From 59401365bd0819271fb061555e56a3a632fa8ab2 Mon Sep 17 00:00:00 2001
From: carddev81 <rich@unlockedlabs.org>
Date: Wed, 11 Nov 2026 12:06:04 -0600
Subject: [PATCH 1/2] ci: run govulncheck on PRs only and alert Slack with the
 PR details (EN-251)

---
 .github/workflows/govulncheck.yml | 72 +++++++++++++++++++++++++------
 1 file changed, 58 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 9883bcf..e9bf22c 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -1,14 +1,12 @@
 name: govulncheck
 
 # Checks the code, its dependencies and the Go version it builds with against
-# the Go vulnerability database. It runs on every push, and every Monday so main
-# is checked for vulnerabilities published since its last push. When main fails
-# and the repository can see a SLACK_WEBHOOK_URL secret, it posts to Slack.
+# the Go vulnerability database on every PR, so vulnerabilities are fixed
+# before they reach main, as unlocked-core's PR scan does. Vulnerabilities fail
+# the check and, when the repository can see a SLACK_WEBHOOK_URL secret, post
+# to #unlockedv2-alerts.
 on:
-  push:
-    branches: ['**']
-  schedule:
-    - cron: '0 14 * * 1'
+  pull_request:
   workflow_dispatch:
 
 permissions:
@@ -18,6 +16,7 @@ jobs:
   govulncheck:
     name: govulncheck
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -28,20 +27,65 @@ jobs:
           # cached on the runner.
           check-latest: true
       - run: go install golang.org/x/vuln/cmd/govulncheck@v1.9.0
-      - run: '"$(go env GOPATH)/bin/govulncheck" ./...'
+
+      # govulncheck exits 3 when it finds vulnerabilities, and with another
+      # non-zero code when it couldn't check, such as a module download error.
+      # Only the first is reported as vulnerabilities, and only it goes to Slack.
+      - name: Run govulncheck
+        id: scan
+        run: |
+          set +e
+          "$(go env GOPATH)/bin/govulncheck" ./... > govulncheck.txt 2>&1
+          code=$?
+          cat govulncheck.txt
+          echo "exit_code=$code" >> "$GITHUB_OUTPUT"
+          case $code in
+            0) ;;
+            3) echo "::error::govulncheck found vulnerabilities"; exit 1 ;;
+            *) echo "::error::govulncheck couldn't finish (exit $code), so nothing was checked. Re-run the job."; exit 1 ;;
+          esac
 
       - name: Tell Slack
-        if: failure() && github.ref == 'refs/heads/main'
+        if: failure() && steps.scan.outputs.exit_code == '3' && github.event_name == 'pull_request'
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-          TEXT: >-
-            ${{ github.repository }}: govulncheck failed on main.
-            ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
           if [[ -z "$SLACK_WEBHOOK_URL" ]]; then
             echo "::notice::SLACK_WEBHOOK_URL isn't set, so nothing was posted to Slack"
             exit 0
           fi
-          jq -n --arg text "$TEXT" '{text: $text}' \
+          details=$(head -c 2000 govulncheck.txt)
+          if [[ $(wc -c < govulncheck.txt) -gt 2000 ]]; then
+            details+="... (truncated, see full output in workflow logs)"
+          fi
+          text=$(cat <<EOF
+          :rotating_light: *SECURITY VULNERABILITIES DETECTED* :rotating_light:
+
+          Repository: $REPO
+          PR: #$PR_NUMBER - $PR_TITLE
+          Author: $PR_AUTHOR
+          Branch: $PR_BRANCH
+
+          This PR contains Go security vulnerabilities and has been blocked from merging until fixed.
+
+          *Vulnerability Details:*
+          $details
+
+          :wrench: *Actions needed:*
+          1. Bump the go line in go.mod if the fix is in the standard library, or update the module: \`go get <module>@<safe-version>\`
+          2. Push updates to the PR
+
+          *PR Link:* $PR_URL
+          EOF
+          )
+          jq -n --arg text "$text" \
+            '{channel: "#unlockedv2-alerts", username: "Security Bot", icon_emoji: ":warning:", text: $text}' \
             | curl --fail --silent --show-error --max-time 10 \
-                -H 'Content-Type: application/json' --data @- "$SLACK_WEBHOOK_URL"
+                -H 'Content-Type: application/json' --data @- "$SLACK_WEBHOOK_URL" \
+            || echo "::warning::Failed to send the Slack notification"

From dc97e24b9a2524845d31d306087820eb48e2db7c Mon Sep 17 00:00:00 2001
From: carddev81 <rich@unlockedlabs.org>
Date: Wed, 11 Nov 2026 12:06:28 -0600
Subject: [PATCH 2/2] fix: build with Go 1.26.11 for GO-2026-6859 (EN-251)

---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index a5224da..f42104a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/UnlockedLabs/unlocked-provider-platforms
 
-go 1.26.10
+go 1.26.11
 
 require (
 	github.com/UnlockedLabs/unlocked-contracts v0.4.0