fix(ci): Dont fail on govulncheck

[elizabethhealy]

Proposed Changes

• We decided to trust GH Security Check (dependency review GHA in opentdf/platform) as the ground source of truth and make govulncheck nonrequired. We'll do a follow-up to make sure govulncheck run failures add context to PRs for visibility

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow configuration for vulnerability scanning. The scan will no longer block workflow completion if issues are detected, allowing the pipeline to proceed for further review.

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[coderabbitai]

📝 Walkthrough

Walkthrough

A vulnerability scanning step in .github/workflows/checks.yaml was corrected from govluncheck to govulncheck, assigned an explicit step id, and configured with continue-on-error: true to allow workflow progression despite potential errors.

Changes

Cohort / File(s)	Summary
CI/CD Workflow Configuration .github/workflows/checks.yaml	Renamed vulnerability scan step from govluncheck to govulncheck, added step id, and set continue-on-error: true to permit job continuation on scan findings.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A typo hopped away so quick,
govlun became govuln slick!
With errors now allowed to pass,
The workflow flows with gentle sass! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(ci): Dont fail on govulncheck' clearly and specifically describes the main change: modifying CI behavior to allow govulncheck to continue without failing the workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bypass-govulncheck

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	210.751725ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	99.901564ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	378.587802ms
Throughput	264.14 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.243427375s
Average Latency	400.845261ms
Throughput	124.24 requests/second

[github-actions]

X-Test Failure Report

✅ go-pull-3257
✅ java-pull-3257
✅ java-v0.9.0
✅ js-pull-3257
✅ js-v0.9.0
test-cases-mapping-report
cukes-report
bats-test-results
opentdfplatformA510XN.dockerbuild

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/checks.yaml:
- Around line 72-74: The govulncheck step is marked continue-on-error: true so
failures are silent; add a follow-up step that runs unconditionally or with if:
steps.govulncheck.outcome == 'failure' and explicitly surfaces the result (for
example emit an actionable warning/annotation or set a job output) so reviewers
see when steps.govulncheck.outcome == 'failure'; reference the govulncheck step
by id ('govulncheck') and use that outcome check to print a clear message or
annotate the run without changing the step to blocking.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3b6b01ac-fcfe-46ca-8e5d-a849867ceff4

📥 Commits

Reviewing files that changed from the base of the PR and between f04a385 and bf7ba20.

📒 Files selected for processing (1)

• .github/workflows/checks.yaml

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	196.090065ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	102.425439ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	373.012186ms
Throughput	268.09 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.775894388s
Average Latency	395.431897ms
Throughput	125.70 requests/second

[github-actions]

X-Test Results

✅ go-pull-3257
✅ go-v0.9.0
✅ java-pull-3257
✅ java-v0.9.0
✅ js-pull-3257
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformZ7N86P.dockerbuild