disable gomod in dependabot, add govulncheck workflow

Author: Luit

.github/dependabot.yml

@@ -3,12 +3,6 @@
 
 version: 2
 updates:
-  - package-ecosystem: "gomod"
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "weekly"
-      day: "sunday"
-      time: "16:00"
   - package-ecosystem: "docker"
     directories:
       - "/"
@@ -24,4 +18,4 @@ updates:
       time: "16:00"
     groups:
       all-actions:
-        patterns: [ "*" ]
+        patterns: ["*"]

.github/workflows/govulncheck.yml

@@ -0,0 +1,26 @@
+on:
+  schedule:
+    # Mondays & Thursdays at 07:00.
+    - cron: "0 7 * * 1,4"
+      timezone: "Europe/Amsterdam"
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    name: Run govulncheck
+    strategy:
+      matrix:
+        go:
+          - "1.25"
+          - "1.26"
+    steps:
+      - id: govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: ${{ matrix.go }}