Let the nightly scan fail instead of swallowing the exit code

[mzihlmann]

govulncheck exits 3 on a finding, but piping it into tee returned tee's status, and github's default shell is bash -e without pipefail, so the run stayed green.

Last night's scan did find the five reachable stdlib issues from go1.26.6 and reported success, no issue filed.

The pipe is gone, govulncheck writes to the log anyway. The issue creation is gone too, it had no dedupe so it would have opened one issue per night for as long as an advisory stands. A failed scheduled run notifies whoever last touched the cron, which is enough. issues: write dropped with it.

Summary by CodeRabbit

• Chores
  • Updated nightly vulnerability scanning to report results directly without automatically creating issue tickets.
  • Reduced workflow permissions used by the security scan.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 23c8e2b2-4235-47ae-9000-c4e2044da049

📥 Commits

Reviewing files that changed from the base of the PR and between a0f14df and 6bd30b6.

📒 Files selected for processing (1)

• .github/workflows/nightly-vulnerability-scan.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The nightly vulnerability scan workflow now runs govulncheck ./... directly. It no longer captures scan output or creates GitHub issues from failed scans.

Changes

Vulnerability scan workflow

Layer / File(s)	Summary
Direct scan execution .github/workflows/nightly-vulnerability-scan.yaml	The workflow runs govulncheck ./... directly and removes output capture for issue creation.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 6bd30

The workflow now propagates vulnerability-scan failures and removes redundant issue creation and permissions; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: the nightly vulnerability scan now preserves the failure exit code instead of masking it.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-vuln-scan

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}