From 627c410f6474ca696c7e6fe82d8bc2a36be3d31c Mon Sep 17 00:00:00 2001 From: leet-c1 <264029741+leet-c1@users.noreply.github.com> Date: Wed, 11 Nov 2026 00:00:59 +0000 Subject: [PATCH] Run govulncheck by path in release preflight Since #159 routed release-preflight through locked-tools, only the pinned Go's bin is on PATH. `go install` still writes govulncheck to GOBIN or the first GOPATH entry's bin, so the next line failed with `govulncheck: command not found` (exit 127) and every release with go_vulnerability_scan: true stopped before building. Call the binary at the path go install uses. Callers with the input off (the default) never run this step; for callers with it on, the step failed every time, so nothing that passes today changes, and a govulncheck already on PATH can no longer shadow the pinned v1.7.0. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 65f6f19..8c9ceb7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -383,8 +383,12 @@ jobs: run: | set -euo pipefail go install golang.org/x/vuln/cmd/govulncheck@v1.7.0 + # locked-tools does not put GOBIN or GOPATH/bin on PATH. + gopath="$(go env GOPATH)" + bin="$(go env GOBIN)" + bin="${bin:-${gopath%%:*}/bin}" for goos in linux darwin windows; do - GOOS="$goos" govulncheck ./... + GOOS="$goos" "$bin/govulncheck" ./... done goreleaser-binaries: