chore(ci): govulncheck will only fail if PR adds a new vulnerability - #7405
Merged
electron0zero merged 2 commits intoJun 4, 2026
Merged
Conversation
Adds a govulncheck workflow that fails a PR only for reachable vulnerabilities the PR newly introduces, replacing the previous absolute scan in ci.yml. It scans the PR head and the base branch and diffs the results, so a CVE already present in main shows up in both scans and is filtered out, so it doesn't fail the check.
electron0zero
requested review from
carles-grafana,
ie-pham,
javiermolinar,
mapno,
mattdurham,
mdisibio,
oleg-kozlyuk-grafana,
ruslan-mikhailov,
stoewer,
yvrhdn,
zalegrala and
zhxiaogg
as code owners
June 4, 2026 15:28
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a dedicated govulncheck PR workflow that compares reachable vulnerability findings between the PR (merge ref) and the base branch, and removes the previous always-on govulncheck job from the main CI workflow to avoid failing PRs on pre-existing vulns in main.
Changes:
- Introduces a new
govulncheck.ymlworkflow that scans both PR and base and fails only if the PR introduces new reachable vulnerabilities. - Removes the previous
golang/govulncheck-actionjob fromci.yml.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/govulncheck.yml | New PR gate workflow that diffs govulncheck results between PR and base. |
| .github/workflows/ci.yml | Removes the old govulncheck job now replaced by the dedicated workflow. |
electron0zero
force-pushed
the
govulncheck-pr-diff-gate
branch
from
June 4, 2026 15:35
789d51e to
58e0469
Compare
electron0zero
force-pushed
the
govulncheck-pr-diff-gate
branch
from
June 4, 2026 15:41
58e0469 to
67d5d0f
Compare
electron0zero
force-pushed
the
govulncheck-pr-diff-gate
branch
from
June 4, 2026 15:57
1142335 to
67d5d0f
Compare
electron0zero
enabled auto-merge (squash)
June 4, 2026 16:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does:
Adds a govulncheck workflow that fails a PR only for reachable vulnerabilities the PR newly introduces, replacing the previous absolute scan in
ci.yml. It scans the PR head and the base branch and diffs the results, so a CVE already present inmainshows up in both scans and is filtered out, so it doesn't fail the check.Checklist
.chloggen/(N/A - CI-only change,chore:title skips the changelog gate)