling of Go has not proven to be the most reliable in our past experiences. On the other hand, Govulncheck has proven quite reliable. Having it as an additional security filter here makes sense. 👍

[Widcket]

Thanks @evansims!