fix(ci): Add comment if govulncheck fails

.github/workflows/checks.yaml

@@ -69,11 +69,24 @@ jobs:
       - run: go work use .
         if: env.IS_RELEASE_BRANCH == 'true'
         working-directory: ${{ matrix.directory }}
-      - name: govluncheck
+      - name: govulncheck
+        id: govulncheck
+        continue-on-error: true
         uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
         with:
           go-version-input: "1.25.7"
           work-dir: ${{ matrix.directory }}
+      - if: steps.govulncheck.outcome == 'failure'
+        run: echo "$MODULE_DIR" > "/tmp/govulncheck-failure-${JOB_INDEX}.txt"
+        env:
+          MODULE_DIR: ${{ matrix.directory }}
+          JOB_INDEX: ${{ strategy.job-index }}
+      - if: steps.govulncheck.outcome == 'failure'
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+        with:
+          name: govulncheck-failure-${{ strategy.job-index }}
+          path: /tmp/govulncheck-failure-${{ strategy.job-index }}.txt
+          retention-days: 1
       - name: golangci-lint
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
@@ -104,6 +117,58 @@ jobs:
         run: git diff-files --quiet --ignore-submodules
         if: env.IS_RELEASE_BRANCH == 'false'
 
+  comment-govulncheck:
+    if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork && !cancelled()
+    permissions:
+      contents: read
+      pull-requests: write
+    needs: go
+    runs-on: ubuntu-22.04
+    steps:
+      - name: download govulncheck failures
+        id: download
+        continue-on-error: true
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          pattern: govulncheck-failure-*
+          path: govulncheck-failures
+          merge-multiple: true
+      - name: build comment body
+        id: comment-body
+        if: steps.download.outcome == 'success'
+        env:
+          RUN_ID: ${{ github.run_id }}
+          SERVER_URL: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+        run: |
+          modules=$(find govulncheck-failures -name '*.txt' | sort | while IFS= read -r f; do echo "- \`$(cat "$f")\`"; done)
+          run_url="${SERVER_URL}/${REPO}/actions/runs/${RUN_ID}"
+          body="## :warning: Govulncheck found vulnerabilities :warning:
+
+          The following modules have known vulnerabilities:
+
+          ${modules}
+
+          See the [workflow run](${run_url}) for details."
+          {
+            echo "body<<EOF"
+            echo "$body"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+      - name: post govulncheck comment
+        if: steps.download.outcome == 'success'
+        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
+        with:
+          header: govulncheck-results
+          recreate: true
+          message: ${{ steps.comment-body.outputs.body }}
+      - name: delete govulncheck comment
+        if: steps.download.outcome != 'success'
+        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987 # v3.0.2
+        with:
+          header: govulncheck-results
+          delete: true
+
   integration:
     permissions:
       contents: read