From 1432c70fe5b767fbbb860ca80063fff302966dd0 Mon Sep 17 00:00:00 2001 From: Elizabeth Healy Date: Fri, 3 Apr 2026 12:15:55 -0400 Subject: [PATCH 1/2] continue on error and comment --- .github/workflows/checks.yaml | 71 ++++++++++++++++++++++++++++++++++- 1 file changed, 70 insertions(+), 1 deletion(-) diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml index 7f103da443..dee9a4569a 100644 --- a/.github/workflows/checks.yaml +++ b/.github/workflows/checks.yaml @@ -69,7 +69,9 @@ jobs: - run: go work use . if: env.IS_RELEASE_BRANCH == 'true' working-directory: ${{ matrix.directory }} - - name: govluncheck + - name: govulncheck + id: govulncheck + continue-on-error: true uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4 with: go-version-input: "1.25.7" @@ -104,6 +106,73 @@ jobs: run: git diff-files --quiet --ignore-submodules if: env.IS_RELEASE_BRANCH == 'false' + comment-govulncheck: + if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork && !cancelled() + permissions: + contents: read + pull-requests: write + needs: go + runs-on: ubuntu-22.04 + steps: + - name: post or update PR comment + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + script: | + const marker = ''; + const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`; + + // Check workflow run annotations for govulncheck warnings + const { data: jobs } = await github.rest.actions.listJobsForWorkflowRun({ + owner: context.repo.owner, + repo: context.repo.repo, + run_id: context.runId, + }); + const failures = jobs.jobs + .filter(j => j.name.startsWith('go (') && j.steps?.some(s => s.name === 'govulncheck' && s.conclusion === 'failure')) + .map(j => j.name.match(/^go \((.+)\)$/)?.[1]) + .filter(Boolean); + + // Find existing comment by marker + const { data: comments } = await github.rest.issues.listComments({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + }); + const existing = comments.find(c => c.body.includes(marker)); + + if (failures.length > 0) { + const modules = failures.map(m => `- \`${m}\``).join('\n'); + const body = [ + marker, + '## Govulncheck found vulnerabilities\n', + 'The following modules have known vulnerabilities:\n', + modules, + `\nSee the [workflow run](${runUrl}) for details.`, + ].join('\n'); + + if (existing) { + await github.rest.issues.updateComment({ + owner: context.repo.owner, + repo: context.repo.repo, + comment_id: existing.id, + body, + }); + } else { + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + body, + }); + } + } else if (existing) { + await github.rest.issues.deleteComment({ + owner: context.repo.owner, + repo: context.repo.repo, + comment_id: existing.id, + }); + } + integration: permissions: contents: read From bf7ba200b2e53d1b961d807cfe20976ce46647d4 Mon Sep 17 00:00:00 2001 From: Elizabeth Healy Date: Fri, 3 Apr 2026 12:33:15 -0400 Subject: [PATCH 2/2] remove extra job, just bypass for now --- .github/workflows/checks.yaml | 67 ----------------------------------- 1 file changed, 67 deletions(-) diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml index dee9a4569a..32f668b693 100644 --- a/.github/workflows/checks.yaml +++ b/.github/workflows/checks.yaml @@ -106,73 +106,6 @@ jobs: run: git diff-files --quiet --ignore-submodules if: env.IS_RELEASE_BRANCH == 'false' - comment-govulncheck: - if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork && !cancelled() - permissions: - contents: read - pull-requests: write - needs: go - runs-on: ubuntu-22.04 - steps: - - name: post or update PR comment - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const marker = ''; - const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`; - - // Check workflow run annotations for govulncheck warnings - const { data: jobs } = await github.rest.actions.listJobsForWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId, - }); - const failures = jobs.jobs - .filter(j => j.name.startsWith('go (') && j.steps?.some(s => s.name === 'govulncheck' && s.conclusion === 'failure')) - .map(j => j.name.match(/^go \((.+)\)$/)?.[1]) - .filter(Boolean); - - // Find existing comment by marker - const { data: comments } = await github.rest.issues.listComments({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - }); - const existing = comments.find(c => c.body.includes(marker)); - - if (failures.length > 0) { - const modules = failures.map(m => `- \`${m}\``).join('\n'); - const body = [ - marker, - '## Govulncheck found vulnerabilities\n', - 'The following modules have known vulnerabilities:\n', - modules, - `\nSee the [workflow run](${runUrl}) for details.`, - ].join('\n'); - - if (existing) { - await github.rest.issues.updateComment({ - owner: context.repo.owner, - repo: context.repo.repo, - comment_id: existing.id, - body, - }); - } else { - await github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body, - }); - } - } else if (existing) { - await github.rest.issues.deleteComment({ - owner: context.repo.owner, - repo: context.repo.repo, - comment_id: existing.id, - }); - } - integration: permissions: contents: read