fix: change securego/gosec with trivy

Signed-off-by: Andre Nogueira <aanogueira@protonmail.com>

Author: aanogueira

.github/workflows/ci.yml

@@ -2,9 +2,13 @@ name: CI
 
 on:
   push:
-    branches: [main, master]
+    branches: [main]
   pull_request:
-    branches: [main, master]
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
 
 jobs:
   test:
@@ -19,7 +23,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ matrix.go }}
 
@@ -29,7 +33,7 @@ jobs:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum', '**/go.mod') }}
           restore-keys: |
             ${{ runner.os }}-go-
 
@@ -44,6 +48,7 @@ jobs:
         run: go test -v -race -coverprofile=coverage.txt -covermode=atomic ./...
 
       - name: Upload coverage to Codecov
+        if: matrix.os == 'ubuntu-latest'
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -69,6 +74,7 @@ jobs:
   build:
     name: Build
     runs-on: ${{ matrix.os }}
+    needs: [test, lint, security]
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
@@ -103,12 +109,18 @@ jobs:
         with:
           go-version: "1.25"
 
-      - name: Run Gosec Security Scanner
-        uses: securego/gosec@master
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
         with:
-          args: "-no-fail -fmt sarif -out results.sarif ./..."
-
-      - name: Upload SARIF file
+          scan-type: "fs"
+          scan-ref: "."
+          format: "sarif"
+          output: "trivy-results.sarif"
+          severity: "CRITICAL,HIGH,MEDIUM"
+          exit-code: "1"
+
+      - name: Upload Trivy results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v4
+        if: always()
         with:
-          sarif_file: results.sarif
+          sarif_file: "trivy-results.sarif"