feat(ci): add govulncheck workflow

[Quang Nguyen (nddq)]

Description

Trivy and Dependabot match Go module versions against advisory ranges; neither can tell whether the vulnerable code is reachable. This PR adds a govulncheck workflow: it builds the call graph and reports a vulnerability only when an affected function is reachable from retina code.

How it runs:

• Scans linux and windows on PRs, merge groups, pushes to main, and a daily cron. Not a required check.
• The scanner is pinned through the go.mod tool block and built from the module graph, so go.sum verifies it and dependabot bumps it. The vulnerability database is fetched from vuln.go.dev at run time, so a pinned scanner still sees new advisories immediately.
• setup-go installs the golang version parsed from controller/Dockerfile, so findings track the toolchain the shipped images build with and follow dependabot's golang-base bumps automatically.
• The scan step separates findings (govulncheck exit status 3) from operational failures; the job summary carries the full output and the error annotation states which case occurred.
• Runs on main also upload SARIF to code scanning under per-goos categories (govulncheck-linux / govulncheck-windows), so findings surface as code-scanning alerts next to trivy's and close automatically when they clear. PR and merge-queue runs skip the upload — alerts track main, and fork PR tokens lack security-events: write.

The first runs are red with 5 findings per leg:

• GO-2026-4316 — go-chi/chi v4: pkg/server still imports the v4 middleware package; migrating it to chi/v5 (already in go.mod) clears this. Follow-up PR.
• GO-2026-5932 — x/crypto/openpgp: unmaintained, no fix will exist; pulled in by helm.sh/helm/v3 provenance code.
• GO-2026-5622, GO-2026-5338, GO-2026-5064 — containerd v1 line: fixed only in containerd/v2, which helm v3 does not use.

Related Issue

N/A.

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

Both legs validated locally at go1.26.5: 5 findings each, matching CI. arm64 matched amd64 finding-for-finding, so the matrix covers goos only.

The SARIF path was validated end to end from a dispatch run with a temporarily widened gate (run 31718757480): both legs generated and uploaded SARIF, and the code-scanning API records both analyses (govulncheck-linux / govulncheck-windows, tool govulncheck, 5 results and 5 rules each). Locally, the SARIF output contains only error-level results for reachable findings, so the upload needs no filtering.

actionlint passes on the workflow file.

Additional Notes

Complements trivy rather than replacing it: image and compliance scanning stay with trivy; govulncheck adds the reachability signal for Go code.

[github-actions]

Retina Code Coverage Report

Total coverage no change

Increased diff

Impacted Files	Coverage
pkg/controllers/operator/retinaendpoint/retinaendpoint_controller.go	82.25% ... 83.28% (1.03%)	⬆️
pkg/controllers/daemon/namespace/namespace_controller.go	76.24% ... 78.46% (2.22%)	⬆️

[Copilot]

Pull request overview

Adds reachability-aware Go vulnerability scanning to complement Trivy and Dependabot.

Changes:

• Scans Linux and Windows builds with govulncheck.
• Publishes summaries and main-branch SARIF results.
• Creates deduplicated dependency issues on failures.

Suppressed comments (2)

.github/workflows/govulncheck.yaml:74

• steps.scan.outcome is failure for both vulnerability findings and operational failures (for example, package-loading or network errors), so this annotation can falsely claim that vulnerabilities were found. Either capture and distinguish govulncheck's finding exit status from other failures, or use a neutral failure message.

            echo "::error::govulncheck found reachable vulnerabilities (GOOS=${GOOS}); see the job summary"

.github/workflows/govulncheck.yaml:92

• This files a reachable-vulnerability issue for any failure in either matrix leg, including checkout/setup/install errors, package-load failures, timeouts, SARIF generation errors, or upload outages. That creates a false dependency alert when the scan did not actually report a vulnerability. Propagate a dedicated “vulnerabilities found” signal from the text scan (the current tool uses exit status 3) through a matrix-safe aggregate, and gate this job on that signal while leaving operational failures as ordinary job failures.

    if: failure() && github.ref == 'refs/heads/main'

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.