[leet-c1]

Problem

Since #159 (2026-10-21) routed release-preflight through locked-tools, only the pinned Go's bin is on PATH. The "Check for known vulnerabilities" step runs go install golang.org/x/vuln/cmd/govulncheck@v1.7.0, which writes the binary to GOBIN or the first GOPATH entry's bin. The next line then fails with govulncheck: command not found (exit 127). Every release with go_vulnerability_scan: true stops in preflight before building. ConductorOne/c1i's v0.10.0 release hit this twice (run 42847996674); its v0.9.2 released on the workflow version from before #159.

Fix

Call the binary at the path go install uses: $(go env GOBIN), else the first entry of $(go env GOPATH) plus /bin. Four lines, in that one step.

Compatibility

• The step only runs with go_vulnerability_scan: true, which defaults to false. No other input, output, permission or job changes.
• For callers with it on, the step failed every time, so nothing that passes today can start failing.
• The one behaviour change: a govulncheck already on PATH can no longer shadow the pinned v1.7.0.

Verified

The step's script was extracted from the workflow and run against ConductorOne/c1i at v0.10.0. The environment matched the runner's: only the locked Go 1.27.3 on PATH, GOTOOLCHAIN=local, GOFLAGS=-mod=readonly, and a fresh HOME.

Setup	Before	After
GOPATH unset	127	0
GOPATH single entry	127	0
GOPATH multi-entry	127	0
GOBIN set	127	0
govulncheck already on PATH	0	0

python3 scripts/test-tool-integrity.py (28 OK, 1 skipped), go vet ./..., go test ./... and make test-scripts pass. The PowerShell tests were skipped because there's no pwsh locally. Nothing asserts on this step's text, and the README and docs/release-workflow.md describe only the input, so they stay accurate. Callers pick up the fix once v4 moves past it.

🤖 Generated with Claude Code

[github-actions]

Superseded — see the current review report for commit 627c410f6474

General PR Review: Run govulncheck by path in release preflight

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base 226b66f5bc03.
Review mode: full
View review run

Review Summary

The "Check for known vulnerabilities" step in release-preflight (.github/workflows/release.yaml:379-392) now runs govulncheck by its full path. That path is $(go env GOBIN) if set, otherwise the first GOPATH entry plus /bin, which is where go install puts the binary. Before, the step looked for govulncheck on PATH, and locked-tools doesn't put that directory there. I scanned the full PR diff, a single 4-line hunk, for security and correctness problems. The path logic matches where go install writes. ${gopath%%:*} uses : as the list separator, which is right because the job runs on ubuntu-latest (release.yaml:268). set -euo pipefail still makes failures in go env fatal. Nothing else in the repo calls govulncheck from PATH. No repo-local criteria loaded, so I used only the base criteria. Inputs, outputs, permissions and job structure are unchanged, so callers keep the same interface.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

General PR Review: Run govulncheck by path in release preflight

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base 226b66f5bc03.
Review mode: full
View review run

Review Summary

The "Check for known vulnerabilities" step in release-preflight (.github/workflows/release.yaml:379-392) now runs govulncheck by its full path. That path is $(go env GOBIN) if set, otherwise the first GOPATH entry plus /bin, which is where go install puts the binary. Before, the step looked for govulncheck on PATH, and locked-tools doesn't put that directory there. I scanned the full PR diff, a single 4-line hunk, for security and correctness problems. The path logic matches where go install writes. ${gopath%%:*} uses : as the list separator, which is right because the job runs on ubuntu-latest (release.yaml:268). set -euo pipefail still makes failures in go env fatal. Nothing else in the repo calls govulncheck from PATH. No repo-local criteria loaded, so I used only the base criteria. Inputs, outputs, permissions and job structure are unchanged, so callers keep the same interface.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

---

Reviewed commit: 627c410f6474

[github-actions]

No blocking issues found — see the full review report