Fix working-directory handling to always run govulncheck on ./...

The action was incorrectly passing the working-directory value as an argument
to govulncheck. This fix ensures that:

- The action changes into the specified working-directory
- govulncheck always runs on './...' from within that directory
- Annotations use relative paths from the working directory

This matches the expected behavior where working-directory controls where
govulncheck runs, but govulncheck itself always scans the entire module
tree from that location.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

test/govulncheck.test.js

@@ -80,7 +80,7 @@ describe('GovulncheckRunner', () => {
       expect(result.errorOutput).toBe('error: vulnerabilities found');
     });
 
-    it('should use default working directory', async () => {
+    it('should always run on ./...', async () => {
       mockExec.exec.mockResolvedValue(0);
       
       await runner.run();
@@ -92,18 +92,6 @@ describe('GovulncheckRunner', () => {
       );
     });
 
-    it('should use custom working directory', async () => {
-      mockExec.exec.mockResolvedValue(0);
-      
-      await runner.run('./cmd/...');
-      
-      expect(mockExec.exec).toHaveBeenCalledWith(
-        'govulncheck',
-        ['-json', './cmd/...'],
-        expect.any(Object)
-      );
-    });
-
     it('should handle execution errors', async () => {
       mockExec.exec.mockRejectedValue(new Error('Command not found'));
       

test/index.test.js

@@ -65,7 +65,7 @@ describe('GitHub Action Integration', () => {
     expect(core.info).toHaveBeenCalledWith('No vulnerabilities found');
 
     expect(mockGovulncheck.install).toHaveBeenCalled();
-    expect(mockGovulncheck.run).toHaveBeenCalledWith('./...');
+    expect(mockGovulncheck.run).toHaveBeenCalled();
 
     expect(core.setOutput).toHaveBeenCalledWith('vulnerabilities-found', 'false');
     expect(core.setOutput).toHaveBeenCalledWith('vulnerability-count', '0');