fix(ci): Add comment if govulncheck fails

.github/workflows/checks.yaml

@@ -69,11 +69,21 @@
       - run: go work use .
         if: env.IS_RELEASE_BRANCH == 'true'
         working-directory: ${{ matrix.directory }}
-      - name: govluncheck
+      - name: govulncheck
+        id: govulncheck
+        continue-on-error: true
         uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
         with:
           go-version-input: "1.25.7"
           work-dir: ${{ matrix.directory }}
+      - if: steps.govulncheck.outcome == 'failure'
+        run: echo "${{ matrix.directory }}" > /tmp/govulncheck-failure.txt
+      - if: steps.govulncheck.outcome == 'failure'
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+        with:
+          name: govulncheck-failure-${{ strategy.job-index }}
+          path: /tmp/govulncheck-failure.txt
+          retention-days: 1
       - name: golangci-lint
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
@@ -104,6 +114,78 @@
         run: git diff-files --quiet --ignore-submodules
         if: env.IS_RELEASE_BRANCH == 'false'
 
+  comment-govulncheck:
+    if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork && !cancelled()
+    permissions:
+      contents: read
+      pull-requests: write
+    needs: go
+    runs-on: ubuntu-22.04
+    steps:
+      - name: download govulncheck failures
+        id: download
+        continue-on-error: true
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          pattern: govulncheck-failure-*
+          path: govulncheck-failures
+          merge-multiple: true
+      - name: post or update PR comment
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- govulncheck-results -->';
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+
+            // Read failing module names from downloaded artifacts
+            let failures = [];
+            if ('${{ steps.download.outcome }}' === 'success') {
+              const files = fs.readdirSync('govulncheck-failures').filter(f => f.endsWith('.txt'));
+              failures = files.map(f => fs.readFileSync(`govulncheck-failures/${f}`, 'utf8').trim()).sort();
+            }
+
+            // Find existing comment by marker
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+
+            if (failures.length > 0) {
+              const modules = failures.map(m => `- \`${m}\``).join('\n');
+              const body = [
+                marker,
+                '## Govulncheck found vulnerabilities\n',
+                'The following modules have known vulnerabilities:\n',
+                modules,
+                `\nSee the [workflow run](${runUrl}) for details.`,
+              ].join('\n');
+
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  comment_id: existing.id,
+                  body,
+                });
+              } else {
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.issue.number,
+                  body,
+                });
+              }
+            } else if (existing) {
+              await github.rest.issues.deleteComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+              });
+            }
+
   integration:
     permissions:
       contents: read