should it be in another job as this job is focusing on golangci-lint ? I think golangci-lint and nancy are two independent tasks, they can be running in parallel as well :)

ok, let me move it

We might need to test it out for negative case to make sure it failed here. I faced a few cases github action didn't fail as expected, so just a precautious step.

I'm using it in several projects, and at work and it's failing :)

recently I had to disable it on a weekend because the server was unavailable

oh I see, we can just let it run as non-required job for sometime first, then change settings later once we see fit.

then I need to move it to a separate file

like extra

done

oh actually, you can still have it in the same pr workflow, mandatory setting is per job.

Anyway, no harm to keep it in another file.

You should rather use:

go list -json -m all | nancy

(see deprecation notice)

thanks I didn't know

done